Access permission management method and device, storage medium and program product

Abstract

The embodiment of the invention provides an access permission management method and device, a storage medium and a program product, and relates to the technical field of data storage, and the method comprises the steps: obtaining a first access data set of a target client in a first time period, and determining data features corresponding to at least one piece of first access data in the first access data set, the data feature is used for indicating the feature and the access mode of the first access data; inputting the first access data set and the data features corresponding to the at least one piece of first access data into an authority prediction model to obtain a target authority corresponding to the target client; and determining a second access data set corresponding to the target permission, and allocating a permission for acquiring the second access data set to the target client. By adopting the scheme, the technical problem that the flexibility of an access authority management method in a current NFS system is relatively low in the related technology is solved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing technology, and in particular, to a method and device for managing access rights, a storage medium, and a program product. Background Art

[0002] Network File System (NFS) allows users to access remote file systems over the network just like accessing local file systems. When using NFS, user permission management is a key technology to ensure data security and access control. By assigning permissions to users, users can access folders with permissions.

[0003] When using manual methods to assign permissions, it will appear inefficient. Therefore, a relatively intelligent automated permission management method is usually used. In the related art, user permissions are usually assigned based on predefined rules. System administrators can define a series of permission rules, and user permissions can be automatically granted according to the preset rules. However, the predefined rules are fixed. When faced with file and user adjustments, it is difficult to dynamically adjust permissions for users and scenarios. In other words, the access permission management method in the related art has low flexibility.

[0004] In view of the technical problem in the related art that the access permission management method in the current NFS system has low flexibility, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a method and device for managing access rights, a storage medium, and a program product to at least solve the technical problem of low flexibility of the access rights management method in the current NFS system in the related art.

[0006] According to one embodiment of the present application, a method for managing access rights is provided, including: obtaining a first access data set of a target client within a first time period, and determining data features corresponding to at least one first access data in the first access data set, wherein the data features are used to indicate characteristics and access patterns of the first access data; inputting the first access data set and the data features corresponding to at least one first access data into a permission prediction model to obtain a target permission corresponding to the target client; determining a second access data set corresponding to the target permission, and assigning permission to obtain the second access data set to the target client.

[0007] In an exemplary embodiment, the above-mentioned determination of the second access data set corresponding to the target permission and allocation of permission to the target client to obtain the second access data set include: upon receiving a permission adjustment instruction, updating the second access data set to a third access data set, and allocating permission to obtain the third access data set to the target client, wherein the permission adjustment instruction is used to indicate the third access data set; upon receiving a permission determination instruction, allocating permission to obtain the second access data set to the target client.

[0008] In an exemplary embodiment, after determining the second access data set corresponding to the target permission and assigning the target client the permission to obtain the second access data set, the following steps include: obtaining an access instruction of the target client within a second time period, wherein the access instruction is used to indicate a fourth access data set; comparing the fourth access data set with the second access data set, and generating prompt information if a preset prompt condition is met.

[0009] In an exemplary embodiment, the generating of prompt information when a preset prompt condition is met includes: generating prompt information when the number of access data in the fourth access data set that is not included in the second access data set reaches a preset threshold.

[0010] In an exemplary embodiment, the training process of the above-mentioned permission prediction model includes: obtaining a reference access data set of a reference client within a third time period, and determining the data features corresponding to each reference access data in the reference access data set; obtaining initialization parameters of the permission prediction model; using the reference access data set to train the permission prediction model to update the parameters of the permission prediction model, and obtaining a trained permission prediction model when preset conditions are met.

[0011] In an exemplary embodiment, the above-mentioned acquisition of a reference access data set of a reference client within a third time period and determination of data features corresponding to each reference access data in the reference access data set includes: performing data cleaning and standardization on the reference access data set and data features corresponding to each of the multiple reference access data to obtain a reference access data set to be determined; removing data features that meet screening conditions from the data features corresponding to each of the reference access data in the reference access data set to be determined to obtain an updated reference access data set.

[0012] In an exemplary embodiment, the above-mentioned method of training the permission prediction model using a reference access data set to update the parameters of the permission prediction model, and obtaining a trained permission prediction model when preset conditions are met, includes: randomly dividing the reference access data set into M access data subsets; traversing the M access data subsets, and performing the following operations during the i-th traversal process: using all access data subsets of the M access data subsets except the i-th access data subset as training sets to train the permission prediction model, and inputting the i-th access data subset into the permission prediction model to obtain the i-th evaluation function result of the permission prediction model, wherein M is an integer greater than 0, and i is an integer greater than 0 and less than or equal to M; when the M evaluation function results meet the preset conditions, a trained permission prediction model is obtained.

[0013] In an exemplary embodiment, the above-mentioned use of all access data subsets except the i-th access data subset in the M access data subsets as training sets to train the permission prediction model includes: performing T random sampling on the training set, and in each random sampling process, performing the following operations: collecting n samples in the training set to obtain a sampling set containing n samples, wherein T is an integer greater than 0, and n is the same as the number of reference access data contained in the training set; establishing T permission prediction sub-models, and corresponding the T sampling sets to the T permission prediction sub-models one by one; using the sampling sets to train the corresponding permission prediction sub-models, and the training process of the permission prediction sub-models includes: when currently in the first node layer, according to the feature number, randomly determining the first feature set from the data features corresponding to each of the reference access data, wherein the number of feature types of the data features in the feature set is the same as the feature number; establishing candidate nodes of the second node layer according to the first feature set, and evaluating the candidate nodes using the first feature set to obtain evaluation results of the candidate nodes of the second node layer; determining the candidate nodes of the second node layer according to the evaluation results of the candidate nodes of the second node layer Node; split the sampling set according to the nodes of the second node layer to obtain the sampling subsets corresponding to the nodes of the second node layer; when currently in the p-th node layer, according to the feature number, randomly determine the q-th feature set from the sampling subsets corresponding to the nodes of the p-th node layer; establish the candidate nodes of the p+1-th node layer according to the q-th feature set, and use the q-th feature set to evaluate the candidate nodes of the p+1-th node layer to obtain the evaluation results of the candidate nodes of the p+1-th node layer; determine the p+1-th node layer according to the evaluation results of the candidate nodes of the p+1-th node layer. nodes of the p-th node layer; split the sampling subset corresponding to the nodes of the p-th node layer according to the nodes of the p+1-th node layer to obtain the sampling subset corresponding to the nodes of the p+1-th node layer, wherein p is an integer greater than 1, and q is an integer greater than 1; when the number of reference access data contained in the sampling subset corresponding to the nodes of the p+1-th node layer is less than or equal to the preset number of data or p is greater than or equal to the preset number of layers, the model composed of the current p+1 node layers is determined as the permission prediction sub-model; T permission prediction sub-models are integrated to obtain the permission prediction model.

[0014] In an exemplary embodiment, the above method also includes: obtaining the fifth access data set of the target client within the fourth time period, and determining the data features corresponding to each of the multiple fifth access data in the fifth access data set; using the fifth access data set and the data features corresponding to each of the fifth access data to update the parameters of the permission prediction model to obtain an updated permission prediction model.

[0015] According to another embodiment of the present application, there is provided an access rights management device, comprising: a data acquisition module, used to acquire a first access data set of a target client within a first time period, and determine data features corresponding to at least one first access data in the first access data set, wherein the data features are used to indicate characteristics and access patterns of the first access data; a permission prediction module, used to input the data features corresponding to the first access data set and at least one first access data into a permission prediction model to obtain a target permission corresponding to the target client; and a permission allocation module, used to determine a second access data set corresponding to the target permission, and allocate permission to the target client to acquire the second access data set.

[0016] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0017] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0018] Through the present application, the first access data set of the target client in the first time period is obtained, and the data features corresponding to at least one first access data in the first access data set are determined, wherein the data features are used to indicate the characteristics and access mode of the first access data; the data features corresponding to the first access data set and at least one first access data are input into the permission prediction model to obtain the target permission corresponding to the target client; the second access data set corresponding to the target permission is determined, and the permission to obtain the second access data set is allocated to the target client. In the case where the target client accesses data to the server, the server can obtain the data accessed by the target client in the first time period, and select part of it as the first access data set. After obtaining the first access data set, the corresponding data features can be determined, and the permission prediction model is used to generate permission recommendations suitable for the current user and file through the access data and data features. It is used as the target permission, and the second access data set corresponding to the target permission is determined, so as to allocate the permission to obtain the second access data set to the target client. In this way, the access rights of the client can be determined in real time according to the data accessed by the client, and its permissions can be updated, so that in the face of changing users or files, the user's permissions can be quickly allocated to ensure that the permission configuration always matches the actual use requirements and is applicable to the dynamic requirements of different users and scenarios. The invention solves the technical problem of low flexibility of the access permission management method in the current NFS system in the related art, and can automatically recommend and adjust the permission setting intelligently according to the user's access data, thereby improving the efficiency of permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a hardware structure block diagram of an optional access rights management method according to an embodiment of the present application;

[0020] Figure 2 is a flowchart of an optional access rights management method according to an embodiment of the present application;

[0021] Figure 3 is a schematic diagram of an optional access rights management method according to an embodiment of the present application;

[0022] Figure 4 is a schematic diagram of another optional access rights management method according to an embodiment of the present application;

[0023] Figure 5 is a schematic diagram of another optional access rights management method according to an embodiment of the present application;

[0024] Figure 6 is a schematic diagram of another optional access rights management method according to an embodiment of the present application;

[0025] Figure 7 It is a structural block diagram of an optional access rights management device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0028] According to one aspect of the embodiments of the present application, a method for managing access rights is provided. As an optional implementation, the method for managing access rights can be applied to, but is not limited to, Figure 1 The management system of access rights in the hardware environment shown. The management system of access rights may include but is not limited to terminal device 102, network 110, server 112, and database 114. The terminal device 102 includes a display 108, a processor 106, and a memory 104. The display 108 can be used to display the acquired access data, etc., and also to provide a human-computer interaction interface to receive touch human-computer interaction operations for different information. The processor is used to generate an interaction instruction in response to the above human-computer interaction operation, and send the interaction instruction to the server to obtain the stored data. The memory is used to store the access data required for the client to run.

[0029] In addition, the server 112 includes a processing engine 116, which is used to perform storage or reading operations on the database 114. Specifically, the processing engine 116 reads and accesses a data set from the database 114.

[0030] The specific process of this embodiment is as follows: As in step S102, the terminal device 102 can send a request to the server 112 through the network 110 to obtain access data with access rights. After receiving the request sent by the terminal device 102, the server 112 obtains the access data set from the database 114 and sends the access data set to the terminal device 102. After that, the server 112 can execute steps S104 to S108, and can determine the first access data set of the terminal device 102 in the first time period, and determine its corresponding data features, and then use the permission prediction model to determine the target permission of the terminal device. Determine the second access data set corresponding to the target permission, and assign the target client the permission to obtain the second access data set. The terminal device 102 may be one or more devices; the server 112 can assign permissions to multiple terminal devices 102.

[0031] Optionally, in this embodiment, the terminal device 102 may be a terminal device configured with a target client, and may include but is not limited to at least one of the following: a mobile phone (such as an Android phone, an iOS phone, etc.), a laptop, a tablet computer, a PDA, a MID (Mobile Internet Devices), a PAD, a desktop computer, a smart TV, etc. The network may include but is not limited to: a wired network, a wireless network, wherein the wired network includes: a local area network, a metropolitan area network and a wide area network, and the wireless network includes: Bluetooth, WIFI and other networks that implement wireless communication. The server may be a single server, or a server cluster consisting of multiple servers, or a cloud server. The above is only an example, and this embodiment does not impose any limitation on this.

[0032] Through the present application, the first access data set of the target client in the first time period is obtained, and the data features corresponding to at least one first access data in the first access data set are determined, wherein the data features are used to indicate the characteristics and access mode of the first access data; the data features corresponding to the first access data set and at least one first access data are input into the permission prediction model to obtain the target permission corresponding to the target client; the second access data set corresponding to the target permission is determined, and the permission to obtain the second access data set is allocated to the target client. In the case where the target client accesses data to the server, the server can obtain the data accessed by the target client in the first time period, and select part of it as the first access data set. After obtaining the first access data set, the corresponding data features can be determined, and the permission prediction model is used to generate permission recommendations suitable for the current user and file through the access data and data features. It is used as the target permission, and the second access data set corresponding to the target permission is determined, so as to allocate the permission to obtain the second access data set to the target client. In this way, the access rights of the client can be determined in real time according to the data accessed by the client, and its permissions can be updated, so that in the face of changing users or files, the user's permissions can be quickly allocated to ensure that the permission configuration always matches the actual use requirements and is applicable to the dynamic requirements of different users and scenarios. The invention solves the technical problem of low flexibility of the access permission management method in the current NFS system in the related art, and can automatically recommend and adjust the permission setting intelligently according to the user's access data, thereby improving the efficiency of permission management.

[0033] In this embodiment, a method for managing access rights is provided. Figure 2 is a flowchart of an optional access rights management method according to an embodiment of the present application, such as Figure 2 As shown, the management method of the access permission includes:

[0034] Step S202, obtaining a first access data set of a target client in a first time period, and determining a data feature corresponding to at least one first access data in the first access data set, wherein the data feature is used to indicate a characteristic and an access mode of the first access data;

[0035] It should be noted that the data that the NFS client can access depends on the exported directories and corresponding access permissions configured on the server. The NFS server can designate certain directories as exported directories, which are visible and accessible to the client. The client can access and operate the files and folders in these exported directories, including reading, modifying, and executing files. The server can also assign corresponding permissions to users. One client can correspond to multiple users, and different users can obtain access data from the server through the client. The server can assign different permissions to different users.

[0036] In an optional implementation, the first time period can be preset, and during the process of the current NFS client accessing the data of the server, the access data in the first time period can be read, and part or all of the access data can be used as the first access data set for subsequent access permission prediction. The access data can be in the form of data blocks, files, etc., and there is no limitation on the form.

[0037] In an optional implementation, after determining the first access data set, the data features corresponding to each access data therein can be used, such as time features: access time, dwell time, access frequency, etc.; user features: user ID, user registration time, user level, etc.; behavior features: click-through rate, browsing path, access history, etc.; device features: access device, operating system, client type and other features.

[0038] Step S204, inputting the data features corresponding to the first access data set and at least one first access data into a permission prediction model to obtain a target permission corresponding to the target client;

[0039] It should be noted that the permission prediction model may be a pre-trained model, and the permission prediction model may take the first access data set and the data features corresponding to the first access data as input, and output the target permission corresponding to the client.

[0040] In an optional implementation, the input of the permission prediction model may also be the first access data set corresponding to the user and the data features corresponding to each of the first access data sets, and the result output by the permission prediction model may be the target permission corresponding to the user.

[0041] In an optional implementation manner, the target permissions corresponding to the same user using different clients may be different, and the target permissions corresponding to different users using the same client may also be different.

[0042] Step S206: determine the second access data set corresponding to the target permission, and allocate permission for obtaining the second access data set to the target client.

[0043] The second access data set may be data that the target client may access, which is not an unchanging fixed data set and is determined based on the first access data set of the client in the first time period.

[0044] In an optional implementation, the access rights management method of the present application can periodically obtain the first access data set of the user using the target client in the first period of time according to a preset time when the user accesses the server through the client. The obtained first access data set and the corresponding data features can be used to predict the user's rights under the target client, and the accessible data rights for the user can be updated according to the predicted target rights. This can ensure that the rights configuration always matches the actual usage requirements, thereby improving the flexibility of the system.

[0045] In an optional implementation, the access rights management method of the present application can be used when a new user is added to the system, and the user's access request can be obtained, and the user's rights can be predicted using a rights prediction model based on the access data and data features (such as user ID, client used by the user, etc.) indicated by the user's access request to obtain the user's access rights. This reduces the manual operations of the system administrator, especially in scenarios where a large number of users are added (such as the reorganization of a business unit), and improves the efficiency of rights management.

[0046] In an optional implementation, the access rights management method of the present application can also be used when permissions need to be allocated for large quantities of data (such as server file updates, etc.). The corresponding permissions can be determined based on the user's access data and corresponding data features, and allocated to the user to improve the efficiency of permission management.

[0047] Through the present application, the first access data set of the target client in the first time period is obtained, and the data features corresponding to at least one first access data in the first access data set are determined, wherein the data features are used to indicate the characteristics and access mode of the first access data; the data features corresponding to the first access data set and at least one first access data are input into the permission prediction model to obtain the target permission corresponding to the target client; the second access data set corresponding to the target permission is determined, and the permission to obtain the second access data set is allocated to the target client. In the case where the target client accesses data to the server, the server can obtain the data accessed by the target client in the first time period, and select part of it as the first access data set. After obtaining the first access data set, the corresponding data features can be determined, and the permission prediction model is used to generate permission recommendations suitable for the current user and file through the access data and data features. It is used as the target permission, and the second access data set corresponding to the target permission is determined, so as to allocate the permission to obtain the second access data set to the target client. In this way, the access rights of the client can be determined in real time according to the data accessed by the client, and its permissions can be updated, so that in the face of changing users or files, the user's permissions can be quickly allocated to ensure that the permission configuration always matches the actual use requirements and is applicable to the dynamic requirements of different users and scenarios. The invention solves the technical problem of low flexibility of the access permission management method in the current NFS system in the related art, and can automatically recommend and adjust the permission setting intelligently according to the user's access data, thereby improving the efficiency of permission management.

[0048] In an optional embodiment, the above-mentioned determination of the second access data set corresponding to the target permission and assigning the target client the permission to obtain the second access data set include: upon receiving a permission adjustment instruction, updating the second access data set to a third access data set, and assigning the target client the permission to obtain the third access data set, wherein the permission adjustment instruction is used to indicate the third access data set; upon receiving a permission determination instruction, assigning the target client the permission to obtain the second access data set.

[0049] It should be noted that the server can receive external instructions (such as instructions sent by a system administrator) and can perform different operations in response to different instructions. Figure 3 is a schematic diagram of an optional access rights management method according to an embodiment of the present application; Figure 3As shown, when the server obtains the first access data set of the user using the target client in the first period of time, the server can use the first access data set and the corresponding data features to input into the permission prediction model to obtain the corresponding target permission. The target permission can be displayed to the system administrator in different ways, and the instructions sent by the system administrator can be accepted to determine the user's permission.

[0050] In an optional implementation, if the system administrator has approved and no changes are needed, a permission determination instruction can be sent to the server, and the server can assign target permissions to the user in response to the permission determination instruction. If the system administrator has not approved, a permission adjustment instruction can be sent to the server, and the server can adjust the second access data set to the third access data set in response to the permission adjustment instruction, and update permissions for the user.

[0051] Through the above implementation of the present application, after automatically generating the permission recommendation results suitable for the current user and file, the data set corresponding to the permission can be adjusted or determined through the received instructions to ensure the rationality and accuracy of the results. And avoid the overfitting problem after the model runs for a period of time, and improve the accuracy of permission allocation.

[0052] In an optional embodiment, after determining the second access data set corresponding to the target permission and assigning the target client the permission to obtain the second access data set, the method further includes: obtaining an access instruction of the target client within a second time period, wherein the access instruction is used to indicate a fourth access data set; comparing the fourth access data set with the second access data set, and generating a prompt message when a preset prompt condition is met.

[0053] In an optional implementation, generating prompt information when a preset prompt condition is met includes: generating prompt information when the number of access data in the fourth access data set that is not included in the second access data set reaches a preset threshold.

[0054] It should be noted that, after receiving the user's access request, the fourth access data corresponding to the access request can be compared with the access data in the second access data set corresponding to the user's authority. If the fourth access data does not exist in the second access data set, it can be considered that the user does not have the authority to access the fourth access data. The server can reject the access request and return an error message to indicate that the user cannot access the data.

[0055] Figure 4 is a schematic diagram of another optional access rights management method according to an embodiment of the present application; Figure 4As shown, the user's access request can be analyzed and the access behavior can be detected. If the access data indicated by the access request does not have permission, it can be considered as an abnormal behavior. If the abnormal behavior in the second period reaches a threshold, a prompt message can be generated. The prompt message can indicate that the user has accessed unauthorized files multiple times.

[0056] Through the above-mentioned implementation mode of the present application, the user's access request can be analyzed and abnormal behavior can be identified. When the user's abnormal behavior is detected multiple times, a prompt message can be generated to notify the system administrator. Potential security threats can be proactively identified to prevent data leakage, thereby improving the security of the system.

[0057] In an optional embodiment, the training process of the above-mentioned permission prediction model includes: obtaining a reference access data set of a reference client within a third time period, and determining the data features corresponding to each reference access data in the reference access data set; obtaining initialization parameters of the permission prediction model; using the reference access data set to train the permission prediction model to update the parameters of the permission prediction model, and obtaining a trained permission prediction model when preset conditions are met.

[0058] In an optional implementation, before training the model, it is necessary to determine a training data set, and a reference access data set of a reference client in a third time period can be obtained. The reference client can be at least one client including the target client, and the reference client can read access data from the NFS server. The third time period can also be pre-set, and the third time period can be a period of time before training, or a period of time with the current time as one end of the period. The reference access data set can be data accessed by a user using a reference client, or it can be data accessed by multiple users using the reference client.

[0059] In an optional implementation, after obtaining the training data (reference access data set), the parameters of the permission prediction model can be initialized, and then the permission prediction model can be trained using the reference access data set to update its parameters. Meeting the preset condition can be that the preset indicators such as the accuracy, recall rate, and mean square error of the permission prediction model reach a preset threshold range. When the preset conditions are met, the model training is considered to be completed.

[0060] Through the above implementation of the present application, the model can be trained using the reference access data set of multiple clients in the third period. And the preset evaluation index of the model can be used to indicate whether the model training is completed. The robustness, universality and accuracy of the trained model can be improved.

[0061] In an optional embodiment, the above-mentioned obtaining of a reference access data set of a reference client within a third time period and determining data features corresponding to each reference access data in the reference access data set includes: performing data cleaning and standardization on the reference access data set and the data features corresponding to each of the multiple reference access data to obtain a reference access data set to be determined; removing data features that meet screening conditions from the data features corresponding to each of the reference access data in the reference access data set to be determined to obtain an updated reference access data set.

[0062] In an optional embodiment, after obtaining the reference access data, the data features corresponding to each of them can be determined. Then the data is cleaned, and missing value processing can be performed: identifying and processing missing values ​​in the reference access data set and the corresponding data features, possibly by deletion, filling (such as using the mean, median, mode or model-based prediction, etc.). Outlier detection can be performed: identifying outliers in the reference access data set and the corresponding data features and deciding how to handle them, such as deleting, replacing or transforming. Deduplication: checking and deleting duplicate records in the reference access data set and the corresponding data features to avoid bias in the analysis. Error correction: correcting entry errors in the reference access data set and the corresponding data features or errors in the data extraction process.

[0063] In an optional implementation, data features for training may be determined before processing the training data, such as retaining data features such as data size and data type, and removing data features such as data security, so as to remove irrelevant or redundant data features.

[0064] Optionally, after data cleaning, annotation, and feature selection, the reference access data set is subjected to an updated reference access data set as a data set for the model training phase.

[0065] Through the above implementation of the present application, the reference access data set is cleaned, annotated, and feature-selected to obtain an updated reference access data set as the data set for the model training phase, which can improve the performance and accuracy of the trained model and increase the model training speed. In addition, automatic data preprocessing can reduce manual intervention in the data processing process, reduce the possibility of human errors, and improve the stability and reliability of the system.

[0066] In an optional embodiment, the above-mentioned method of training the permission prediction model using a reference access data set to update the parameters of the permission prediction model, and obtaining a trained permission prediction model when preset conditions are met, includes: randomly dividing the reference access data set into M access data subsets; traversing the M access data subsets, and performing the following operations during the i-th traversal process: using all access data subsets of the M access data subsets except the i-th access data subset as training sets to train the permission prediction model, and inputting the i-th access data subset into the permission prediction model to obtain the i-th evaluation function result of the permission prediction model, wherein M is an integer greater than 0, and i is an integer greater than 0 and less than or equal to M; when the M evaluation function results meet the preset conditions, a trained permission prediction model is obtained.

[0067] Figure 5 is a schematic diagram of another optional access rights management method according to an embodiment of the present application; Figure 5 As shown, the reference access data set 502 (such as Figure 5 D) is randomly divided into M access data subsets 504 (such as Figure 5 D1 to D M ). The M access data subsets can be traversed, and the following operations can be performed during each traversal: all access data subsets except the i-th access data subset in the M access data subsets are used as training sets to train the permission prediction model, and the i-th access data subset is input into the permission prediction model to obtain the i-th evaluation function result of the permission prediction model. The evaluation function result obtained in each traversal can be averaged to evaluate the performance of the model. The above can be used to test the hyperparameter combination in the permission prediction model, such as the number of features of the permission prediction model, the number of node layers, the access data threshold and other parameters. The role of specific parameters in the training process will be explained in detail below and will not be repeated here.

[0068] In an optional implementation, when the evaluation function result does not meet the preset conditions (such as the mean of the evaluation function result is less than the preset result), the parameters of the authority prediction model can be changed and trained again to determine the above-mentioned hyperparameters of the authority prediction model.

[0069] Through the above implementation of the present application, the reference access data set can be randomly split into a training set and a validation set, and the performance of the permission prediction model can be trained and evaluated multiple times to determine the hyperparameters of the permission prediction model, and the optimal parameter configuration can be selected to improve the performance of the permission prediction model. In this way, the prediction results of the model are more accurate during the application process, and the performance of the system is improved.

[0070] In an optional embodiment, the above-mentioned use of all access data subsets except the i-th access data subset in the M access data subsets as training sets to train the permission prediction model includes: performing T random sampling on the training set, and in each random sampling process, performing the following operations: collecting n samples in the training set to obtain a sampling set containing n samples, wherein T is an integer greater than 0, and n is the same as the number of reference access data contained in the training set; establishing T permission prediction sub-models, and making one-to-one correspondence between the T sampling sets and the T permission prediction sub-models; using the sampling sets to train the corresponding permission prediction sub-models, and the training process of the permission prediction sub-models includes: when currently in the first node layer, according to the feature number, randomly determining the first feature set from the data features corresponding to each of the reference access data, wherein the number of feature types of the data features in the feature set is the same as the feature number; establishing candidate nodes of the second node layer according to the first feature set, and evaluating the candidate nodes using the first feature set to obtain evaluation results of the candidate nodes of the second node layer; determining the candidate nodes of the second node layer according to the evaluation results of the candidate nodes of the second node layer. Node; split the sampling set according to the nodes of the second node layer to obtain the sampling subsets corresponding to the nodes of the second node layer; when currently in the p-th node layer, according to the feature number, randomly determine the q-th feature set from the sampling subsets corresponding to the nodes of the p-th node layer; establish the candidate nodes of the p+1-th node layer according to the q-th feature set, and use the q-th feature set to evaluate the candidate nodes of the p+1-th node layer to obtain the evaluation results of the candidate nodes of the p+1-th node layer; determine the p+1-th node layer according to the evaluation results of the candidate nodes of the p+1-th node layer. nodes of the p-th node layer; split the sampling subset corresponding to the nodes of the p-th node layer according to the nodes of the p+1-th node layer to obtain the sampling subset corresponding to the nodes of the p+1-th node layer, wherein p is an integer greater than 1, and q is an integer greater than 1; when the number of reference access data contained in the sampling subset corresponding to the nodes of the p+1-th node layer is less than or equal to the preset number of data or p is greater than or equal to the preset number of layers, the model composed of the current p+1 node layers is determined as the permission prediction sub-model; T permission prediction sub-models are integrated to obtain the permission prediction model.

[0071] In an optional implementation, the reference access data set may be used as a training set for training, and the training set may be randomly sampled T times. In each random sampling process, the following operations are performed: the training set is sampled n times to obtain a sampling set containing n samples. In the process of determining the sampling set, a sample may be randomly taken out and put into the sampling set, and then the sample is put back into the initial data set, so that the sample may still be selected in the next sampling.

[0072] In an optional implementation, a permission prediction sub-model may be established. Figure 6is a schematic diagram of another optional access rights management method according to an embodiment of the present application; Figure 6 As shown, after obtaining T sampling sets using the reference data set, the sampling sets can be used to train the corresponding permission prediction sub-models. After the training of the T permission prediction sub-models is completed, they are integrated to obtain a trained permission prediction model.

[0073] In an optional embodiment, there may be one node (root node) in the first node layer, and the nodes in the second node layer may be obtained by splitting the root node. Determining that the nodes in the second node layer may be split may be performed using the type of data features. As before, the number of features of the model may be determined, which defines the number of features to be considered when looking for the best split. It may be an integer or a ratio of the total number of features. If the number of features is set to an integer, then at each splitting node, the number of features specified by this integer will be randomly selected for evaluation. If the number of features is set to a floating point number, then it indicates that a certain proportion of the total number of original features will be considered. For example, if the data set has 100 features, an eigenvalue of 0.3 means that 30 features will be considered at each splitting point.

[0074] In an optional implementation, in the process of determining the splitting node, the determination method can be changed according to the form of the data feature. For example, for continuous features, it is necessary to traverse all unique values ​​and calculate the evaluation value of each possible splitting point; for discrete features, each different category value is a potential splitting point. For each splitting point, the evaluation result after splitting is calculated. For classification tasks, information gain can be used as a function to determine the evaluation result; for regression tasks, mean square error may be used as a function to determine the evaluation result.

[0075] In an optional implementation, the above process can be repeated for each node until the number of node layers reaches a preset number of layers, or the number of reference access data contained in the sampling subset corresponding to the node is less than or equal to the preset number of data, and it can be determined that the training of the permission prediction sub-model is completed. The preset number of layers and the preset number of data can be determined in advance as described above.

[0076] Through the above-mentioned implementation mode of the present application, a permission prediction model can be obtained by training multiple permission prediction sub-models and integrating them. In this way, the overfitting problem of a single model can be effectively resisted, and more stable and accurate prediction results can be provided, ensuring that the permission management method can maintain good performance under various complex access behaviors.

[0077] In an optional embodiment, the above method also includes: obtaining a fifth access data set of the target client within a fourth time period, and determining data features corresponding to each of multiple fifth access data in the fifth access data set; using the fifth access data set and the data features corresponding to each of the fifth access data to update parameters of the permission prediction model to obtain an updated permission prediction model.

[0078] In an optional implementation, the target client can obtain access data from the NFS server, and the server can determine the access data within the fourth period in the access data as the fifth access data set. The fifth access data set can be used to update the parameters of the permission prediction model in the above manner to obtain an updated permission prediction model.

[0079] Through the above implementation of the present application, the fifth access data set can be collected regularly to retrain and update the permission prediction model. This can ensure that the system can continue to adapt to new access patterns and maintain the optimal state of the permission management method. This can improve the performance of the system. It can also be used in combination with the administrator inputting different instructions as recorded above, which is equivalent to considering the data set used to input the update model to avoid overfitting of the model.

[0080] In an optional implementation, the server may be a distributed storage system, in which different storage methods may be adopted, such as data replication (storing multiple copies of the same file or data block on multiple servers), data sharding (dividing large files or data sets into multiple small blocks (called shards), each of which can be stored independently on different servers), data redundancy (the system may store multiple copies of data, which can be exactly the same), etc.

[0081] It should be noted that when a user accesses data in a distributed storage system, it is necessary to ensure consistency of the accessed data, that is, the permissions of the same user on the same client to files in various distributed servers are consistent.

[0082] In an optional implementation, the first access data set of the user in the first time period can be processed using the permission prediction model to obtain the target permissions corresponding to each of the multiple distributed servers. The target permissions corresponding to each of the multiple distributed servers can be used to determine the user's permissions for the entire server. For example, the permissions corresponding to files with consistent relationships in the distributed servers (such as copies of the same file, fragments of the same file, etc.) can be used to vote, and the result with more permission judgment results in the result can be determined as the target permission corresponding to the user. For example, for a copy of a file, different distributed servers can correspond to the result that 3 servers assign permissions to the user, and 1 server prohibits the user from accessing. The user can be assigned access rights to the file. After granting access rights, even the prohibited server can access the file. It is also possible to assign weights to the allocation results. If there is a server indicating that access is prohibited, the user will not have access rights to the file that has a consistent relationship with the file.

[0083] In an optional implementation, a permission prediction model may be used to process a first access data set of a user in a first period of time to obtain target permissions for the entire file, and the corresponding permissions of the user may be determined for files in each distributed server based on the obtained target permissions.

[0084] Through the above-mentioned implementation modes of the present application, in the case of a distributed storage system, the server can predict the user's access rights while maintaining the consistency of the files, so as to improve the reliability of the permission allocation.

[0085] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, or by hardware, but in many cases the former is a better implementation method. Based on this understanding, the computer software product is stored in a storage medium (such as ROM / RAM, disk, CD), including several instructions for enabling a terminal device (which can be a computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0086] In this embodiment, a device for managing access rights is also provided, which is used to implement the above embodiments and preferred implementations, and will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0087] Figure 7 is a structural block diagram of an optional access rights management device according to an embodiment of the present application, such as Figure 7As shown, the device comprises:

[0088] The data acquisition module 72 is used to acquire a first access data set of the target client within a first time period, and determine a data feature corresponding to at least one first access data in the first access data set, wherein the data feature is used to indicate a characteristic and an access mode of the first access data;

[0089] The permission prediction module 74 is used to input the data features corresponding to the first access data set and at least one first access data into the permission prediction model to obtain the target permission corresponding to the target client;

[0090] The authority allocation module 76 is used to determine the second access data set corresponding to the target authority and allocate the authority to obtain the second access data set to the target client.

[0091] Through the present application, the first access data set of the target client in the first time period is obtained, and the data features corresponding to at least one first access data in the first access data set are determined, wherein the data features are used to indicate the characteristics and access mode of the first access data; the data features corresponding to the first access data set and at least one first access data are input into the permission prediction model to obtain the target permission corresponding to the target client; the second access data set corresponding to the target permission is determined, and the permission to obtain the second access data set is allocated to the target client. In the case where the target client accesses data to the server, the server can obtain the data accessed by the target client in the first time period, and select part of it as the first access data set. After obtaining the first access data set, the corresponding data features can be determined, and the permission prediction model is used to generate permission recommendations suitable for the current user and file through the access data and data features. It is used as the target permission, and the second access data set corresponding to the target permission is determined, so as to allocate the permission to obtain the second access data set to the target client. In this way, the access rights of the client can be determined in real time according to the data accessed by the client, and its permissions can be updated, so that in the face of changing users or files, the user's permissions can be quickly allocated to ensure that the permission configuration always matches the actual use requirements and is applicable to the dynamic requirements of different users and scenarios. The invention solves the technical problem of low flexibility of the access permission management method in the current NFS system in the related art, and can automatically recommend and adjust the permission setting intelligently according to the user's access data, thereby improving the efficiency of permission management.

[0092] Optionally, the above-mentioned permission allocation module 76 is also used to update the second access data set to a third access data set and allocate the target client with the permission to obtain the third access data set when receiving a permission adjustment instruction, wherein the permission adjustment instruction is used to indicate the third access data set; and allocate the target client with the permission to obtain the second access data set when receiving a permission determination instruction.

[0093] Optionally, the authority allocation module 76 is further configured to obtain access instructions from the target client within a second period of time, wherein the access instructions are used to indicate a fourth access data set; compare the fourth access data set with the second access data set, and generate prompt information when a preset prompt condition is met.

[0094] Optionally, the generating of prompt information when a preset prompt condition is met includes: generating prompt information when the number of access data in the fourth access data set that is not included in the second access data set reaches a preset threshold.

[0095] Optionally, the training process of the above-mentioned permission prediction model includes: obtaining a reference access data set of the reference client within a third time period, and determining the data features corresponding to each reference access data in the reference access data set; obtaining initialization parameters of the permission prediction model; using the reference access data set to train the permission prediction model to update the parameters of the permission prediction model, and obtaining a trained permission prediction model when preset conditions are met.

[0096] Optionally, the above-mentioned obtaining of a reference access data set of a reference client within a third time period and determining data features corresponding to each reference access data in the reference access data set includes: performing data cleaning and standardization on the reference access data set and data features corresponding to each of the multiple reference access data to obtain a reference access data set to be determined; removing data features that meet screening conditions from the data features corresponding to each of the reference access data in the reference access data set to be determined to obtain an updated reference access data set.

[0097] Optionally, the above-mentioned method of training the permission prediction model using the reference access data set to update the parameters of the permission prediction model, and obtaining a trained permission prediction model when preset conditions are met, includes: randomly dividing the reference access data set into M access data subsets; traversing the M access data subsets, and performing the following operations during the i-th traversal process: using all access data subsets of the M access data subsets except the i-th access data subset as training sets to train the permission prediction model, and inputting the i-th access data subset into the permission prediction model to obtain the i-th evaluation function result of the permission prediction model, wherein M is an integer greater than 0, and i is an integer greater than 0 and less than or equal to M; when the M evaluation function results meet the preset conditions, a trained permission prediction model is obtained.

[0098] Optionally, the above-mentioned use of all access data subsets except the i-th access data subset in the M access data subsets as training sets to train the permission prediction model includes: performing T random sampling on the training set, and in each random sampling process, performing the following operations: collecting n samples in the training set to obtain a sampling set containing n samples, wherein T is an integer greater than 0, and n is the same as the number of reference access data contained in the training set; establishing T permission prediction sub-models, and making one-to-one correspondence between the T sampling sets and the T permission prediction sub-models; using the sampling sets to train the corresponding permission prediction sub-models, and the training process of the permission prediction sub-models includes: when currently in the first node layer, according to the feature number, randomly determining the first feature set from the data features corresponding to each of the reference access data, wherein the number of feature types of the data features in the feature set is the same as the feature number; establishing candidate nodes of the second node layer according to the first feature set, and using the first feature set to evaluate the candidate nodes to obtain evaluation results of the candidate nodes of the second node layer; determining the nodes of the second node layer according to the evaluation results of the candidate nodes of the second node layer; The sampling set is split according to the nodes of the second node layer to obtain the sampling subsets corresponding to the nodes of the second node layer; when the node is currently in the p-th node layer, the q-th feature set is randomly determined from the sampling subsets corresponding to the nodes of the p-th node layer according to the feature number; the candidate nodes of the p+1-th node layer are established according to the q-th feature set, and the candidate nodes of the p+1-th node layer are evaluated using the q-th feature set to obtain the evaluation results of the candidate nodes of the p+1-th node layer; the p+1-th node layer is determined according to the evaluation results of the candidate nodes of the p+1-th node layer. nodes of the node layer; split the sampling subset corresponding to the nodes of the p-th node layer according to the nodes of the p+1-th node layer to obtain the sampling subset corresponding to the nodes of the p+1-th node layer, wherein p is an integer greater than 1, and q is an integer greater than 1; when the number of reference access data contained in the sampling subset corresponding to the nodes of the p+1-th node layer is less than or equal to the preset number of data or p is greater than or equal to the preset number of layers, the model composed of the current p+1 node layers is determined as the permission prediction sub-model; integrate T permission prediction sub-models to obtain the permission prediction model.

[0099] Optionally, the above-mentioned permission allocation module 76 is also used to obtain the fifth access data set of the target client within the fourth time period, and determine the data characteristics corresponding to each of the multiple fifth access data in the fifth access data set; use the fifth access data set and the data characteristics corresponding to each of the fifth access data to update the parameters of the permission prediction model to obtain an updated permission prediction model.

[0100] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0101] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0102] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0103] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0104] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0105] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0106] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0107] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for managing access rights, It is characterized in that The method comprises: Acquire a first access data set of a target client in a first time period, and determine a data feature corresponding to at least one first access data in the first access data set, wherein the data feature is used to indicate a characteristic and an access mode of the first access data; Inputting data features corresponding to the first access data set and the at least one first access data into a permission prediction model to obtain a target permission corresponding to the target client; A second access data set corresponding to the target permission is determined, and a permission to obtain the second access data set is allocated to the target client.

2. The method according to claim 1, It is characterized in that The determining the second access data set corresponding to the target permission and allocating permission for the target client to obtain the second access data set includes: When receiving the permission adjustment instruction, updating the second access data set to a third access data set, and allocating permission for the target client to obtain the third access data set, wherein the permission adjustment instruction is used to indicate the third access data set; When receiving the authority determination instruction, the target client is assigned the authority to obtain the second access data set.

3. The method according to claim 1, It is characterized in that After determining the second access data set corresponding to the target permission and allocating permission for the target client to obtain the second access data set, the method includes: Obtaining an access instruction of the target client within a second time period, wherein the access instruction is used to indicate a fourth access data set; The fourth access data set is compared with the second access data set, and prompt information is generated when a preset prompt condition is met.

4. The method according to claim 3, It is characterized in that The generating of prompt information when the preset prompt condition is met includes: When the number of access data in the fourth access data set that is not included in the second access data set reaches a preset threshold, prompt information is generated.

5. The method according to claim 1, It is characterized in that The training process of the permission prediction model includes: Acquire a reference access data set of the reference client in a third time period, and determine data features corresponding to each of the reference access data in the reference access data set; Obtaining initialization parameters of the authority prediction model; The authority prediction model is trained using the reference access data set to update the parameters of the authority prediction model, and the trained authority prediction model is obtained when preset conditions are met.

6. The method according to claim 5, It is characterized in that The obtaining of a reference access data set of the reference client in a third time period, and determining data features corresponding to each of the reference access data in the reference access data set, includes: Performing data cleaning and standardization processing on the reference access data set and data features corresponding to each of the plurality of reference access data to obtain a reference access data set to be determined; The data features that meet the screening conditions are removed from the data features corresponding to the reference access data in the reference access data set to be determined, so as to obtain the updated reference access data set.

7. The method according to claim 5, It is characterized in that The using the reference access data set to train the permission prediction model to update the parameters of the permission prediction model, and obtaining the trained permission prediction model when a preset condition is met, includes: Randomly divide the reference access data set into M access data subsets; The M access data subsets are traversed, and the following operations are performed during the i-th traversal: Using all the access data subsets except the i-th access data subset in the M access data subsets as training sets to train the permission prediction model, and inputting the i-th access data subset into the permission prediction model to obtain the i-th evaluation function result of the permission prediction model, wherein M is an integer greater than 0, and i is an integer greater than 0 and less than or equal to M; When the M evaluation function results meet the preset conditions, the trained authority prediction model is obtained.

8. The method according to claim 7, It is characterized in that The step of using all the access data subsets except the i-th access data subset in the M access data subsets as training sets to train the authority prediction model includes: Perform T random sampling on the training set, and in each random sampling process, perform the following operations: collect n samples in the training set to obtain a sampling set containing n samples, wherein T is an integer greater than 0, and n is the same as the number of the reference access data contained in the training set; Establishing T authority prediction sub-models, and making one-to-one correspondence between the T sampling sets and the T authority prediction sub-models; The corresponding authority prediction sub-model is trained using the sampling set, and the training process of the authority prediction sub-model includes: In the case of being currently in the first node layer, according to the feature number, randomly determine the first feature set from the data features corresponding to each of the reference access data, wherein the number of feature types described in the data features in the feature set is the same as the feature number; establish candidate nodes of the second node layer according to the first feature set, and evaluate the candidate nodes using the first feature set to obtain evaluation results of the candidate nodes of the second node layer; determine the nodes of the second node layer according to the evaluation results of the candidate nodes of the second node layer; split the sampling set according to the nodes of the second node layer to obtain sampling subsets corresponding to the nodes of the second node layer; In the case of being currently in the p-th node layer, according to the feature number, randomly determine the q-th feature set from the sampling subsets corresponding to the nodes of the p-th node layer; establish the candidate nodes of the p+1-th node layer according to the q-th feature set, and use the q-th feature set to evaluate the candidate nodes of the p+1-th node layer to obtain the evaluation results of the candidate nodes of the p+1-th node layer; determine the nodes of the p+1-th node layer according to the evaluation results of the candidate nodes of the p+1-th node layer; split the sampling subsets corresponding to the nodes of the p-th node layer according to the nodes of the p+1-th node layer to obtain the sampling subsets corresponding to the nodes of the p+1-th node layer, wherein p is an integer greater than 1, and q is an integer greater than 1; When the number of the reference access data contained in the sampling subset corresponding to the nodes of the p+1th node layer is less than or equal to the preset number of data or p is greater than or equal to the preset number of layers, the model composed of the current p+1 node layer is determined as the permission prediction sub-model; The T authority prediction sub-models are integrated to obtain the authority prediction model.

9. The method according to any one of claims 1 to 8, It is characterized in that The method further comprises: Acquire a fifth access data set of the target client within a fourth time period, and determine data features corresponding to each of a plurality of fifth access data in the fifth access data set; The parameters of the authority prediction model are updated by using the fifth access data set and the data features corresponding to each of the fifth access data to obtain the updated authority prediction model.

10. A device for managing access rights, It is characterized in that The device comprises: a data acquisition module, configured to acquire a first access data set of a target client within a first time period, and determine a data feature corresponding to at least one first access data in the first access data set, wherein the data feature is used to indicate a characteristic and an access mode of the first access data; A permission prediction module, used for inputting data features corresponding to the first access data set and the at least one first access data into a permission prediction model to obtain a target permission corresponding to the target client; The authority allocation module is used to determine the second access data set corresponding to the target authority and allocate the authority for obtaining the second access data set to the target client.

11. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method according to any one of claims 1 to 9 when executed by a processor.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, It is characterized in that When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images