A system setting management system based on system roles

Abstract

The present invention provides a system setting management system based on system roles, which relates to the technical field of system setting management systems, including: obtaining role requirements of system roles based on system management requirements; matching corresponding authentication processes and functional permissions to each system role based on the role requirements; obtaining historical operation records of each system role in a system role platform to obtain an operation evaluation report of each system role; and optimizing the management of system roles in the system role platform based on the operation evaluation report and in combination with the matching results. The system setting management system solves the problem of rough management, and achieves the beneficial effects of improving the efficiency of system role management and further ensuring the security of the system setting management system.

Description

Technical Field

[0001] The present invention relates to the technical field of system setting management systems, and in particular to a system setting management system based on system roles. Background Art

[0002] At present, the system settings management system, as an information technology system, is mainly used to improve the efficiency and security of information technology systems and optimize the configuration of enterprise resources.

[0003] With the development of computer technology, system settings management has gradually evolved from simple hardware and software configuration management to comprehensive management of networks, databases, security, performance and other aspects.

[0004] However, with the rapid development of artificial intelligence and automation technology, the system settings management system has ushered in new technical challenges in terms of efficiency and security. The system settings management system based on system roles is another breakthrough in the system settings management system technology to achieve refined management. Summary of the invention

[0005] The present invention provides a system setting management system based on system roles, which is used to solve the defect of rough management of the system setting management system in the prior art.

[0006] In one aspect, the present invention provides a system setting management system based on system roles, comprising:

[0007] Role definition module: obtains the role requirements of system roles based on system management requirements;

[0008] Role matching module: matches the corresponding authentication process and functional permissions to each system role based on the role requirements;

[0009] Operation analysis module: obtains the historical operation records of each system role in the system role platform and obtains the operation evaluation report of each system role;

[0010] Operation optimization module: based on the operation evaluation report and in combination with the matching results, optimize the management of the system roles in the system role platform.

[0011] According to a system setting management system based on system roles provided by the present invention, a role definition module includes:

[0012] Requirements analysis unit: analyzing the system management requirements to obtain corresponding functional requirements;

[0013] Function sequence acquisition unit: based on the cross-relationship of all functions in the functional requirements during the implementation process, obtains the function sequence of the functions with cross-relationship;

[0014] Permission sequence acquisition unit: constructs a permission sequence based on the permission level in the permission requirements corresponding to the functions in each function sequence;

[0015] Function permission table construction unit: constructs a function permission table based on the permission sequence and the function sequence.

[0016] According to a system setting management system based on system roles provided by the present invention, the role definition module further includes:

[0017] The first role matching unit: based on each function in the function permission table, matches the first role required for function implementation;

[0018] A first role table acquisition unit: based on the first roles that realize the same functional authority in the functional authority table, obtains the corresponding first role table;

[0019] A second role table acquisition unit: based on the special function requirements in the system management requirements, adjusting the permissions corresponding to each first role in the first role table to obtain a second role table;

[0020] The role requirement acquisition unit obtains the role requirements based on the corresponding permissions of each first role in the adjusted second role table and the functions to be implemented.

[0021] According to a system setting management system based on system roles provided by the present invention, a role matching module includes:

[0022] Role set acquisition unit: based on all system roles and corresponding permissions in the role requirements, obtain the role set at each permission level;

[0023] Functional authority expansion unit: sort all authority levels from high to low, and merge a role set greater than the middle level with a role set less than the middle level, until all the merges are completed without duplication to obtain the functions under each merged set, and combine the authority level of the unmerged set corresponding to the merged set to obtain the functional authority of the authority level corresponding to each merged set;

[0024] Authentication process matching unit: matches the corresponding authentication process based on the corresponding permission level of each merged set;

[0025] Functional authority matching unit: According to the functional authority under all merged sets, the corresponding functional authority is matched to the system roles that have passed the authentication process.

[0026] According to a system setting management system based on system roles provided by the present invention, the operation analysis module includes:

[0027] Operation record acquisition unit: obtains the operation record of each system role from the current moment to the last maintenance moment from the system role platform, and obtains the operation record set under each permission level;

[0028] Authentication record acquisition unit: based on the second role of each operation record set, obtains the corresponding authentication record;

[0029] The authority authentication unit verifies the authority of the corresponding second role based on the authentication record and obtains a verification report;

[0030] If the verification report is abnormal, extract the operation record of the corresponding second role for security verification, and remove the second role from the corresponding operation record set;

[0031] Function record acquisition unit: based on the reserved operation record set, obtains the function record accessed by each third role, and arranges the access sequence according to the access time of the third role;

[0032] Conversion unit: converting the access sequence to obtain a corresponding operation result sequence;

[0033] Table acquisition unit: based on the operation result sequence and the standard operation result set of each function, obtains a real-time comparison table of the operation result and the standard operation result under the same function;

[0034] Adding unit: based on the real-time comparison table and the reasonable range of each preset standard operation result, judging whether each functional operation is qualified, and adding it to the real-time comparison table;

[0035] Abnormal analysis unit: input the retained real-time comparison table into the functional abnormality analysis model to obtain the corresponding real-time evaluation report;

[0036] A times acquisition unit: acquires the role operation record of the confidentiality function, and obtains the operation times and the first operation result of each fourth role accessing the confidentiality function;

[0037] A calculation unit: sequentially calculates the difference between the number of operations corresponding to the fourth role under each access confidentiality function and the preset number of confidentiality operations, obtains a first difference, and constructs a first change point diagram for the fourth role;

[0038] A graph construction unit: constructing a second change point graph for the fourth character in chronological order based on all first operation results;

[0039] The calibration unit performs a first calibration on the points in the first change point map where the first difference is greater than a preset difference, and at the same time, for the connecting straight line between two adjacent points in the second change point map and the connecting curve constructed for the second change point map, determines the corresponding closed area, closed perimeter, and the length of the straight line between the midpoint of the connecting straight line and the middle of the connecting curve, and performs a second calibration on the points where the determination result does not meet the preset result;

[0040] A level determination unit: determining a verification level for the fourth role according to the first calibration result and the second calibration result and in combination with the initial setting authority of the fourth role;

[0041] Conduct security verification of the fourth role's operation records in accordance with the verification plan consistent with the verification level;

[0042] Report acquisition unit: based on the security verification result and the real-time evaluation report, obtains the corresponding operation evaluation report of each system role.

[0043] According to a system setting management system based on system roles provided by the present invention, a calibration unit includes:

[0044] Value calculation subunit: calculate the determined value of each point in the second change point graph respectively:

[0045] ;

[0046] Among them, A1 represents the determined value of the corresponding point; Y1 represents the vertical value of the first point between two adjacent points; Y2 represents the vertical value of the second point between two adjacent points; Indicates the standard value that matches the preset result; ln indicates the logarithmic function symbol; It represents the closed area formed by two adjacent points; Z1 represents the closed perimeter formed by two adjacent points; L1 represents the length of the straight line formed by two adjacent points; represents the standardized coefficient for area; represents the normalization coefficient for circumference; represents the standardized coefficient for length; Indicates the maximum value symbol; represents the analysis adjustment coefficient;

[0047] Analysis subunit: When the determined value is greater than a preset value, it is determined that the preset result is not satisfied and a second calibration is required for the corresponding point.

[0048] According to a system setting management system based on system roles provided by the present invention, the level determination unit includes:

[0049] Determine the calibration distribution of the first calibration result and the second calibration result, and input them into the distribution analysis model to obtain a first distribution check coefficient h1 of the first calibration result and a second distribution check coefficient h2 of the second calibration result;

[0050] Get the first average difference of all first differences under the first calibration result and the first variance At the same time, obtain the second average difference of the second difference between all determined values ​​and the preset value under the second calibration result and the second variance ;

[0051] Combined with the initial setting authority of the fourth role, the verification level H1 for the fourth role is determined:

[0052] ;

[0053] in, Indicates the rounding up symbol; represents a random function, which refers to Randomly select a variance from Indicates the level impact factor for initial approval of authority.

[0054] According to a system setting management system based on system roles provided by the present invention, an authentication process matching unit includes:

[0055] Match the permission level corresponding to each merged set with the level-authentication mapping table;

[0056] The process with the highest matching degree is used as the authentication process for the corresponding merged set.

[0057] The present invention provides a system setting management system based on system roles, which obtains the role requirements of system roles by analyzing the system management requirements, matches the corresponding authentication process and functional authority to each system role by analyzing the role requirements, obtains the historical operation records of each system role in the system role platform, obtains the operation evaluation report of each system role, and optimizes the management of the system roles in the system role platform based on the operation evaluation report and in combination with the matching results, thereby solving the problem of rough management of the system setting management system and achieving the beneficial effects of improving the efficiency of system role management and further ensuring the security of the system setting management system. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 It is a structural diagram of a system setting management system based on system roles provided by an embodiment of the present invention;

[0060] Figure 2 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Embodiment 1:

[0063] The embodiment of the present invention provides a system setting management system based on system roles, such as Figure 1 As shown, the system mainly includes the following steps:

[0064] Role definition module 101: obtains role requirements of system roles based on system management requirements;

[0065] Role matching module 102: matching corresponding authentication process and functional authority to each system role based on the role requirements;

[0066] Operation analysis module 103: obtains historical operation records of each system role in the system role platform and obtains an operation evaluation report for each system role;

[0067] Operation optimization module 104: optimizes and manages the system roles in the system role platform based on the operation evaluation report and in combination with the matching results.

[0068] In this embodiment, the system management requirement refers to the customer's requirement for system setting management system.

[0069] In this embodiment, the role requirement refers to the system role and the corresponding authority and corresponding function obtained by analyzing the system management requirements.

[0070] In this embodiment, the authentication process refers to the authentication process that each system role needs to perform in order to obtain the due authority during initial registration, including: applying for approval, sending permission, and dynamic verification.

[0071] In this embodiment, the functional authority refers to the authority level for implementing a certain function.

[0072] In this embodiment, the system role platform refers to a platform for managing system roles, including: registration and login of system roles, permissions of system roles, and login logs of system roles.

[0073] In this embodiment, the historical operation record refers to the record of the system role's registration and login operations at historical times, including the implemented functions and the results of the functions after the operation.

[0074] In this embodiment, the operation evaluation report refers to an evaluation of the operation process of the system role obtained by analyzing the historical operation records of the system role, including the judgment of abnormal and non-abnormal behaviors.

[0075] The beneficial effects of the above technical solution are: by analyzing the system management requirements, the role requirements of the system roles are obtained, the role requirements are analyzed to match the corresponding authentication process and functional permissions to each system role, the historical operation records of each system role in the system role platform are obtained, and the operation evaluation report of each system role is obtained. Based on the operation evaluation report and combined with the matching results, the system roles in the system role platform are optimized and managed, which solves the problem of rough management of the system setting management system and achieves the beneficial effect of improving the efficiency of system role management and further ensuring the security of the system setting management system.

[0076] Embodiment 2:

[0077] Based on Example 1, this embodiment of the present invention provides a role definition module, including:

[0078] Requirements analysis unit: analyzing the system management requirements to obtain corresponding functional requirements;

[0079] Function sequence acquisition unit: based on the cross-relationship of all functions in the functional requirements during the implementation process, obtains the function sequence of the functions with cross-relationship;

[0080] Permission sequence acquisition unit: constructs a permission sequence based on the permission level in the permission requirements corresponding to the functions in each function sequence;

[0081] Function permission table construction unit: constructs a function permission table based on the permission sequence and the function sequence.

[0082] In this embodiment, the functional requirements refer to the functions that need to be implemented in the system management requirements.

[0083] In this embodiment, the cross relationship refers to a relationship between functions in which one function must be realized before another function is realized, or two or more functions must be realized at the same time.

[0084] In this embodiment, the function sequence refers to a sequence of functions with a cross relationship constructed in the order of implementation.

[0085] In this embodiment, the permission requirement refers to the permission level of the system role required to implement the function.

[0086] In this embodiment, the permission sequence refers to a sequence obtained by arranging the permission levels in the permission requirements corresponding to the functions in each function sequence according to the order of the function sequence.

[0087] In this embodiment, the function permission table refers to a table obtained by combining the function sequence and the permission sequence and capable of expressing the relationship between functions and permissions.

[0088] The beneficial effect of the above technical solution is: by analyzing the functional requirements of the system management requirements, a table of each function implementation and permission comparison is obtained, which is conducive to the setting of system roles.

[0089] Embodiment 3:

[0090] Based on Example 1, the embodiment of the present invention provides a role definition module, further comprising:

[0091] The first role matching unit: based on each function in the function permission table, matches the first role required for function implementation;

[0092] A first role table acquisition unit: based on the first roles that realize the same functional authority in the functional authority table, obtains the corresponding first role table;

[0093] A second role table acquisition unit: based on the special function requirements in the system management requirements, adjusting the permissions corresponding to each first role in the first role table to obtain a second role table;

[0094] The role requirement acquisition unit obtains the role requirements based on the corresponding permissions of each first role in the adjusted second role table and the functions to be implemented.

[0095] In this embodiment, the first role refers to a system role that matches each function in the function permission table.

[0096] In this embodiment, the first role table refers to a table constructed by the first role in the function permission table to achieve consistent function permissions.

[0097] In this embodiment, the special function requirement refers to a requirement that does not comply with conventional permissions and is required to implement a certain special function.

[0098] In this embodiment, the second role table refers to a comparison table of system roles and permissions obtained by analyzing special functional requirements in system management requirements and adjusting permissions corresponding to each first role in the first role table.

[0099] The beneficial effect of the above technical solution is: by analyzing the system management requirements, the role requirements of the system roles are obtained, and the initial role and authority matching is completed.

[0100] Embodiment 4:

[0101] Based on Example 1, the embodiment of the present invention provides a role matching module, including:

[0102] Role set acquisition unit: based on all system roles and corresponding permissions in the role requirements, obtain the role set at each permission level;

[0103] Functional authority expansion unit: sort all authority levels from high to low, and merge a role set greater than the middle level with a role set less than the middle level, until all the merges are completed without duplication to obtain the functions under each merged set, and combine the authority level of the unmerged set corresponding to the merged set to obtain the functional authority of the authority level corresponding to each merged set;

[0104] Authentication process matching unit: matches the corresponding authentication process based on the corresponding permission level of each merged set;

[0105] Functional authority matching unit: According to the functional authority under all merged sets, the corresponding functional authority is matched to the system roles that have passed the authentication process.

[0106] In this embodiment, the permission level refers to the level of permission, and the smaller the level value, the higher the permission.

[0107] In this embodiment, the role set refers to all system roles at each permission level.

[0108] In this embodiment, the merged set refers to a set obtained by merging a role set greater than the middle level with a role set less than the middle level.

[0109] The beneficial effect of the above technical solution is: by analyzing role requirements, matching corresponding authentication processes and functional permissions to each system role, ensuring that the operations of the system role are within the scope of permissions.

[0110] Embodiment 5:

[0111] Based on Example 1, the embodiment of the present invention provides an operation analysis module, including:

[0112] Operation record acquisition unit: obtains the operation record of each system role from the current moment to the last maintenance moment from the system role platform, and obtains the operation record set under each permission level;

[0113] Authentication record acquisition unit: based on the second role of each operation record set, obtains the corresponding authentication record;

[0114] The authority authentication unit verifies the authority of the corresponding second role based on the authentication record and obtains a verification report;

[0115] If the verification report is abnormal, extract the operation record of the corresponding second role for security verification, and remove the second role from the corresponding operation record set;

[0116] Function record acquisition unit: based on the reserved operation record set, obtains the function record accessed by each third role, and arranges the access sequence according to the access time of the third role;

[0117] Conversion unit: converting the access sequence to obtain a corresponding operation result sequence;

[0118] Table acquisition unit: based on the operation result sequence and the standard operation result set of each function, obtains a real-time comparison table of the operation result and the standard operation result under the same function;

[0119] Adding unit: based on the real-time comparison table and the reasonable range of each preset standard operation result, judging whether each functional operation is qualified, and adding it to the real-time comparison table;

[0120] Abnormal analysis unit: input the retained real-time comparison table into the functional abnormality analysis model to obtain the corresponding real-time evaluation report;

[0121] A times acquisition unit: acquires the role operation record of the confidentiality function, and obtains the operation times and the first operation result of each fourth role accessing the confidentiality function;

[0122] A calculation unit: sequentially calculates the difference between the number of operations corresponding to the fourth role under each access confidentiality function and the preset number of confidentiality operations, obtains a first difference, and constructs a first change point diagram for the fourth role;

[0123] A graph construction unit: constructing a second change point graph for the fourth character in chronological order based on all first operation results;

[0124] The calibration unit performs a first calibration on the points in the first change point map where the first difference is greater than a preset difference, and at the same time, for the connecting straight line between two adjacent points in the second change point map and the connecting curve constructed for the second change point map, determines the corresponding closed area, closed perimeter, and the length of the straight line between the midpoint of the connecting straight line and the middle of the connecting curve, and performs a second calibration on the points where the determination result does not meet the preset result;

[0125] A level determination unit: determining a verification level for the fourth role according to the first calibration result and the second calibration result and in combination with the initial setting authority of the fourth role;

[0126] Conduct security verification of the fourth role's operation records in accordance with the verification plan consistent with the verification level;

[0127] Report acquisition unit: based on the security verification result and the real-time evaluation report, obtains the corresponding operation evaluation report of each system role.

[0128] In this embodiment, the maintenance time refers to the time of system maintenance set by the system setting management system.

[0129] In this embodiment, the operation record set refers to a set of operation records of the system role at each authority level from the current moment to the last maintenance moment.

[0130] In this embodiment, the second role refers to a system role in a set of operation records corresponding to each permission level.

[0131] In this embodiment, the authentication record refers to a record of the authentication process when the second role performs registration and login.

[0132] In this embodiment, the verification report refers to a report that analyzes the authentication record of the second role and verifies whether the authority of the second role is consistent with the current authority level, including: compliance and non-compliance.

[0133] In this embodiment, the security check refers to checking whether the authenticated authority of the second role is consistent with the authority of the function accessed by the second role.

[0134] In this embodiment, the third role refers to the system role in each set of retained operation records.

[0135] In this embodiment, the function record refers to a record of functions accessed by the third role.

[0136] In this embodiment, the access sequence refers to a sequence obtained by arranging all function records according to the access time of the third role.

[0137] In this embodiment, the operation result sequence refers to the result of realizing the function after the third role accesses the function, and is a sequence arranged in the order of the access sequence.

[0138] In this embodiment, the standard operation result set refers to the result after the standard operation of each function is completed.

[0139] In this embodiment, the real-time comparison table refers to a comparison table of operation results under the same function and standard operation results.

[0140] In this embodiment, the function abnormality analysis model refers to a model that is trained based on the real-time operation results of the function and the standard operation results to analyze whether the result of the function is abnormal.

[0141] In this embodiment, the real-time evaluation report refers to an evaluation of whether each function of the real-time comparison table is abnormal.

[0142] In this embodiment, the confidentiality function refers to a pre-set function that requires confidentiality and strict authority control.

[0143] In this embodiment, the role operation record refers to the operation record of the system role accessing the confidentiality function.

[0144] In this embodiment, the fourth role refers to a system role that accesses the confidentiality function.

[0145] In this embodiment, the number of operations refers to the number of times the fourth role accesses the confidentiality function to perform operations.

[0146] In this embodiment, the first operation result refers to the operation result when the fourth role accesses the confidentiality function and the operation is completed.

[0147] In this embodiment, the preset number of confidentiality operations refers to the number of operations for normal access to the confidentiality function that is preset to ensure normal operation.

[0148] In this embodiment, the first difference refers to the difference between the number of operations corresponding to the fourth role under each access to the confidentiality function and the preset number of confidentiality operations.

[0149] In this embodiment, the first change point diagram refers to a point diagram constructed according to the order of access time, based on the difference between the number of operations corresponding to all fourth roles corresponding to each access to the confidentiality function and the preset number of confidentiality operations.

[0150] In this embodiment, the preset difference refers to the difference between a preset reasonable number of operations and a preset number of confidentiality operations.

[0151] In this embodiment, the first calibration refers to calibrating the points in the first change point graph where the first difference is greater than the preset difference.

[0152] In this embodiment, the closed area refers to the area of ​​a closed figure enclosed by a straight line connecting two adjacent points in the second change point graph and a connecting curve constructed for the second change point graph.

[0153] In this embodiment, the closed perimeter refers to the perimeter of a closed figure formed by a straight line connecting two adjacent points in the second change point graph and a connecting curve constructed for the second change point graph.

[0154] In this embodiment, the determination result refers to the value obtained by calculating the closed area, closed perimeter, and the length of the straight line between the midpoint of the connecting straight line and the middle of the connecting curve for the connecting straight line connecting two adjacent points in the second change point diagram and the connecting curve constructed for the second change point diagram.

[0155] In this embodiment, the preset result refers to the value obtained by calculating the closed area, closed perimeter, and the length of the straight line between the midpoint of the connecting straight line and the middle of the connecting curve for the connecting straight line between two adjacent points in the second change point diagram and the connecting curve constructed for the second change point diagram under the preset standard access conditions.

[0156] In this embodiment, the second calibration refers to calibrating the points where the determination results do not meet the preset results.

[0157] In this embodiment, the initially set authority refers to the authority level for initial authentication.

[0158] In this embodiment, the verification level refers to the level of verification of the fourth role obtained by comprehensive analysis of the first calibration result and the second calibration result in combination with the initial set authority of the fourth role, wherein the smaller the level value, the higher the level and the more detailed the verification.

[0159] In this embodiment, the verification scheme refers to a verification scheme corresponding to a verification level.

[0160] The beneficial effects of the above technical solution are: by analyzing the system role's authentication authority for functions and the functions accessed, and analyzing the results after accessing the functions, the operation records of abnormal system roles are evaluated, and by detailed verification of the operation records of system roles that access confidentiality functions, the accuracy of the verification is increased, the security of the data in the confidentiality functions is ensured, and the various system roles of the system settings management system are ensured to be within their respective authorities, thereby improving the efficiency of the system settings management system.

[0161] Embodiment 6:

[0162] Based on Example 5, the embodiment of the present invention provides a calibration unit, including:

[0163] Value calculation subunit: calculate the determined value of each point in the second change point graph respectively:

[0164] ;

[0165] Among them, A1 represents the determined value of the corresponding point; Y1 represents the vertical value of the first point between two adjacent points; Y2 represents the vertical value of the second point between two adjacent points; Indicates the standard value that matches the preset result; ln indicates the logarithmic function symbol; It represents the closed area formed by two adjacent points; Z1 represents the closed perimeter formed by two adjacent points; L1 represents the length of the straight line formed by two adjacent points; represents the standardized coefficient for area; represents the normalization coefficient for circumference; represents the standardized coefficient for length; Indicates the maximum value symbol; represents the analysis adjustment coefficient;

[0166] Analysis subunit: When the determined value is greater than a preset value, it is determined that the preset result is not satisfied and a second calibration is required for the corresponding point.

[0167] In this embodiment, the vertical value refers to the value of the ordinate corresponding to the point.

[0168] In this embodiment, the normalization coefficient refers to a preset coefficient for normalization calculation of various parameters in the closed figure.

[0169] In this embodiment, the analysis adjustment coefficient refers to a coefficient for adjusting the function obtained by calculating various parameters of the closed graph.

[0170] The beneficial effect of the above technical solution is: by calculating the connecting straight line between two adjacent points in the second change point diagram and the connecting curve constructed for the second change point diagram, the corresponding closed area, closed perimeter and the length of the straight line between the midpoint of the connecting straight line and the middle of the connecting curve are determined to obtain a determined value, and the points are accurately calibrated, which is conducive to a detailed analysis of whether the fourth character's access to the confidentiality function is abnormal.

[0171] Embodiment 7:

[0172] Based on Embodiment 5, the embodiment of the present invention provides the level determination unit, including:

[0173] Determine the calibration distribution of the first calibration result and the second calibration result, and input them into the distribution analysis model to obtain a first distribution check coefficient h1 of the first calibration result and a second distribution check coefficient h2 of the second calibration result;

[0174] Get the first average difference of all first differences under the first calibration result and the first variance At the same time, obtain the second average difference of the second difference between all determined values ​​and the preset value under the second calibration result and the second variance ;

[0175] Combined with the initial setting authority of the fourth role, the verification level H1 for the fourth role is determined:

[0176] ;

[0177] in, Indicates the rounding up symbol; represents a random function, which refers to Randomly select a variance from Indicates the level impact factor for initial approval of authority.

[0178] In this embodiment, the calibration distribution refers to the distribution diagram of the points of the first calibration and the second calibration.

[0179] In this embodiment, the distribution analysis model refers to a model for analyzing distribution conditions obtained by distribution training of calibration points.

[0180] In this embodiment, the first distribution verification coefficient refers to the coefficient of the verification of the first calibrated point input to the distribution analysis model output.

[0181] In this embodiment, the second distribution verification coefficient refers to a coefficient for verifying the output of the distribution analysis model from the second calibrated point input.

[0182] In this embodiment, the level impact factor refers to the degree of impact corresponding to the level of authority.

[0183] The beneficial effect of the above technical solution is: by analyzing the first calibration result and the second calibration result, combining the initial set permissions of the fourth role for calculation, determining the verification level for the fourth role, accurately verifying the fourth role, and ensuring the security of the access rights to the confidentiality function.

[0184] Embodiment 8:

[0185] Based on Example 4, this embodiment of the present invention provides an authentication process matching unit, including:

[0186] Match the permission level corresponding to each merged set with the level-authentication mapping table;

[0187] The process with the highest matching degree is used as the authentication process for the corresponding merged set.

[0188] In this embodiment, the level-authentication mapping table refers to a mapping table that matches the authority level and the corresponding authentication process.

[0189] In this embodiment, the matching degree refers to the matching degree between the authority level in the level-authentication mapping table and the corresponding authentication process.

[0190] The beneficial effect of the above technical solution is: by matching the permission level corresponding to each merged set with the level-authentication mapping table, the process with the highest matching degree is used as the authentication process for the corresponding merged set, thereby improving the matching accuracy of the authentication process and ensuring the authentication security of the permission.

[0191] Based on the same general inventive concept, the present invention also protects a system setting management device based on system roles. The system setting management device based on system roles provided by the present invention is described below. The system setting management device based on system roles described below and the system setting management system based on system roles described above can refer to each other.

[0192] Figure 2 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

[0193] like Figure 2 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other via the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute a system setting management system based on system roles.

[0194] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0195] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0196] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A system setting management system based on system roles, characterized in that: include: Role definition module: obtains the role requirements of system roles based on system management requirements; Role matching module: matches the corresponding authentication process and functional permissions to each system role based on the role requirements; Operation analysis module: obtains the historical operation records of each system role in the system role platform and obtains the operation evaluation report of each system role; Operation optimization module: based on the operation evaluation report and in combination with the matching results, optimize the management of the system roles in the system role platform; The operation analysis module includes: Operation record acquisition unit: obtains the operation record of each system role from the current moment to the last maintenance moment from the system role platform, and obtains the operation record set under each permission level; Authentication record acquisition unit: based on the second role of each operation record set, obtains the corresponding authentication record; The authority authentication unit verifies the authority of the corresponding second role based on the authentication record and obtains a verification report; If the verification report is abnormal, extract the operation record of the corresponding second role for security verification, and remove the second role from the corresponding operation record set; Function record acquisition unit: based on the reserved operation record set, obtains the function record accessed by each third role, and arranges the access sequence according to the access time of the third role; Conversion unit: converting the access sequence to obtain a corresponding operation result sequence; Table acquisition unit: based on the operation result sequence and the standard operation result set of each function, obtains a real-time comparison table of the operation result and the standard operation result under the same function; Adding unit: based on the real-time comparison table and the reasonable range of each preset standard operation result, judging whether each functional operation is qualified, and adding it to the real-time comparison table; Abnormal analysis unit: input the retained real-time comparison table into the functional abnormality analysis model to obtain the corresponding real-time evaluation report; A times acquisition unit: acquires the role operation record of the confidentiality function, and obtains the operation times and the first operation result of each fourth role accessing the confidentiality function; A calculation unit: sequentially calculates the difference between the number of operations corresponding to the fourth role under each access confidentiality function and the preset number of confidentiality operations, obtains a first difference, and constructs a first change point diagram for the fourth role; A graph construction unit: constructing a second change point graph for the fourth character in chronological order based on all first operation results; The calibration unit performs a first calibration on the points in the first change point map where the first difference is greater than a preset difference, and at the same time, for the connecting straight line between two adjacent points in the second change point map and the connecting curve constructed for the second change point map, determines the corresponding closed area, closed perimeter, and the length of the straight line between the midpoint of the connecting straight line and the middle of the connecting curve, and performs a second calibration on the points where the determination result does not meet the preset result; A level determination unit: determining a verification level for the fourth role according to the first calibration result and the second calibration result and in combination with the initial setting authority of the fourth role; Conduct security verification of the fourth role's operation records in accordance with the verification plan consistent with the verification level; Report acquisition unit: based on the security verification result and the real-time evaluation report, obtains the corresponding operation evaluation report of each system role.

2. The system according to claim 1, characterized in that Role definition module, including: Requirements analysis unit: analyzing the system management requirements to obtain corresponding functional requirements; Function sequence acquisition unit: based on the cross-relationship of all functions in the functional requirements during the implementation process, obtains the function sequence of the functions with cross-relationship; Permission sequence acquisition unit: constructs a permission sequence based on the permission level in the permission requirements corresponding to the functions in each function sequence; Function permission table construction unit: constructs a function permission table based on the permission sequence and the function sequence.

3. The system according to claim 2, characterized in that The role definition module also includes: The first role matching unit: based on each function in the function permission table, matches the first role required for function implementation; A first role table acquisition unit: based on the first roles that realize the same functional authority in the functional authority table, obtains the corresponding first role table; A second role table acquisition unit: based on the special function requirements in the system management requirements, adjusting the permissions corresponding to each first role in the first role table to obtain a second role table; The role requirement acquisition unit obtains the role requirements based on the corresponding permissions of each first role in the adjusted second role table and the functions to be implemented.

4. The system according to claim 3, characterized in that Role matching module, including: Role set acquisition unit: based on all system roles and corresponding permissions in the role requirements, obtain the role set at each permission level; Functional authority expansion unit: sort all authority levels from high to low, and merge a role set greater than the middle level with a role set less than the middle level, until all the merges are completed without duplication to obtain the functions under each merged set, and combine the authority level of the unmerged set corresponding to the merged set to obtain the functional authority of the authority level corresponding to each merged set; Authentication process matching unit: matches the corresponding authentication process based on the corresponding permission level of each merged set; Functional authority matching unit: According to the functional authority under all merged sets, the corresponding functional authority is matched to the system roles that have passed the authentication process.

5. The system according to claim 1, characterized in that Calibration unit, including: Value calculation subunit: calculate the determined value of each point in the second change point graph respectively: ； Among them, A1 represents the determined value of the corresponding point; Y1 represents the vertical value of the first point between two adjacent points; Y2 represents the vertical value of the second point between two adjacent points; Indicates the standard value that matches the preset result; ln indicates the logarithmic function symbol; It represents the closed area formed by two adjacent points; Z1 represents the closed perimeter formed by two adjacent points; L1 represents the length of the straight line formed by two adjacent points; represents the standardized coefficient for area; represents the normalization coefficient for circumference; represents the standardized coefficient for length; Indicates the maximum value symbol; represents the analysis adjustment coefficient; Analysis subunit: When the determined value is greater than a preset value, it is determined that the preset result is not satisfied and a second calibration is required for the corresponding point.

6. The system according to claim 5, characterized in that The level determination unit comprises: Determine the calibration distribution of the first calibration result and the second calibration result, and input them into the distribution analysis model to obtain a first distribution check coefficient h1 of the first calibration result and a second distribution check coefficient h2 of the second calibration result; Get the first average difference a of all first differences under the first calibration result and the first variance At the same time, obtain the second average difference of the second difference between all determined values ​​and the preset value under the second calibration result and the second variance ; Combined with the initial setting authority of the fourth role, the verification level H1 for the fourth role is determined: ； in, Indicates the rounding up symbol; represents a random function, which refers to Randomly select a variance from Indicates the level impact factor for initial approval of authority.

7. The system according to claim 4, characterized in that Certification process matching unit, including: Match the permission level corresponding to each merged set with the level-authentication mapping table; The process with the highest matching degree is used as the authentication process for the corresponding merged set.

Images