Access permission control method and device, electronic equipment, product and storage medium
Through the dynamic verification mechanism, combined with the characteristic attributes of user behavior information and historical behavior information, substantive permissions are granted, which solves the problem that traditional identity verification methods cannot control access rights after identity information is stolen, and improves the security and user experience of the system.
Patent Information
- Application Number
- CN202411501055.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-25
- Publication Date
- 2024-12-27
AI Technical Summary
Traditional username and password authentication methods cannot control access rights after identity information is stolen, resulting in security risks of malicious access and unauthorized operations.
By obtaining the behavior information of ordinary permission users, determining their behavior characteristic attributes, and verifying them with the characteristic attributes of historical behavior information, substantive permissions are dynamically granted to ensure that the user only obtains full access after passing the verification.
Effectively prevent malicious access and unauthorized operations caused by identity information being stolen, improving the security and flexibility of the system, ensuring that users cannot perform important operations before passing the verification.
Smart Images
Figure CN119203093A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security technology, and in particular to an access authority control method, device, electronic equipment, product and storage medium. Background Art
[0002] With the rapid development of the Internet and the continuous expansion of the network scale, network security risks have become increasingly prominent, and security issues such as network vulnerabilities have gradually increased. Traditional user authentication methods mainly rely on usernames and passwords. Users enter their credentials for authentication when logging in, and they can obtain access rights after passing the authentication. Although this method can protect the basic information security of users to a certain extent, its security faces many challenges, especially in multi-scenario centralized platforms. Once the user's username and password are stolen, the thief can use the identity to easily obtain access rights to multiple scenarios, which will have a serious impact on all scenarios in the platform. Therefore, there is an urgent need for an access rights control method to prevent malicious access and unauthorized operations caused by identity theft. Summary of the invention
[0003] The present invention provides an access authority control method, device, electronic device, product and storage medium, which are used to solve the defects of the prior art that after identity information is stolen, access authority cannot be controlled, which may lead to malicious access and unauthorized operation.
[0004] The present invention provides an access authority control method, comprising: Obtain behavior information of users with general permissions; Based on the behavior information of the ordinary authorized user, determining a behavior characteristic attribute corresponding to the behavior information; Based on the historical behavior information of the ordinary authorized user in each verification scenario in the preset verification scenario set, respectively determine the behavior characteristic attributes corresponding to each of the historical behavior information; The behavior characteristic attributes corresponding to the behavior information are verified with the behavior characteristic attributes corresponding to each of the historical behavior information respectively. If the verification result is successful, the ordinary authority user is determined as a substantial authority user.
[0005] According to an access rights control method provided by the present invention, the behavior information of the ordinary-authority user is determined based on the following method: Receive login request information of a user to be identified, and obtain login behavior information of the user to be identified; the login behavior information represents behavior data of the user to be identified during the login phase; Verifying the login request information, and determining the user to be identified as a user with ordinary authority after the verification is passed; Acquire operation behavior information of the ordinary authority user; the operation behavior information represents the behavior data of the ordinary authority user in the operation stage after verification; The login behavior information and the operation behavior information are determined as behavior information of a user with ordinary authority.
[0006] According to an access rights control method provided by the present invention, the determining of the behavior characteristic attribute corresponding to the behavior information based on the behavior information of the ordinary permission user includes: Based on the behavior information, determining an interaction operation sequence corresponding to the behavior information; the interaction operation sequence includes information of each interaction operation and a time corresponding to each interaction operation; the interaction operation sequence is obtained by sorting the information of each interaction operation based on a time sequence of a time corresponding to each interaction operation; Collecting the interactive operation sequence corresponding to the behavior information based on a behavior feature collection method, and determining a behavior feature attribute corresponding to the behavior information; Wherein, the behavior feature collection method includes: Determine the time interval between each interaction operation based on the time corresponding to each interaction operation; Determine the minimum value among the time intervals as the standard time difference; Based on the time intervals exceeding the preset interval threshold in each of the time intervals, the interactive operation sequence is divided into a plurality of sub-operation sequences, the standard deviation of all time intervals in each of the sub-operation sequences is calculated, and a sub-operation sequence standard deviation set is determined; The standard time difference and the sub-operation sequence standard deviation set are determined as behavior characteristic attributes.
[0007] According to an access rights control method provided by the present invention, the behavior characteristic attribute corresponding to any of the historical behavior information is determined based on the following method: Based on the historical behavior information, determining an interactive operation sequence corresponding to the historical behavior information; The interactive operation sequence corresponding to the historical behavior information is collected based on the behavior feature collection method to determine the behavior feature attributes corresponding to the historical behavior information.
[0008] According to an access rights control method provided by the present invention, the behavior characteristic attribute corresponding to the historical behavior information includes a standard time difference and a sub-operation sequence standard deviation set corresponding to the historical behavior information; The behavior characteristic attribute corresponding to the behavior information and the behavior characteristic attribute corresponding to any of the historical behavior information are verified based on the following method: Determine a ratio between a standard time difference in a behavior characteristic attribute corresponding to the behavior information and a standard time difference in a behavior characteristic attribute corresponding to the historical behavior information, and if the ratio is within a first preset threshold interval, determine that the first verification result is verified; Determine the normalized measurement value of each standard deviation in the sub-operation sequence standard deviation set in the behavior characteristic attribute corresponding to the behavior information, and the ratio between the normalized measurement values of each standard deviation in the sub-operation sequence standard deviation set in the behavior characteristic attribute corresponding to the historical behavior information, and if the ratio is within a second preset threshold range, determine that the second verification result is verified to be passed; Based on the first verification result being verified as passed and the second verification result being verified as passed, it is determined that the behavior characteristic attribute corresponding to the behavior information and the behavior characteristic attribute corresponding to the historical behavior information are successfully verified.
[0009] According to a method for access control provided by the present invention, the preset verification scenario set is determined based on the following method: Determine the weight of each historical access scenario in the historical access scenario set based on the number of visits and access duration of each historical access scenario in the historical access scenario set by the general permission user; The weights of the historical access scenarios in the historical access scenario set are sorted, and a preset verification scenario set is determined based on the sorting result.
[0010] The present invention also provides an access authority control device, comprising: A behavior information acquisition module is used to obtain behavior information of users with ordinary permissions; A first behavior characteristic attribute determination module, which is used to determine the behavior characteristic attribute corresponding to the behavior information based on the behavior information of the ordinary authority user; A second behavior characteristic attribute determination module, which is used to determine the behavior characteristic attribute corresponding to each historical behavior information based on the historical behavior information of the ordinary authority user in each verification scenario in the preset verification scenario set; A verification module is used to verify the behavior characteristic attributes corresponding to the behavior information with the behavior characteristic attributes corresponding to each of the historical behavior information. If the verification result is successful, the ordinary authority user is determined as a substantial authority user.
[0011] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the access authority control methods described above is implemented.
[0012] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any of the access authority control methods described above is implemented.
[0013] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the access authority control methods described above.
[0014] The access permission control method, device, electronic device, product and storage medium provided by the present invention obtain the behavior information of ordinary permission users; determine the behavior characteristic attributes corresponding to the behavior information based on the behavior information of the ordinary permission users; determine the behavior characteristic attributes corresponding to each historical behavior information based on the historical behavior information of the ordinary permission users in each verification scenario in a preset verification scenario set; verify the behavior characteristic attributes corresponding to the behavior information with the behavior characteristic attributes corresponding to each historical behavior information respectively, and if the verification result is successful, determine the ordinary permission user as a substantive permission user; the present invention adopts a dynamic verification mechanism, which only grants ordinary permissions after the user logs in, and determines the behavior characteristic attributes corresponding to the behavior information by monitoring and analyzing the behavior information of ordinary permission users, and grants substantive permissions only after the behavior characteristic attributes corresponding to the behavior information are verified with the behavior characteristic attributes corresponding to the historical behavior information; this permission control method ensures that the user cannot perform important operations before passing the verification, thereby preventing malicious access and unauthorized operations caused by identity information being stolen, and effectively improving security and flexibility. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0016] Figure 1 It is a flow chart of the access authority control method provided by the present invention.
[0017] Figure 2 It is a flow chart of a behavior feature collection method of the access permission control method provided by the present invention.
[0018] Figure 3 It is a structural schematic diagram of the access authority control device provided by the present invention.
[0019] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION
[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0021] With the rapid development of network technology and the continuous expansion of application scenarios, users' activities on multi-scenario centralized platforms are becoming more and more frequent, but the accompanying security risks are also increasing significantly. Especially in the identity authentication process, the traditional username and password mechanism is particularly vulnerable to network attacks. In the process of using these platforms, the applicant observed that many users' identities were stolen due to stolen passwords, which in turn affected the security and user experience of all scenarios in the platform. This situation seriously damaged the trust of users and caused the leakage of user information and economic losses.
[0022] Based on the above observations, the applicant clearly realized that the existing authentication mechanism is too dependent on static usernames and passwords and lacks dynamic analysis of user behavior. This allows attackers to easily gain access to all scenarios in the platform after obtaining user login information, thus posing greater security risks. The applicant realized that it is urgent to introduce a more flexible and intelligent access control mechanism to improve the security of the multi-scenario platform.
[0023] In view of the above problems, the present invention proposes the following embodiments.
[0024] Figure 1 is a flow chart of the access permission control method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 110, obtaining behavior information of users with ordinary permissions.
[0025] Here, a user with ordinary permissions refers to a user who is granted only limited access rights after preliminary identity verification. Ordinary permissions usually only allow users to perform some basic operations, such as browsing content or performing simple interactions, without involving access to sensitive information.
[0026] Here, behavioral information refers to various data generated when using a system or application, including but not limited to operation records, input behaviors, access paths, etc. Behavioral information provides a basis for analyzing user habits, identifying abnormal activities, and providing personalized services.
[0027] Regarding the process of determining the ordinary authorized user and the specific process of determining the behavior information, reference may be made to the following embodiments, which will not be described in detail here.
[0028] Step 120: Based on the behavior information of the ordinary-authority user, determine the behavior characteristic attribute corresponding to the behavior information.
[0029] Here, behavioral characteristic attributes refer to key features extracted through analysis of user behavior information, which can reflect the user's operating habits and usage patterns; these features can be quantitative, such as operation frequency, operation duration, etc., or qualitative, such as operation type.
[0030] The method for determining the behavior characteristic attribute corresponding to the behavior information may refer to the following embodiments, which will not be described in detail here.
[0031] Step 130 , based on the historical behavior information of the general-authority user in each verification scenario in a preset verification scenario set, the behavior characteristic attributes corresponding to each of the historical behavior information are determined respectively.
[0032] Here, the preset verification scenario set refers to a set of scenarios obtained through calculation and sorting based on the user's historical behavior data, which aims to optimize the identity authentication process and ensure the accuracy of verification.
[0033] Here, historical behavior information refers to all operation records performed by users in specific scenarios in the past, including but not limited to data such as users' click behaviors, input behaviors, and access paths, and is the basis for analyzing user behavior patterns. The behavior feature attributes corresponding to historical behavior information refer to the features extracted from the analysis of historical behavior information, reflecting the user's operating habits and patterns. These attributes will be used to compare with the behavior feature attributes corresponding to the current user behavior information to determine the legitimacy of their identity.
[0034] Step 140: Verify the behavior characteristic attributes corresponding to the behavior information with the behavior characteristic attributes corresponding to each of the historical behavior information. If the verification result is successful, the ordinary authority user is determined as a substantial authority user.
[0035] In one embodiment, the behavioral characteristic attributes extracted from the behavior information of the general permission user are compared one by one with the behavioral characteristic attributes extracted from the historical behavior information of the user in each verification scenario. The key to this step is to find the similarity between the current behavior and the historical behavior in each verification scenario. If the behavioral characteristic attributes in the current situation are respectively consistent with each past behavioral characteristic attribute, the verification result is deemed to be successful, and the identity of the user is upgraded from a general permission user to a substantive permission user. At this time, the user will obtain more comprehensive access rights.
[0036] The access permission control method provided in the embodiment of the present invention adopts a dynamic verification mechanism to grant only ordinary permissions after the user logs in, monitors and analyzes the behavior information of users with ordinary permissions, determines the behavior characteristic attributes corresponding to the behavior information, and grants substantive permissions only after the behavior characteristic attributes corresponding to the behavior information and the behavior characteristic attributes corresponding to the historical behavior information have been verified. This permission control method ensures that the user cannot perform important operations before passing the verification, thereby preventing malicious access and unauthorized operations caused by the theft of identity information, and effectively improving security and flexibility.
[0037] Based on any of the above embodiments, in this method, the behavior information of the ordinary-authority user is determined based on the following method: Receive login request information of a user to be identified, and obtain login behavior information of the user to be identified; the login behavior information represents behavior data of the user to be identified during the login phase; Verifying the login request information, and determining the user to be identified as a user with ordinary authority after the verification is passed; Acquire operation behavior information of the ordinary authority user; the operation behavior information represents the behavior data of the ordinary authority user in the operation stage after verification; The login behavior information and the operation behavior information are determined as behavior information of a user with ordinary authority.
[0038] Here, login request information refers to the information submitted by the user to be identified during the login process, including user name, password and other credentials. Login behavior information represents the user's behavior data during the login phase, including but not limited to the continuity of keyboard tapping, time difference, etc. Operation behavior information refers to the behavior data of the user who has obtained ordinary permissions during the operation phase after successful login; It should be noted that by combining login behavior information and operation behavior information to form complete behavior information of ordinary privileged users, the system can obtain more comprehensive user behavior data by collecting behavior information before and after login; this comprehensiveness makes subsequent behavior analysis and verification more accurate.
[0039] Exemplarily, the behavior information may also include, but is not limited to, mouse clicking habits, user sliding habits on a touch screen, etc. These data reflect the user's operating habits and can provide identification clues.
[0040] For example, if the user to be identified logs in to the Metaverse scene, after the user to be identified successfully logs in, based on the access permission setting, the user to be identified will be determined as a user with ordinary permissions. Users with ordinary permissions can only enter preset public scenes or specific verification scenes, and cannot access all resources or private spaces in the system. This restriction prevents unverified users from accessing sensitive data or functions. Users can perform basic social interactions, such as sending messages and having simple exchanges with other users, but cannot perform high-privilege operations, such as managing scenes, editing content, or accessing administrator functions.
[0041] The access permission control method provided by the embodiment of the present invention can timely record the behavior data of the user to be identified during the login stage by receiving login request information and obtaining login behavior information, which provides the necessary data basis for subsequent permission verification; further, after successful verification, the user to be identified is determined to be a user with ordinary permissions, thereby allowing him to perform subsequent operations; the system will continue to collect the operation behavior information of users with ordinary permissions, so that the user's behavior habits in the system can be fully understood. By combining login behavior information and operation behavior information, the system can more accurately identify the user's behavior information, thereby realizing a more intelligent verification mechanism in subsequent access permission control; this process not only improves the accuracy and security of user identity authentication, but also provides users with a personalized experience, thereby effectively reducing potential security risks and enhancing the reliability of the system.
[0042] Based on any of the above embodiments, in the method, determining the behavior characteristic attribute corresponding to the behavior information based on the behavior information of the ordinary-authority user includes: Based on the behavior information, determining an interaction operation sequence corresponding to the behavior information; the interaction operation sequence includes information of each interaction operation and a time corresponding to each interaction operation; the interaction operation sequence is obtained by sorting the information of each interaction operation based on a time sequence of a time corresponding to each interaction operation; Collecting the interactive operation sequence corresponding to the behavior information based on a behavior feature collection method, and determining a behavior feature attribute corresponding to the behavior information; Wherein, the behavior feature collection method includes: Determine the time interval between each interaction operation based on the time corresponding to each interaction operation; Determine the minimum value among the time intervals as the standard time difference; Based on the time intervals exceeding the preset interval threshold in each of the time intervals, the interactive operation sequence is divided into a plurality of sub-operation sequences, the standard deviation of all time intervals in each of the sub-operation sequences is calculated, and a sub-operation sequence standard deviation set is determined; The standard time difference and the sub-operation sequence standard deviation set are determined as behavior characteristic attributes.
[0043] like Figure 2 As shown, Figure 2 The figure is a flowchart of the behavior feature collection method.
[0044] It should be noted that the information of each interactive operation performed by the user will be recorded and associated with the timestamp of the operation; these interactive operations are sorted in chronological order to form an ordered interactive operation sequence to reflect the user's operational behavior pattern; interactive operations refer to various interactive behaviors between the user and the system, including clicking the mouse, tapping keyboard keys, etc.; the moment corresponding to each interactive operation refers to the specific time when each interactive operation occurs, which is crucial for the subsequent analysis of the rules of user behavior.
[0045] In addition, based on the interactive operation sequence, the user's behavioral habits, preferences and patterns are analyzed, and the behavioral characteristic attributes that reflect the user's characteristics are extracted. Through the comprehensive analysis of these behavioral characteristic attributes, the user's behavior pattern can be better understood, and subsequent permission verification can be performed accordingly.
[0046] For example, taking keyboard tapping as an example, if the behavior information refers to keyboard tapping, then determine the interaction operation sequence corresponding to the keyboard tapping; when the user uses the keyboard, record the specific key position of each tapping and the time when it occurs. For example, when the user taps the keyboard, the generated interaction operation sequence may be as follows:<n,0:01> ,<i,0:05> , ...,<a,0:015> ;in,<n,0:00> Indicates that "n" was hit at 1 second.<a,0:015> It means that the letter "a" was typed at 1.5 seconds. By analyzing this interactive operation sequence, the user's operation habits and behavior patterns can be extracted to further provide support for identity authentication and permission control.
[0047] Here, the time interval between each interactive operation refers to the time difference between each interactive operation. For example, if a user taps the keyboard at a certain moment, the time difference between the next operation and the click operation is the time interval. The standard time difference refers to the minimum value selected from all time intervals as the standard time difference, which represents the minimum reaction time of the user between operations. Different users have different behaviors, and novice users have different operating habits from experienced users. On the basis of determining the standard time difference, abnormal behaviors can be more easily identified.
[0048] In one embodiment, based on the time intervals in each time interval that exceed the preset interval threshold, the interaction operation sequence is divided into several sub-operation sequences, that is, the first part of the interaction operation sequence of the time interval that exceeds the preset interval threshold forms one sub-operation sequence, and the second part of the interaction operation sequence of the time interval that exceeds the preset interval threshold forms another sub-operation sequence.
[0049] For example, taking the interactive operation sequence corresponding to keyboard tapping as an example, assuming that the preset interval threshold is 1 minute, if after calculating the interactive operation sequence corresponding to keyboard tapping, it is found that the time difference between tapping behavior 1 and tapping behavior 2 is 1 second, the time difference between tapping behavior 2 and tapping behavior 3 is 1 minute and 1 second, and the time difference between tapping behavior 3 and tapping behavior 4 is 2 seconds; in this case, the time interval between tapping behavior 2 and tapping behavior 3, which has a time difference greater than 1 minute, divides the previous and next behaviors into two subsequences, that is, sub-operation sequence A includes tapping behavior 1 and tapping behavior 2, and sub-operation sequence B includes tapping behavior 3 and tapping behavior 4. User behavior is usually continuous. When the time difference between tapping behaviors is greater than 1 minute, it can be reasonably inferred that there is a lack of correlation between the previous and next two behaviors, which means that the user interrupted the operation in the process and no analysis is performed; this process can improve the pertinence and accuracy of subsequent analysis and ensure that the extraction of behavioral feature attributes is more reliable.
[0050] Exemplarily, the standard deviation of all time intervals in each sub-operation sequence is calculated to determine the sub-operation sequence standard deviation set. Taking sub-operation sequence C as an example, sub-operation sequence C includes keyboard tapping behavior 11, keyboard tapping behavior 12, keyboard tapping behavior 13 and keyboard tapping behavior 14; wherein the time difference between keyboard tapping behavior 11 and keyboard tapping behavior 12 is , the time difference between keyboard tapping behavior 12 and keyboard tapping behavior 13 is , the time difference between keyboard tapping behavior 13 and keyboard tapping behavior 14 is ; The standard deviation of the sub-operation sequence C is calculated based on the following formula: C= ; in, is the average value of all time intervals in the sub-operation sequence C, that is, the average time difference, which is calculated based on the following formula: ; In another embodiment, after determining the standard time difference and the sub-operation sequence standard deviation set, the sub-operation sequence with the same interactive operation sequence is identified in the plurality of sub-operation sequences, and the interactive operation sequence repetition sequence is determined; further, the standard time difference, the sub-operation sequence standard deviation set and the interactive operation sequence repetition sequence are determined as behavior feature attributes. The combination of these three feature attributes can conduct a multi-dimensional and detailed analysis of user behavior, which can not only capture personalized behavior patterns, but also identify abnormal operations, thereby improving the accuracy of behavior verification and system security.
[0051] For example, if sub-operation sequence D contains tapping behavior 21, tapping behavior 22, and tapping behavior 23, and sub-operation sequence E also contains tapping behavior 21, tapping behavior 22, and tapping behavior 23 in the same order, then the generated interactive operation sequence repeating sequence is: {[tap behavior 21, tap behavior 22, tapping behavior 23], [ , ],[ , ]};in,[ , ],[ , ] are all time difference sequence elements; the number of sub-operation sequences with the same interaction operation order determines the number of time difference elements in the repeated interaction operation sequence. By recording these sequences and time differences, the rules or habits of user behavior can be further analyzed.
[0052] In the access permission control method provided by the embodiment of the present invention, the interactive operation sequence arranges each user operation in chronological order, which can comprehensively capture the user's specific operation behavior and the time point when it occurs. Then, the time interval between each operation is calculated, and the minimum time difference is determined as the standard time difference, which can reflect the user's accustomed operation speed. On this basis, by setting a preset interval threshold, the operation sequence exceeding the threshold is divided to form a number of sub-operation sequences, and the standard deviation of the time interval of each sub-sequence is calculated to form a sub-operation sequence standard deviation set. This step can effectively separate continuous behaviors and unrelated operations to ensure the accuracy of the analysis. As key behavioral feature attributes, the standard time difference and the sub-operation sequence standard deviation set can not only reflect the user's operation stability and regularity, but also quickly identify abnormal or atypical behaviors, thereby improving verification accuracy and security.
[0053] Based on any of the above embodiments, in this method, the behavior characteristic attribute corresponding to any of the historical behavior information is determined based on the following method: Based on the historical behavior information, determining an interactive operation sequence corresponding to the historical behavior information; The interactive operation sequence corresponding to the historical behavior information is collected based on the behavior feature collection method to determine the behavior feature attributes corresponding to the historical behavior information.
[0054] It should be noted that the behavior feature collection method used to collect the interaction operation sequence corresponding to the historical behavior information is the same as the method used to collect the interaction operation sequence corresponding to the behavior information. The same behavior feature collection method is used to maintain consistency and comparability. By using the same method, historical behavior and current behavior are evaluated within the same framework, thereby ensuring the fairness and accuracy of the analysis.
[0055] In addition, the method for determining the interactive operation sequence corresponding to the historical behavior information is the same as the method for determining the interactive operation sequence corresponding to the behavior information.
[0056] The access control method provided by the embodiment of the present invention ensures the consistency and comparability between historical behavior information and current behavior information by using the same behavior feature collection method to analyze the two. Extracting the interaction operation sequence based on the same rules can ensure that the historical behavior and the current behavior are compared on the same dimension; further, by collecting the behavior feature attributes through a consistent method, changes or anomalies in the user's behavior pattern can be reliably identified, which not only improves the fairness of the analysis, but also ensures the accuracy and stability of the behavior evaluation.
[0057] Based on any of the above embodiments, in this method, the behavior characteristic attribute corresponding to the historical behavior information includes a standard time difference and a sub-operation sequence standard deviation set corresponding to the historical behavior information; The behavior characteristic attribute corresponding to the behavior information and the behavior characteristic attribute corresponding to any of the historical behavior information are verified based on the following method: Determine a ratio between a standard time difference in a behavior characteristic attribute corresponding to the behavior information and a standard time difference in a behavior characteristic attribute corresponding to the historical behavior information, and if the ratio is within a first preset threshold interval, determine that the first verification result is verified; Determine the normalized measurement value of each standard deviation in the sub-operation sequence standard deviation set in the behavior characteristic attribute corresponding to the behavior information, and the ratio between the normalized measurement values of each standard deviation in the sub-operation sequence standard deviation set in the behavior characteristic attribute corresponding to the historical behavior information, and if the ratio is within a second preset threshold range, determine that the second verification result is verified to be passed; Based on the first verification result being verified as passed and the second verification result being verified as passed, it is determined that the behavior characteristic attribute corresponding to the behavior information and the behavior characteristic attribute corresponding to the historical behavior information are successfully verified.
[0058] It should be noted that only when both the first verification result and the second verification result are passed can the verification be determined to be successful, and after the verification is successful, the ordinary authority user is determined to be the actual authority user.
[0059] In addition, since the same behavior feature collection method is used, the behavior feature attributes corresponding to the behavior information include the standard time difference corresponding to the behavior information and the sub-operation sequence standard deviation set, and the behavior feature attributes corresponding to the historical behavior information also include the standard time difference corresponding to the historical behavior information and the sub-operation sequence standard deviation set; It should be noted that only the historical behavior information of one verification scenario is described here, and the verification methods of other verification scenarios in the verification scenario set are the same.
[0060] For example, by calculating the ratio of the two standard time differences and checking whether it is within the first preset threshold interval, it can be determined whether the time rhythm of the current behavior and the historical behavior are consistent. If the ratio is within a reasonable range, it means that the user's operation time interval is consistent with his historical habits, and the first verification result is verified. For example, the standard time difference in the behavior feature attribute corresponding to the behavior information is determined as , the standard time difference in the behavior characteristic attribute corresponding to the historical behavior information is determined as ; Determine the ratio between the standard time differences The formula is: ; when , indicating that the current user is abnormal and the verification fails. That is, if This indicates that the current user is relatively slow, which is considered abnormal and the verification fails. , indicating that the current user is relatively fast, and is also considered abnormal, and the verification fails. is the first preset threshold interval, and It is a preset ratio threshold, which is obtained by performing big data analysis on behavior samples of a large number of normal users. If it is within the first preset threshold range, it is determined that the first verification result is verified.
[0061] In one embodiment, a first metric value is determined by performing normalization calculation on a sub-operation sequence standard deviation set in a behavior characteristic attribute corresponding to the behavior information; a second metric value is determined by performing normalization calculation on a sub-operation sequence standard deviation set in a behavior characteristic attribute corresponding to the historical behavior information; a ratio of the first metric value to the second metric value is determined, and if the ratio is within a second preset threshold range, it is determined that the second verification result is verified to be passed; Exemplarily, after the first verification result is verified, each standard deviation in the sub-operation sequence standard deviation set in the behavior feature attribute corresponding to the behavior information is determined as , each standard deviation in the sub-operation sequence standard deviation set in the behavior feature attribute corresponding to the historical behavior information is determined as ; then the first metric value and the second metric The calculation formula is as follows: ; ; Then the ratio of the first metric value to the second metric value is The calculation formula is as follows: ; in, is the mean function. , then the behavior is considered abnormal and the verification fails, otherwise it is confirmed that the verification has passed. is a pre-set second preset threshold interval, obtained by performing big data analysis on a large number of normal user behavior samples; It is the ratio between the standard time differences calculated in the above embodiment.
[0062] Exemplarily, after the ratio of the first metric value to the second metric value is verified, if the historical behavior information does not have a repeated sequence of interactive operation orders, it is directly determined that the behavior characteristic attribute corresponding to the behavior information and the behavior characteristic attribute corresponding to the historical behavior information are successfully verified.
[0063] If both the behavior characteristic attribute corresponding to the behavior information and the behavior characteristic attribute corresponding to the historical behavior information have a repeated sequence of interactive operation sequences, then determine the mean of the time difference elements in the repeated sequence of interactive operation sequences in the behavior characteristic attribute corresponding to the behavior information, and then calculate the standard deviation of each mean, that is, the first repeated sequence standard deviation; similarly determine the mean of the time difference elements in the repeated sequence of interactive operation sequences in the behavior characteristic attribute corresponding to the historical behavior information, and then calculate the standard deviation of each mean, that is, the second repeated sequence standard deviation; further, calculate the normalized measurement value of the difference between the first repeated sequence standard deviation and the second repeated sequence standard deviation , as shown in the following formula:
[0064] in, is the difference between the standard deviation of the first and second repeat sequences, is the mean function. , it is determined that the third verification result passes; wherein The threshold value is preset for the standard deviation, which is obtained by performing big data analysis on a large number of normal user behavior samples.
[0065] Optionally, if the user logs in for the first time, that is, there is no historical behavior information, historical behavior information of similar users is searched based on the attributes (such as age, occupation, etc.) filled in when the user registered, so as to perform verification.
[0066] Based on any of the above embodiments, in this method, the preset verification scenario set is determined based on the following method: Determine the weight of each historical access scenario in the historical access scenario set based on the number of visits and access duration of each historical access scenario in the historical access scenario set by the general permission user; The weights of the historical access scenarios in the historical access scenario set are sorted, and a preset verification scenario set is determined based on the sorting result.
[0067] Here, the historical visit scene set refers to the collection of all scenes that the user has visited in the past, which contains the user's interaction history data in different scenes; the number of visits refers to the number of times the user enters each scene in the historical visit scene set. The greater the number of visits, the higher the user's preference for the scene. The visit duration refers to the length of time the user stays in each scene in the historical visit scene set. A long stay means that the user may be interested in the scene or have a high demand for use.
[0068] In one embodiment, the weight of each historical access scenario is determined by the number of visits and the duration of the visit. The scene with a large number of visits and a long stay time will have a higher weight. Several historical access scenarios with high weight rankings are selected as preset verification scenarios to determine a preset verification scenario set.
[0069] For example, if the user logs in for the first time, n scenarios are randomly selected from all scenarios in the system as preset verification scenarios. A preset value.
[0070] If the user is not logging in for the first time, the verification scenario is determined from the user's multiple historical access scenarios. Determine the number of historical access scenarios the user has entered ,like , it is determined that the user's historical access scenarios are all verification scenarios; if , then determine the number of visits to each scene , the duration of each visit in each scene . Where i is the user ID, j is the scene ID, and k is the number of entries. The weight of the corresponding historical access scene is calculated based on the number of visits and the duration of the visit. The formula is as follows:
[0071] in, Represents the proportion of users entering the corresponding historical visit scene. The higher the proportion, the more users like to enter the scene. It is the average time that users enter the corresponding historical access scene; It is a normalized metric value of the average length of time that the user enters the corresponding historical visit scene. The larger the metric value is, the more the user likes to enter the scene. is the weight that characterizes the historical access scenario. After the calculation is completed, the weight of each historical access scenario is sorted, and several historical access scenarios with high weight rankings are selected as preset verification scenarios to determine the preset verification scenario set.
[0072] The access permission control device provided by the present invention is described below. The access permission control device described below and the access permission control method described above can be referred to each other.
[0073] Figure 3 A schematic diagram of the structure of the access authority control device provided by the present invention, such as Figure 3 As shown, the access permission control device includes: A behavior information acquisition module 310 is used to acquire behavior information of users with common permissions; A first behavior characteristic attribute determination module 320, which is used to determine the behavior characteristic attribute corresponding to the behavior information based on the behavior information of the ordinary authority user; A second behavior characteristic attribute determination module 330, which is used to determine the behavior characteristic attribute corresponding to each historical behavior information based on the historical behavior information of the ordinary authority user in each verification scenario in the preset verification scenario set; The verification module 340 is used to verify the behavior characteristic attributes corresponding to the behavior information with the behavior characteristic attributes corresponding to each of the historical behavior information. If the verification result is successful, the ordinary authority user is determined as a substantial authority user.
[0074] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the access permission control method, which includes: obtaining the behavior information of the ordinary authority user; determining the behavior characteristic attribute corresponding to the behavior information based on the behavior information of the ordinary authority user; determining the behavior characteristic attribute corresponding to each of the historical behavior information based on the historical behavior information of the ordinary authority user in each verification scenario in the preset verification scenario set; verifying the behavior characteristic attribute corresponding to the behavior information with the behavior characteristic attribute corresponding to each of the historical behavior information, and if the verification result is successful, determining the ordinary authority user as a substantial authority user.
[0075] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.
[0076] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the access permission control method provided by the above-mentioned methods, which includes: obtaining behavior information of an ordinary permission user; determining the behavior characteristic attributes corresponding to the behavior information based on the behavior information of the ordinary permission user; determining the behavior characteristic attributes corresponding to each of the historical behavior information based on the historical behavior information of the ordinary permission user in each verification scenario in a preset verification scenario set; verifying the behavior characteristic attributes corresponding to the behavior information with the behavior characteristic attributes corresponding to each of the historical behavior information, and if the verification result is successful, determining the ordinary permission user as a substantive permission user.
[0077] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the access permission control method provided by the above-mentioned methods, the method comprising: obtaining behavior information of an ordinary permission user; determining, based on the behavior information of the ordinary permission user, a behavior characteristic attribute corresponding to the behavior information; determining, based on the historical behavior information of the ordinary permission user in each verification scenario in a preset verification scenario set, the behavior characteristic attribute corresponding to each of the historical behavior information; verifying the behavior characteristic attribute corresponding to the behavior information with the behavior characteristic attribute corresponding to each of the historical behavior information, respectively, and if the verification result is successful, determining the ordinary permission user as a substantive permission user.
[0078] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.
[0079] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for controlling access rights, characterized in that: include: Obtain behavior information of users with general permissions; Based on the behavior information of the ordinary authorized user, determining a behavior characteristic attribute corresponding to the behavior information; Based on the historical behavior information of the ordinary authorized user in each verification scenario in the preset verification scenario set, respectively determine the behavior characteristic attributes corresponding to each of the historical behavior information; The behavior characteristic attributes corresponding to the behavior information are verified with the behavior characteristic attributes corresponding to each of the historical behavior information respectively. If the verification result is successful, the ordinary authority user is determined as a substantial authority user.
2. The access authority control method according to claim 1, characterized in that: The behavior information of the ordinary authorized user is determined based on the following method: Receive login request information of a user to be identified, and obtain login behavior information of the user to be identified; the login behavior information represents behavior data of the user to be identified during the login phase; Verifying the login request information, and determining the user to be identified as a user with ordinary authority after the verification is passed; Obtaining the operation behavior information of the ordinary authorized user; The operation behavior information represents the behavior data of the ordinary authorized user in the operation phase after the verification is passed; The login behavior information and the operation behavior information are determined as behavior information of a user with ordinary authority.
3. The access authority control method according to claim 1, characterized in that: The determining, based on the behavior information of the ordinary-authority user, a behavior characteristic attribute corresponding to the behavior information includes: Based on the behavior information, determining an interaction operation sequence corresponding to the behavior information; the interaction operation sequence includes information of each interaction operation and a time corresponding to each interaction operation; the interaction operation sequence is obtained by sorting the information of each interaction operation based on a time sequence of a time corresponding to each interaction operation; Collecting the interactive operation sequence corresponding to the behavior information based on a behavior feature collection method, and determining a behavior feature attribute corresponding to the behavior information; Wherein, the behavior feature collection method includes: Determine the time interval between each interaction operation based on the time corresponding to each interaction operation; Determine the minimum value among the time intervals as the standard time difference; Based on the time intervals exceeding the preset interval threshold in each of the time intervals, the interactive operation sequence is divided into a plurality of sub-operation sequences, the standard deviation of all time intervals in each of the sub-operation sequences is calculated, and a sub-operation sequence standard deviation set is determined; The standard time difference and the sub-operation sequence standard deviation set are determined as behavior characteristic attributes.
4. The access authority control method according to claim 3, characterized in that: The behavior characteristic attribute corresponding to any of the historical behavior information is determined based on the following method: Based on the historical behavior information, determining an interactive operation sequence corresponding to the historical behavior information; The interactive operation sequence corresponding to the historical behavior information is collected based on the behavior feature collection method to determine the behavior feature attributes corresponding to the historical behavior information.
5. The access authority control method according to claim 4, characterized in that: The behavior characteristic attributes corresponding to the historical behavior information include a standard time difference and a sub-operation sequence standard deviation set corresponding to the historical behavior information; The behavior characteristic attribute corresponding to the behavior information and the behavior characteristic attribute corresponding to any of the historical behavior information are verified based on the following method: Determine a ratio between a standard time difference in a behavior characteristic attribute corresponding to the behavior information and a standard time difference in a behavior characteristic attribute corresponding to the historical behavior information, and if the ratio is within a first preset threshold interval, determine that the first verification result is verified; Determine the normalized measurement value of each standard deviation in the sub-operation sequence standard deviation set in the behavior characteristic attribute corresponding to the behavior information, and the ratio between the normalized measurement values of each standard deviation in the sub-operation sequence standard deviation set in the behavior characteristic attribute corresponding to the historical behavior information, and if the ratio is within a second preset threshold range, determine that the second verification result is verified to be passed; Based on the first verification result being verified as passed and the second verification result being verified as passed, it is determined that the behavior characteristic attribute corresponding to the behavior information and the behavior characteristic attribute corresponding to the historical behavior information are successfully verified.
6. The access authority control method according to claim 1, characterized in that: The preset verification scenario set is determined based on the following method: Determine the weight of each historical access scenario in the historical access scenario set based on the number of visits and access duration of each historical access scenario in the historical access scenario set by the general permission user; The weights of the historical access scenarios in the historical access scenario set are sorted, and a preset verification scenario set is determined based on the sorting result.
7. An access rights control device, characterized in that: include: A behavior information acquisition module is used to obtain behavior information of users with ordinary permissions; A first behavior characteristic attribute determination module, which is used to determine the behavior characteristic attribute corresponding to the behavior information based on the behavior information of the ordinary authority user; A second behavior characteristic attribute determination module, which is used to determine the behavior characteristic attribute corresponding to each historical behavior information based on the historical behavior information of the ordinary authority user in each verification scenario in the preset verification scenario set; A verification module is used to verify the behavior characteristic attributes corresponding to the behavior information with the behavior characteristic attributes corresponding to each of the historical behavior information. If the verification result is successful, the ordinary authority user is determined as a substantial authority user.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the access permission control method according to any one of claims 1 to 6 is implemented.
9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the access permission control method according to any one of claims 1 to 6 is implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the access permission control method according to any one of claims 1 to 6 is implemented.