Role data management method and device based on three members of the system

Abstract

The present invention provides a role data management method and device based on three system members, which relates to the technical field of data security management, including: determining the operation requirements of a target user based on the role type set by the target user in advance according to a system administrator and the operation instructions input by the target user; calling a target audit role to audit the operation requirements according to the requirement type of the operation requirements; storing the operation records and audit records corresponding to the operation requirements in the audit log of the target audit role, so that the target audit role audits the operations of the target user and the operations of the target audit role according to the audit log; managing the role data of the target user according to the audit results of the target audit role; the present invention audits each user operation without affecting data security, so as to alleviate the technical problems that the reliability of user operations cannot be controlled in the prior art and data is easily leaked.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and in particular to a role data management method and device based on three system members. Background Art

[0002] The massive amount of information collected from social media, news websites and other platforms is usually stored in the database of an information data platform. With the development of science and technology, there are currently applications of information data platforms that have high requirements for the confidentiality of each user's data acquisition, data management rights or data operations. The inventors have found that due to the high requirements of such platforms for data security, it is impossible to accurately detect whether the operations performed by such users are compliant.

[0003] Generally speaking, the compliance of each platform user's operation can be checked through the super administrator of the information data platform, but the settings of the super administrator will affect the implementation of data security requirements of such information data platforms, and the operations of the super administrator cannot be controlled. Summary of the invention

[0004] The purpose of the present invention is to provide a role data management method and device based on three system members, which can audit each user operation without affecting data security, so as to alleviate the technical problems in the prior art that the reliability of user operations cannot be controlled and the data is easily leaked.

[0005] In a first aspect, an embodiment of the present invention provides a role data management method based on three system members, the method is applied to an information data platform, the information data platform includes a system administrator, multiple system auditors, multiple system auditors, multiple business auditors and multiple secondary auditors; including:

[0006] Based on at least one role type set by the target user in advance according to the system administrator and the operation instruction input by the target user, determine the current role type of the target user, and the operation requirements for the target data obtained from the information data platform under the current role type and the operation instruction; wherein the role type includes one or more of the following: system administrator, system auditor, system auditor, business auditor and secondary auditor;

[0007] According to the requirement type of the operation requirement, calling the target audit role to audit the operation requirement; wherein the target audit role includes a system auditor and a business auditor;

[0008] The operation records and audit records corresponding to the operation requirements are stored in the audit log of the target audit role, so that the target audit role audits the operations of the target user and the operations of the target audit role according to the audit log; wherein the target audit role includes a system auditor and a secondary auditor;

[0009] The role data of the target user is managed according to the audit result of the target audit role.

[0010] In combination with the first aspect, an embodiment of the present invention provides a first possible implementation of the first aspect, wherein the step of determining the current role type of the target user based on at least one role type pre-set by the target user according to a system administrator and an operation instruction input by the target user, and the operation requirements for the target data obtained from the information data platform under the current role type and the operation instruction includes:

[0011] According to the adding operation of the target user by the system administrator, at least one role type corresponding to the target user is determined;

[0012] Matching the operation instruction input by the target user with the role type corresponding to the target user to determine the current role type of the target user when the operation instruction is input;

[0013] Based on the operation instruction input by the target user and the current role type of the target user, the operation requirement of the target user on the system data or the business data is determined.

[0014] In combination with the first aspect, an embodiment of the present invention provides a second possible implementation of the first aspect, wherein, according to the requirement type of the operation requirement, the step of calling the target review role to review the operation requirement includes:

[0015] If the target user's operation requirement is an operation type for system data, calling a system auditor to review the target user's operation requirement;

[0016] If the operation requirement of the target user is an operation type for business data, a target business auditor is called to audit the operation requirement of the target user; wherein the target business auditor and the target user are in the same department.

[0017] In combination with the first aspect, an embodiment of the present invention provides a third possible implementation manner of the first aspect, wherein the step of storing the operation record and the audit record corresponding to the operation requirement in the audit log of the target audit role so that the target audit role audits the operation of the target user and the operation of the target audit role according to the audit log includes:

[0018] Store operational records and audit records of operational requirements for system data in the system auditor's audit log;

[0019] According to the audit log and the control instruction of the system auditor, the execution of the operation requirement and the audit operation of the system auditor on the execution of the operation requirement are audited respectively.

[0020] In combination with the first aspect, an embodiment of the present invention provides a fourth possible implementation of the first aspect, wherein the step of storing the operation record and the audit record corresponding to the operation requirement in the audit log of the target audit role so that the target audit role audits the operation of the target user and the operation of the target audit role according to the audit log includes:

[0021] storing operation records and audit records for operation requirements of business data in the audit log of the secondary auditor; wherein the secondary auditor who audits the target user and the target user are located in the same department;

[0022] According to the audit log and the control instruction of the secondary auditor, the execution of the operation requirement and the audit operation of the business auditor on the execution of the operation requirement are audited respectively.

[0023] In combination with the first aspect, an embodiment of the present invention provides a fifth possible implementation manner of the first aspect, wherein the step of auditing the execution of the operation requirement and the audit operation of the business auditor on the execution of the operation requirement respectively according to the audit log and the control instruction of the secondary auditor includes:

[0024] When preset keywords are identified from the audit log, the secondary auditor is triggered to automatically audit the execution of the target user's operation requirements in the audit log and the business auditor's audit operation on the execution.

[0025] In combination with the first aspect, an embodiment of the present invention provides a sixth possible implementation of the first aspect, wherein the step of managing the role data of the target user according to the audit result of the target audit role includes:

[0026] If the target user's operation requirement execution status and the business auditor's audit of the execution status are both audited, the target user is granted the authority to manage the role data corresponding to the current role type when the operation instruction is input;

[0027] If the target user's operational requirements execution status or the business auditor's audit of the execution status fails or the audit times out, the target user's authority to manage role data corresponding to the current role type when entering the operational instruction is locked.

[0028] In combination with the first aspect, the embodiment of the present invention provides a seventh possible implementation of the first aspect, wherein the method further includes:

[0029] A system administrator adds at least one role type to the target user, wherein the role type has corresponding permissions;

[0030] Use the system auditor to verify the permissions corresponding to the role type set by the target user;

[0031] If the verification is successful, the role type of the target user and the corresponding permissions of the role type are added successfully.

[0032] In combination with the first aspect, an embodiment of the present invention provides an eighth possible implementation manner of the first aspect, wherein, before the step of determining the operation requirement of the target user based on the role type pre-set by the target user according to the system administrator and the operation instruction input by the target user, the method further includes:

[0033] Get the key value corresponding to the current user;

[0034] Matching the key value with a preset key value corresponding to the current user to verify the identity of the current user;

[0035] If the match is successful, the current user who has passed the identity authentication is determined as the target user.

[0036] In a second aspect, an embodiment of the present invention further provides a role data management device based on three system members, the device is applied to an information data platform, the information data platform includes a system administrator, multiple system auditors, multiple system auditors, multiple business auditors and multiple secondary auditors; including:

[0037] A determination module, based on at least one role type pre-set by the target user according to the system administrator and an operation instruction input by the target user, determines the current role type of the target user, and the operation requirements for the target data obtained from the information data platform under the current role type and the operation instruction; wherein the role type includes one or more of the following: system administrator, system auditor, system auditor, business auditor, and secondary auditor;

[0038] An audit module, according to the requirement type of the operation requirement, calls a target audit role to audit the operation requirement; wherein the target audit role includes a system auditor and a business auditor;

[0039] An audit module stores the operation records and audit records corresponding to the operation requirements in the audit log of the target audit role, so that the target audit role audits the operations of the target user and the operations of the target audit role according to the audit log; wherein the target audit role includes a system auditor and a secondary auditor;

[0040] A management module manages the role data of the target user according to the audit result of the target audit role.

[0041] The embodiment of the present invention brings a role data management method and device based on the three members of the system. For information data platforms with high data security requirements, the three members of the system are introduced; the system administrator configures at least one role for each target user, and each role corresponds to corresponding permissions; based on the operation instructions input by the target user and the role type corresponding to the target user, the target user's current expected operation requirements can be determined; according to the type of operation requirements, a target auditor is selected from the system auditor and the business auditor to review the operation requirements, and if the review is passed, the target user performs the operation that meets the operation requirements; on this basis, in order to further ensure the reliability of the audit operation, according to the type of operation requirements, the target auditor is selected from the system auditor and the secondary auditor to perform a double audit on the execution operation of the operation requirement and the audit operation of the target auditor for the operation requirement, and then according to the audit results, the role data of the role type corresponding to the current operation requirement of the target user is managed; the embodiment of the present invention does not need to introduce a role that can obtain relevant data of each user, and restricts each user's operation without affecting the data security of the platform.

[0042] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description and the drawings.

[0043] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flow chart of a role data management method based on three system members provided by an embodiment of the present invention;

[0046] Figure 2 A schematic diagram of functional modules of a role data management device based on three system members provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] The method can be applied to a database management system. The database management system includes an information data platform, which can be used for network data analysis. At present, the information data platform generally sets a super administrator to detect the operational compliance of various users. However, since the information data platform has high security requirements for each user's acquisition of data, data management authority or data operation, each user can only obtain the corresponding data according to their respective authority, while the super administrator can obtain the operation data of each user of the information data platform. Therefore, the setting of the super administrator will affect the data security requirements of such information data platform.

[0049] In addition, the super administrator's operations cannot be restricted. Once abnormal operations are performed, the data security of the information data platform will be affected.

[0050] Based on this, an embodiment of the present invention provides a role data management method and device based on three system members. By setting the three system members to omit the super administrator, the reliability of each user's operation can be guaranteed without affecting data security.

[0051] To facilitate understanding of this embodiment, firstly, a role data management method based on three system members disclosed in an embodiment of the present invention is introduced in detail. This method can be applied to information data platforms with high data security (data leakage prevention requirements);

[0052] It can be understood that the three system members in the information data platform include system administrators, system auditors and system auditors. The system administrator is used to manage each user role and authority, the system auditor is used to audit the preset important operations of the preset user roles, and the system auditor is used to perform two-way audits on the important operations performed by the preset user roles and the audit operations of the important operations; users with different roles such as the three system members can perform role data management operations through the visual interface configured on the corresponding client.

[0053] Figure 1 A role data management method based on three system members provided in an embodiment of the present invention comprises the following steps:

[0054] Step S102, based on at least one role type pre-set by the target user according to the system administrator and the operation instruction input by the target user, determine the current role type of the target user, and the operation requirements for the target data obtained from the information data platform under the current role type and the operation instruction.

[0055] Exemplarily, based on the role type set by the target user in advance according to the system administrator and the de-identified operation instruction input by the target user, the operation requirements of the target user for the information data platform with higher data security requirements are determined;

[0056] In order to meet the application requirements of information data platforms with high data security requirements involving sensitive information, the operation instructions input by each target user can be encrypted and de-identified. The correspondence between each input operation instruction and the target user can be known only through anonymization or pseudonymization, thereby achieving the purpose of minimizing the operation instruction data.

[0057] The target user can be understood as at least one user who has passed the security check. Each user corresponds to a preset key value. Each target user is set with at least one role type by the system administrator. The role types include ordinary users, system administrators, target reviewers, and target auditors.

[0058] The target user can input operation instructions through the visual interface of the client where he is located. The operation instructions are related to his role type and can determine the operation requirements of the target user; the operation requirements can be understood as the operations that the target user expects to take on some target data in the information data platform with higher data security based on the operation instructions;

[0059] Here, the method for determining whether the current user is the target user may include: obtaining a key value corresponding to the current user; matching the key value with a preset key value corresponding to the current user to verify the identity of the current user; if the match is successful, determining the current user who has passed the identity authentication as the target user.

[0060] Furthermore, the target data may include system data and business data. Based on the current role type and input operation instructions of the current user, its needs for different target data, namely system needs and business needs, can be known; the target data can be understood as system data and business data from the information data platform's own architecture. The business data also includes various types of network data collected from at least one third-party platform. The network data includes each network user's comments on real-time news, articles, videos, pictures, opinions of other network users, etc.; the operation requirements for the target data may include system requirements such as editing, modifying and viewing the system data of the information data platform's own architecture, business requirements such as editing, modifying and viewing the business data of the information data platform's own architecture, and business requirements such as monitoring of various types of network data collected from at least one third-party platform.

[0061] Step S104: According to the requirement type of the operation requirement, the target review role is called to review the operation requirement.

[0062] Among them, each operation requirement may include multiple requirement types, such as business requirement type and system requirement type; and the target audit role also includes system auditors and business auditors; in order to ensure the audit accuracy and efficiency of the audit operation, the corresponding target audit role is called for audit according to the corresponding operation requirement type.

[0063] It should be noted that only when the target review role passes the review of the operation requirement can the target user perform the corresponding operation according to the operation requirement. Otherwise, if the review fails, the target user cannot perform the operation that meets the operation requirement.

[0064] Here, the target review role can review the target data corresponding to the operation requirements, the tasks corresponding to the operation requirements, the operations corresponding to the operation requirements, and the role type of the target user who proposes the operation requirements;

[0065] For business auditors, they are mainly responsible for auditing the calling process of the corresponding business functions of the system, such as comparison and warning functions, modeling and analysis functions, data management functions, etc. For system auditors, they are mainly responsible for auditing system functions, such as system management functions, notification publishing functions, user management functions, role management functions, etc.

[0066] The business auditor has a limited audit scope, which is determined by the department of the target user corresponding to the role; that is, the audit scope of each business auditor is the department scope of the corresponding target user; each department may include at least one business auditor, and if the operation requirement to be audited in the department is approved by any business auditor, the operation requirement to be audited is deemed to have been approved.

[0067] Step S106, storing the operation record and the audit record corresponding to the operation requirement in the audit log of the target audit role, so that the target audit role audits the operation of the target user and the operation of the target audit role according to the audit log.

[0068] Here, the operation records corresponding to the operation requirements include the records of successful operations approved by the audit role, and the records of failed operations not approved by the audit role. The audit records can be understood as the records of the audit operations of the audit role on the operation requirements.

[0069] Among them, the target audit roles include system auditors and secondary auditors (business auditors); based on the demand type corresponding to the operation demand recorded in the aforementioned embodiment, the corresponding system auditor or secondary auditor is selected to jointly audit both the execution operation and the audit operation corresponding to the operation demand, so as to improve the audit reliability and audit efficiency; for example, if the operation demand involves business functions such as query and table lookup, the secondary auditor is responsible for the audit; if the operation demand involves system functions, the system auditor is responsible for the audit; the system auditor can view the operation requirements of each role of each user in each department, as well as the audit list corresponding to each secondary auditor in each department;

[0070] It should be noted that the system auditor and the secondary auditor have corresponding audit logs, which can be selected and stored in the corresponding audit logs according to the requirement type of the operation requirement to be audited, so that the system auditor or the secondary auditor can conduct the audit;

[0071] It should be noted that each second-level auditor has a limited audit scope, and the audit scope of the second-level auditor is determined by the department of the target user corresponding to the role; that is, the audit scope of each second-level auditor is the department scope of the corresponding target user; each department may include at least one second-level auditor, and if the audited operation requirement in the department is audited and approved by any second-level auditor, the audited operation requirement is deemed to have passed the audit.

[0072] As an optional embodiment, when there are operations of multiple users on multiple target users and operations of multiple target audit roles to be audited at the same time, the operations of each target user can be classified according to the machine learning model, and the current operations of each target user can be classified based on the role corresponding to each target user, and the risk event level corresponding to each operation can be marked; in order of risk event levels from high to low, the audit records of the target user's operation and the target audit role's operation are audited first, so as to reduce the time and resource consumption required for the audit;

[0073] For example, whether the operation of each target user under the current role passes the audit can be distinguished according to the asymmetric threshold of the behavior statistical model of each role of each target user;

[0074] A behavior statistical model of each target user is established based on the historical operation data of each role of each target user. Here, the operation frequency of the historical operation of each role of each target user can be described by normal distribution, the operation demand type of the historical operation of each role of each target user can be described by Poisson distribution, and the operation sequence of the historical operation of each role of each target user can be described by Markov model.

[0075] In some embodiments, a hybrid model may also be constructed to simultaneously capture the behavior patterns of different roles corresponding to the same target user;

[0076] In actual applications, if the operation frequency exceeds the expected normal distribution range, it is considered abnormal; if the operation demand type has never occurred, it is considered abnormal; if the operation sequence does not meet the prediction of the Markov model, it is considered abnormal. On this basis, in order to ensure that the behavior statistical model of each target user has the performance on unseen data and ensure the generalization ability of the model;

[0077] You can choose structures such as logistic regression, support vector machine, and decision tree to participate in the further construction of the above-mentioned behavioral statistical model; first, pre-set the regularization coefficient C in logistic regression, the kernel function type and kernel function parameters in the support vector machine, and other hyperparameters; specifically, use methods such as grid search or random search to traverse different combinations of hyperparameters and find the best hyperparameter settings; for example, grid search: systematically search the hyperparameters of the model to find the optimal parameter combination; random search: compared with grid search, random search is more efficient, especially when the hyperparameter space is large; Bayesian optimization: use more advanced methods such as Bayesian optimization to automatically find the optimal hyperparameter configuration;

[0078] Second, for each set of hyperparameters, use cross-validation to evaluate model performance; for example, K-fold cross-validation: divide the dataset for each set of hyperparameters into K subsets, and use one of the subsets as the validation set each time, and the remaining subsets as the training set to obtain a more stable estimate of model performance.

[0079] Step S108: managing the role data of the target user according to the audit result of the target audit role.

[0080] The audit operation is equivalent to a second audit operation after the first audit operation (the audit operation of step S104). The first audit operation is used to determine whether the target user can perform the operation corresponding to the operation requirement. The current audit operation is to audit the operation of performing the operation requirement and the first audit operation again, and then manage the role data of the target user according to the audit result.

[0081] It can be seen from the above embodiments that the target user may include multiple role types. Based on the operation instructions input by the target user, the current role type of the target user can be determined, and then the role data corresponding to the role type can be managed.

[0082] In a preferred embodiment of actual application, for an information data platform with high data security requirements, three system members are introduced; the system administrator configures at least one role for each target user, and each role corresponds to corresponding permissions; based on the operation instructions input by the target user and the role type corresponding to the target user, the target user's current expected operation requirements can be determined; according to the type of operation requirements, a target auditor is selected from the system auditor and the business auditor to review the operation requirements, and if the review is passed, the target user performs the operation that meets the operation requirements; on this basis, in order to further ensure the reliability of the audit operation, according to the type of operation requirements, the target auditor's execution operation on the operation requirement and the target auditor's audit operation on the operation requirement are selected from the system auditor and the secondary auditor to conduct a double audit, and then according to the audit results, the role data of the role type corresponding to the current operation requirements of the target user are managed; the embodiment of the present invention does not need to introduce a role that can obtain relevant data of each user, and restricts each user's operation without affecting the security of the platform.

[0083] In some embodiments, the operation requirements for review and audit are jointly determined by the role type corresponding to the target user and the operation instructions input by the target user; according to the operation requirements, the operation expectations of the target user can be known, and then it is judged whether the operation expectations are consistent with the target user, that is, the rationality of the operation expectations applied by the target user; illustratively, step S102 can determine the operation requirements in the following manner, including:

[0084] Step 1.1), according to the system administrator's adding operation on the target user, at least one role type corresponding to the target user is determined.

[0085] Specifically, as an optional embodiment, at least one role type can be added to the target user through the system administrator; wherein the role types include one or more of the following: system administrator, system auditor, system auditor, business auditor, and secondary auditor; each role type has corresponding permissions; secondly, the system auditor is used to verify the permissions corresponding to the role type set by the target user; if the verification is successful, the role type of the target user and the corresponding permissions of the role type are added successfully; otherwise, if the verification fails, the role type of the target user and the corresponding permissions fail to be added. The embodiment of the present invention implements verification from the beginning of the system administrator's role and permission addition process, that is, it ensures the reliability of each target user's addable roles and permissions, and further verifies the rationality of the operation requirements proposed by each target user based on such reliable permissions;

[0086] Among them, the system administrator's operation of adding a target user can be triggered according to the needs of the target user; when the target user has a target permission or a target role requirement, a corresponding request is sent to the system administrator, so that the system administrator can add the target role required by the target user to the target user according to the needs of the target user and set the target permission of the target user; if a target user is configured with multiple roles, each role has corresponding permissions, so that the permission set of each target user can be obtained, and the permission set includes the set of each permission of each role corresponding to the target user;

[0087] In actual applications, there is only one role type for system administrator, system auditor and system reviewer in the information data platform; the embodiment of the present invention randomly configures the system administrator, system auditor and system reviewer to one or more target users in advance; at this time, if there is a target user who applies to become a system administrator, system auditor or system reviewer, and the review is passed, then when the system administrator, system auditor or system reviewer is assigned to the new target user, the system administrator, system auditor or system reviewer role type and the permissions corresponding to such role types of the original target user will automatically become invalid; for example: when there is a system auditor, when the system administrator assigns the role to other target users, after approval, the system auditor role and corresponding permissions of the previous target user will automatically become invalid.

[0088] As an optional implementation example, the system administrator can also add a target user and bind the newly added target user to a department (the department comes from the organizational structure), a role and corresponding permissions. The newly added target user after the binding operation will only take effect after being reviewed and approved by the system auditor.

[0089] In step 1.2), the operation instruction input by the target user is matched with the role type corresponding to the target user to determine the current role type of the target user when the operation instruction is input.

[0090] Here, the current role type to which the inputted operation instruction corresponds can be determined from at least one role type corresponding to the target user according to the action type of the operation instruction and the data type targeted by the instruction; for example, if the action type of the operation instruction A is setting, and the data type targeted is the business auditor role of another target user and the corresponding permission data, then the inputted operation instruction A corresponds to the system administrator role type of the target user;

[0091] For example, the variables are defined as follows: U: represents the target user. U : represents the set of all roles of user U. I: represents the operation command input by the target user U. M(I, R U ): represents a function that accepts an operation instruction I and a set of role types R of user U U , and returns a role type that is most relevant to the current operation instruction I. C: represents the current role type, that is, the role type of user U when executing operation instruction I.

[0092] Combined with the above definitions, the entire solution of step 1.2) can be expressed as a function calculation process:

[0093] C = M(I, R U )

[0094] Among them, M(I, R U ) is a function that needs to be based on the role set R of user U U and operation instruction I to determine the current role type C.

[0095] To better understand how this function works, we can further decompose M(I, R U ) function internal implementation: R U ={"Administrator","User","Guest"},I="Delete user account";

[0096] M(I,R U ) can be defined as follows:

[0097]

[0098] in, is an evaluation function that accepts a role type r and an operation instruction I and returns a score indicating how suitable the role type r is for executing the operation instruction I. The role type with the highest score will be selected as the current role type C.

[0099] Evaluation Function Implementation:

[0100] Assumptions is a rule-based function that checks whether role type r has permission to perform operation instruction I. For example, if the operation instruction is to delete a user account, only the administrator role ("Administrator") has this permission. If role type r matches operation instruction I, then ,otherwise .

[0101] For example, if R U ={"Administrator","User","Guest"}, I="Delete user account", then f ("Administrator", "Delete User Account") = 1, f ("user", "delete user account") = 0, f ("Guest", "Delete User Account") = 0;

[0102] therefore, , C="Administrator".

[0103] Step 1.3), based on the operation instructions input by the target user and the current role type of the target user, determine the target user's operation requirements for system data or business data.

[0104] According to step 1.2) of the above embodiment, it is possible to obtain the currently input operation instruction and the role type of the target user at this time, and then obtain the target user's operation expectation for the data;

[0105] For example, according to the operation instruction of operation instruction A and the current role type of its system administrator, its operation requirement is to set a business auditor role and corresponding permissions for another target user.

[0106] In some embodiments, in addition to the system auditor role set by the information data platform, at least one business auditor role may be set for each target user in each department according to the functional organizational structure, so that such business auditor role has the authority to review the operation requirements of each target user within the respective department, which can ensure the internal data security of the department while improving the audit efficiency; illustratively, the step S104 can realize the division of labor review of operation requirements through the following steps, including:

[0107] Step 2.1), if the target user's operation requirement is an operation type for system data, call the system auditor to review the target user's operation requirement.

[0108] Here, the authority of the system auditor is to review the operational requirements for system data, and such operational requirements are reviewed by the system auditor role.

[0109] In step 2.2), if the target user's operation requirement is an operation type for business data, the target business auditor is called to review the target user's operation requirement.

[0110] The authority of a business auditor is to audit the operational requirements for business data, and the audit scope of each business auditor is the department where the target user corresponding to the role is located, that is, the auditor can only audit the operational requirements for business data of each target user in his or her department;

[0111] In actual applications, each department may include at least one business auditor. For a certain operation requirement B for business data in the department, a target business auditor may be selected from multiple business auditors to implement the audit operation; wherein the target business auditor and the target user are in the same department; the target business auditor may be determined from multiple business auditors based on the online status of the business auditor, the number of pending audits of each business auditor, and the accuracy of the audited operations of each business auditor. On the basis of the aforementioned embodiment, for the operation requirements for business data and system data respectively, the execution status and audit records of the operation requirements may be respectively assigned to different auditors to implement the audit operation to ensure audit efficiency and audit reliability, wherein the audit process for the system auditor may specifically include:

[0112] Step 3.1), store the operation records and audit records of the operation requirements for the system data in the audit log of the system auditor.

[0113] The target audit role is used to audit unqualified target users or manage the permissions or role data corresponding to the target user's current role type. If they are eliminated, the audit operation is equivalent to another audit based on the audit operation.

[0114] Step 3.2), based on the audit log and the control instructions of the system auditor, audit the execution of the operation requirements and the audit operation of the system auditor on the execution of the operation requirements.

[0115] As a preferred embodiment, each review role and each audit role can be clustered into a label and multiple sub-labels corresponding to the review / audit role according to its historical review / audit records; the label can know whether each review role tends to handle the review / audit for system operation requirements or the review / audit for business operation requirements; and the sub-labels are the various review / audit detailed categories with higher frequencies determined by the frequency of historical review / audit records under the label; for example, the system label can include detailed categories such as basic information, management system data, and processing system data; the business label can include network data from real-time news networks, business data operated by personnel on information data platforms, network data from self-media sources, etc.

[0116] Here, in addition to determining the target reviewer / target auditor in the above manner, a first preset number of target reviewers / target auditors may be determined according to the sub-tag and the current user's operation requirements for the target data, so that the first preset number of target reviewers / target auditors respectively review / audit the operation requirements; when the review / audit results of the second preset number (less than the first preset number) of target reviewers / target auditors are obtained, it is determined whether the review / audit is passed according to the consistency of the review / audit results (the majority of the review / audit results that remain consistent);

[0117] In actual applications, there are situations where the target auditor / auditor fails to conduct a review / audit in time; if the review / audit result of the second preset data is not obtained after the preset time period, the sensitivity of the target data, the operation instructions input by the user, and the current user role can be used as variables to consider the impact of the three on the review / audit operation, and a weight (Weight, W) is assigned to each variable. The higher the weight value, the greater the influence of the variable factor in the final decision. For example: sensitivity weight W S , operation instruction weight W A , current user role weight W R ; Determine the target reviewer / auditor according to the following formula:

[0118] Score=W S ×S+W A ×A+W R ×R

[0119] Among them, S is the quantitative value of sensitivity, A is the quantitative value of operation instructions, and R is the quantitative value of the current user role; the quantitative value can be understood as dividing the sensitivity, operation instructions, and current user role into multiple levels according to the sensitivity, the importance of the operation instructions, and the criticality of the current user role, and each level corresponds to a quantitative value. Alternatively, the above variable factors can be quantified according to the membership function of fuzzy logic.

[0120] It can be understood that the target auditor / auditor determined in this way has a high degree of precision matching, and accurate review / audit operations can be achieved only through a single target auditor / auditor, thereby improving review / audit efficiency.

[0121] It should be noted that if the current target auditor is a business auditor and the target auditor is a secondary auditor, then before participating in the above-mentioned target auditor / auditor calculation, the auditors / auditors in the same department as the alternative roles are screened out in advance through the functional department of the current user, and then the corresponding variables of such alternative roles are calculated according to the above-mentioned formula to determine the target business auditor / secondary auditor.

[0122] As an optional embodiment, the target audit role can intervene at any time to start the audit operation by recording all operations for the operation requirements (including execution operations and review operations) in the audit log of the corresponding target audit role so that the target audit role can audit them.

[0123] For example, if all operations corresponding to the login and operation requirements of multiple target users are recorded in the audit log, and an abnormal attack is encountered, that is, there is an abnormality in the operation in the audit log, then errors will be continuously reported for the abnormality; if the number of consecutive error reports exceeds the preset threshold, such as 5 times, the information data platform will analyze whether it is under attack at this time. If so, an alarm will be issued.

[0124] The target audit roles include multiple categories, such as system auditors and secondary auditors. Among them, the audit process for secondary auditors who audit the operational requirements of business data may include:

[0125] Step 4.1) Store the operation records and audit records for the operation requirements of the business data in the audit log of the secondary auditor.

[0126] Each department may include at least one secondary auditor, who is used to audit each operational requirement for business data in the department where the corresponding target user is located; the secondary auditor who audits the target user and the target user are located in the same department.

[0127] Step 4.2), based on the audit log and the control instructions of the secondary auditor, audit the execution of the operational requirements and the audit operation of the business auditor on the execution of the operational requirements.

[0128] For example, based on the control instructions issued by the secondary auditor, the execution operation and the review operation corresponding to each operation requirement to be audited recorded in the audit log can be automatically read; the read content is converted into the key text content corresponding to each operation requirement to be audited according to the preset template, so that the secondary auditor can quickly audit each operation to be audited according to the key text content;

[0129] Among them, the key text content may include the operation requirement to be audited - the requirement type of the operation requirement - the target user of the data type - the source - the role type corresponding to the target user at this time - the execution status of the operation requirement - the review status of the operation requirement, etc.

[0130] As an optional embodiment, the extraction of keywords or key content can be achieved through the graph theory TextRank method; first, text preprocessing: perform operations such as word segmentation and stop word removal on the audit log. Construct a vocabulary graph: regard each word as a node in the graph, and establish edges by calculating the similarity between words. Use the word co-occurrence method, that is, if two words appear at the same time in a certain window, then establish an edge between the two words, and assign a weight value to each edge. The weight calculation method can be customized according to actual needs. Common ones are based on word co-occurrence frequency, distance between words, etc.; then update the importance score of each node in an iterative manner. Initially, all nodes have the same score, and then they are updated according to the node's in-degree and out-degree and the edge weight. According to the final node score sorting, select the top N words with the highest scores as keywords.

[0131] As another optional embodiment, in addition to triggering the audit based on the control instructions issued by the secondary auditor in the aforementioned embodiment, the secondary auditor can also automatically trigger the business audit to ensure the timeliness of the audit, specifically including:

[0132] In step 5.1), when preset keywords are identified from the audit log, the secondary auditor is triggered to automatically audit the execution of the target user's operation requirements in the audit log and the business auditor's audit operation on the execution status.

[0133] Among them, the audit log is read automatically in real time, and when the preset keywords are identified, the secondary auditor is triggered to start the automatic audit operation. The preset keywords can be set according to the key work nodes and key businesses of the information data platform. For example, some variables are defined to represent the various parts of the process in step 5.1), and mathematical operators are used to represent the logical relationship between them. The following is a possible representation:

[0134] 1. Let L(t) represent the set of audit logs obtained at time t to monitor the audit logs in real time: for example, L(t) = {"User A accessed the financial report", "User B edited the financial report", "User C viewed the human resources report"};

[0135] 2. Keyword identification:

[0136] Let K be a preset keyword set, let M(L, K) be a function 1 that accepts an audit log set L and a keyword set K and returns a Boolean value indicating whether there is at least one log containing the keyword; for example, K={"financial report", "human resource report"};

[0137] 3. Triggering audit operations:

[0138] Let A be the execution of the audit operation, and let T(A, M) be a function 2 that accepts the audit operation A and the matching result M, and executes the audit operation when M is true.

[0139] The calculation formula is:

[0140] Combined with the above definition, step 5.1) can be expressed as a conditional statement:

[0141]

[0142] Here, the specific implementation of M(L(t), K) depends on the specific keyword matching algorithm. For example, it can be a simple string matching function or a more complex natural language processing algorithm for identifying synonyms or near-synonyms.

[0143] In some embodiments, according to different audit results, corresponding management strategies are adopted for the role data corresponding to the current role type of the target user to ensure data management reliability; specifically, step S108 may include:

[0144] In step 6.1), if the target user's operation requirement execution and the business auditor's audit of the execution status are both audited, the target user is granted the authority to manage the role data corresponding to the current role type when entering the operation instruction.

[0145] It can be understood that if the target user has the management authority for the role data corresponding to a certain role type, then the target user has the authority to input corresponding operation instructions and request corresponding operation requirements when in the role type.

[0146] In step 6.2), if the target user's operation requirement execution status or the business auditor's audit of the execution status fails or the audit times out, the target user's authority to manage the role data corresponding to the current role type when entering the operation instruction is locked.

[0147] Here, it can be understood that if the target user's authority to manage the role data corresponding to the current role type when inputting the operation instruction is locked, the target user is locked, and the target user no longer has the authority to input the operation instruction and put forward the operation requirement in the locked role type;

[0148] As an optional embodiment, if a target user has multiple locked role types, the target user's account is locked, that is, at this time, all role types of the target user are locked from managing role data.

[0149] In actual applications, if the user is locked due to audit failure, the system administrator can unlock the user by editing, and the unlocking operation will take effect after approval by the system auditor. If the user is locked due to audit expiration, the system administrator can unlock the user only after approval by the corresponding auditor, and the unlocking operation will take effect after approval by the system auditor.

[0150] The embodiment of the present invention can ensure the data security of each target user under each department in the information data platform, and can also review the operation of each user role through auditors and auditors, restrict the operation of each user role, and ensure the reliability of operation.

[0151] In some embodiments, Figure 2 As shown, an embodiment of the present invention further provides a role data management device based on three system members, the device is applied to an information data platform, the information data platform includes a system administrator, multiple system auditors, multiple system auditors, multiple business auditors and multiple secondary auditors; including:

[0152] A determination module, based on at least one role type pre-set by the target user according to the system administrator and an operation instruction input by the target user, determines the current role type of the target user, and the operation requirements for the target data obtained from the information data platform under the current role type and the operation instruction; wherein the role type includes one or more of the following: system administrator, system auditor, system auditor, business auditor, and secondary auditor;

[0153] An audit module, according to the requirement type of the operation requirement, calls a target audit role to audit the operation requirement; wherein the target audit role includes a system auditor and a business auditor;

[0154] An audit module stores the operation records and audit records corresponding to the operation requirements in the audit log of the target audit role, so that the target audit role audits the operations of the target user and the operations of the target audit role according to the audit log; wherein the target audit role includes a system auditor and a secondary auditor;

[0155] A management module manages the role data of the target user according to the audit result of the target audit role.

[0156] In some embodiments, the determination module is further specifically used to determine at least one role type corresponding to the target user based on the system administrator's addition operation on the target user; match the operation instructions input by the target user with the role type corresponding to the target user to determine the current role type of the target user when the operation instructions are input; and determine the operation requirements of the target user for system data or business data based on the operation instructions input by the target user and the current role type of the target user.

[0157] In some embodiments, the audit module is further specifically used to, if the operation requirement of the target user is an operation type for system data, call a system auditor to audit the operation requirement of the target user; if the operation requirement of the target user is an operation type for business data, call a target business auditor to audit the operation requirement of the target user; wherein the target business auditor and the target user are in the same department.

[0158] In some embodiments, the audit module is further specifically used to store operation records and audit records of operation requirements for system data in the audit log of the system auditor; and based on the audit log and the control instructions of the system auditor, audit the execution of the operation requirements and the audit operations of the system auditor on the execution of the operation requirements, respectively.

[0159] In some embodiments, the audit module is further specifically used to store operation records and audit records for operational requirements for business data in the audit log of a secondary auditor; wherein the secondary auditor who audits the target user and the target user are located in the same department; and according to the audit log and the control instructions of the secondary auditor, the execution of the operational requirements and the audit operations of the business auditor on the execution of the operational requirements are audited respectively.

[0160] In some embodiments, the audit module is further specifically used to trigger the automatic audit of the secondary auditor's execution of the target user's operational requirements in the audit log and the business auditor's audit operation on the execution when preset keywords are identified from the audit log.

[0161] In some embodiments, the management module is further specifically used to grant the target user the authority to manage role data corresponding to the current role type when the operation instruction is input, if the execution status of the target user's operation requirements and the business auditor's audit operation on the execution status are both audited through; if the execution status of the target user's operation requirements or the business auditor's audit operation on the execution status fail to pass the audit or the audit times out, then lock the target user's authority to manage role data corresponding to the current role type when the operation instruction is input.

[0162] In some embodiments, the device is also specifically used to, through a system administrator, add at least one role type to the target user, and the role type has corresponding permissions; using a system auditor to verify the permissions corresponding to the role type set by the target user; if the verification is successful, the role type of the target user and the corresponding permissions of the role type are added successfully.

[0163] In some embodiments, before the step of determining the operation requirements of the target user based on the role type set in advance by the system administrator and the operation instructions input by the target user, the device is also specifically used to obtain a key value corresponding to the current user; match the key value with a preset key value corresponding to the current user to verify the identity of the current user; if the match is successful, the current user who has passed the identity authentication is determined as the target user.

[0164] It can be understood that the specific operation methods of each functional module in this embodiment can refer to the detailed description of the corresponding steps in the above method embodiment, and will not be repeated here.

[0165] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0166] In addition, in the description of the embodiments of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0167] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the aforementioned embodiments, those of ordinary skill in the art should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the aforementioned embodiments within the technical scope disclosed by the present invention, or can easily conceive of changes, or make equivalent replacements for some of the technical features therein. Such modifications, changes or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the protection scope of the present invention.

Claims

1. A role data management method based on three system members, characterized in that: The method is applied to an information data platform, which includes a system administrator, multiple system auditors, multiple system auditors, multiple business auditors and multiple secondary auditors; including: Based on at least one role type set by the target user in advance according to the system administrator and the operation instruction input by the target user, determine the current role type of the target user, and the operation requirements for the target data obtained from the information data platform under the current role type and the operation instruction; wherein the role type includes one or more of the following: system administrator, system auditor, system auditor, business auditor and secondary auditor; According to the requirement type of the operation requirement, calling the target audit role to audit the operation requirement; wherein the target audit role includes a system auditor and a business auditor; The operation records and audit records corresponding to the operation requirements are stored in the audit log of the target audit role, so that the target audit role audits the operations of the target user and the operations of the target audit role according to the audit log; wherein the target audit role includes a system auditor and a secondary auditor; Managing the role data of the target user according to the audit result of the target audit role; The step of managing the role data of the target user according to the audit result of the target audit role includes: If the target user's operation requirement execution status and the business auditor's audit of the execution status are both audited, the target user is granted the authority to manage the role data corresponding to the current role type when the operation instruction is input; If the target user's operational requirements execution status or the business auditor's audit of the execution status fails or the audit times out, the target user's authority to manage role data corresponding to the current role type when entering the operational instruction is locked.

2. The method according to claim 1, characterized in that The step of determining the current role type of the target user based on at least one role type pre-set by the target user according to the system administrator and the operation instruction input by the target user, and the operation requirements for the target data obtained from the information data platform under the current role type and the operation instruction, comprises: According to the adding operation of the target user by the system administrator, at least one role type corresponding to the target user is determined; Matching the operation instruction input by the target user with the role type corresponding to the target user to determine the current role type of the target user when the operation instruction is input; Based on the operation instruction input by the target user and the current role type of the target user, the operation requirement of the target user on the system data or the business data is determined.

3. The method according to claim 1, characterized in that The step of calling a target review role to review the operation requirement according to the requirement type of the operation requirement includes: If the target user's operation requirement is an operation type for system data, calling a system auditor to review the target user's operation requirement; If the operation requirement of the target user is an operation type for business data, a target business auditor is called to audit the operation requirement of the target user; wherein the target business auditor and the target user are in the same department.

4. The method according to claim 1 or 3, characterized in that: The step of storing the operation record and the audit record corresponding to the operation requirement in the audit log of the target audit role so that the target audit role audits the operation of the target user and the operation of the target audit role according to the audit log includes: Store operational records and audit records of operational requirements for system data in the system auditor's audit log; According to the audit log and the control instruction of the system auditor, the execution of the operation requirement and the audit operation of the system auditor on the execution of the operation requirement are audited respectively.

5. The method according to claim 1 or 3, characterized in that: The step of storing the operation record and the audit record corresponding to the operation requirement in the audit log of the target audit role so that the target audit role audits the operation of the target user and the operation of the target audit role according to the audit log includes: storing operation records and audit records for operation requirements of business data in the audit log of the secondary auditor; wherein the secondary auditor who audits the target user and the target user are located in the same department; According to the audit log and the control instruction of the secondary auditor, the execution of the operation requirement and the audit operation of the business auditor on the execution of the operation requirement are audited respectively.

6. The method according to claim 5, characterized in that The steps of auditing the execution of the operation requirements and the audit operation of the business auditor on the execution of the operation requirements respectively according to the audit log and the control instruction of the secondary auditor include: When preset keywords are identified from the audit log, the secondary auditor is triggered to automatically audit the execution of the target user's operation requirements in the audit log and the business auditor's audit operation on the execution.

7. The method according to claim 1, characterized in that The method further comprises: A system administrator adds at least one role type to the target user, wherein the role type has corresponding permissions; Use the system auditor to verify the permissions corresponding to the role type set by the target user; If the verification is successful, the role type of the target user and the corresponding permissions of the role type are added successfully.

8. The method according to claim 1, characterized in that: Before the step of determining the operation requirement of the target user based on the role type pre-set by the target user according to the system administrator and the operation instruction input by the target user, the method further includes: Get the key value corresponding to the current user; Matching the key value with a preset key value corresponding to the current user to verify the identity of the current user; If the match is successful, the current user who has passed the identity authentication is determined as the target user.

9. A role data management device based on three system members, characterized in that: The device is applied to an information data platform, which includes a system administrator, multiple system auditors, multiple system auditors, multiple business auditors and multiple secondary auditors; including: A determination module, based on at least one role type pre-set by the target user according to the system administrator and an operation instruction input by the target user, determines the current role type of the target user, and the operation requirements for the target data obtained from the information data platform under the current role type and the operation instruction; wherein the role type includes one or more of the following: system administrator, system auditor, system auditor, business auditor, and secondary auditor; An audit module, according to the requirement type of the operation requirement, calls a target audit role to audit the operation requirement; wherein the target audit role includes a system auditor and a business auditor; An audit module stores the operation records and audit records corresponding to the operation requirements in the audit log of the target audit role, so that the target audit role audits the operations of the target user and the operations of the target audit role according to the audit log; wherein the target audit role includes a system auditor and a secondary auditor; A management module manages the role data of the target user according to the audit result of the target audit role; The management module is also used to grant the target user the authority to manage the role data corresponding to the current role type when the operation instruction is input, if the execution status of the target user's operation requirements and the business auditor's audit operation on the execution status are both audited through; if the execution status of the target user's operation requirements or the business auditor's audit operation on the execution status fail to pass the audit or the audit times out, then lock the target user's authority to manage the role data corresponding to the current role type when the operation instruction is input.

Images