Dynamic authorization method and device

Abstract

The invention provides a dynamic authorization method and device, and relates to the technical field of information security. The method specifically comprises the steps that the account number level of a target account number, the operation type of a target operation performed by the target account number on a transaction platform and an operation timestamp are acquired, the operation sensitivity is determined according to the operation type, and the target account number is an account number used for logging in the transaction platform by a target user; determining an operation time period corresponding to the operation timestamp according to the operation timestamp, and determining operation time sensitivity according to the operation time period; the account grade, the operation sensitivity and the operation time sensitivity are input into a target prediction model corresponding to the operation type, a model prediction result is obtained, and the account grade is used for indicating a user role corresponding to the target account; and determining a target authorization level according to the model prediction result, and determining an operation authentication mode corresponding to the target operation according to the target authorization level. The problem of low flexibility of the authorization method in the prior art is solved, and the flexibility of the authorization method is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a dynamic authorization method and device. Background Art

[0002] With the continuous development of the Internet and the increasing use of computers and networks, people are enjoying the great convenience brought by the Internet, but are also worried about the security of their private data. In addition to the need to ensure the security of members' private data, it is also necessary to ensure the security of the member's related operations.

[0003] In order to ensure the security of related operations of different members, the prior art usually sets different permissions for members of different levels to prevent members of different levels from viewing the private data of other members and different members from performing operations different from their levels. However, this method grants the same permissions to users of the same level, that is, for users of the same level, the prior art only verifies the user's relevant information, and authorizes the user after the verification, allowing the user to perform corresponding operations. However, this method grants the same authorization to multiple operations performed by the user, and cannot flexibly respond to operations with different levels of privacy.

[0004] With regard to the problem of low flexibility of authorization methods in the prior art, no effective technical solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a dynamic authorization method and device to at least solve the problem of low flexibility of the authorization method in the prior art.

[0006] According to one aspect of an embodiment of the present application, a dynamic authorization method is provided, including: obtaining the account level of a target account, the operation type and operation timestamp of a target operation performed by the target account on a trading platform, and determining the operation sensitivity according to the operation type, wherein the target account is an account used by a target user to log in to the trading platform; determining the operation time period corresponding to the operation timestamp according to the operation timestamp, and determining the operation time sensitivity according to the operation time period; inputting the account level, operation sensitivity, and operation time sensitivity into a target prediction model corresponding to the operation type to obtain a model prediction result, wherein the account level is used to indicate a user role corresponding to the target account; determining the target authorization level according to the model prediction result, and determining the operation authentication method corresponding to the target operation according to the target authorization level.

[0007] According to another aspect of an embodiment of the present application, a dynamic authorization device is also provided, including: an acquisition unit, used to acquire the account level of a target account, the operation type and operation timestamp of a target operation performed by the target account on a trading platform, and determine the operation sensitivity according to the operation type, wherein the target account is an account used by a target user to log in to the trading platform; a first determination unit, used to determine the operation time period corresponding to the operation timestamp according to the operation timestamp, and determine the operation time sensitivity according to the operation time period; an input unit, used to input the account level, operation sensitivity, and operation time sensitivity into a target prediction model corresponding to the operation type to obtain a model prediction result, wherein the account level is used to indicate the user role corresponding to the target account; a second determination unit, used to determine the target authorization level according to the model prediction result, and determine the operation authentication method corresponding to the target operation according to the target authorization level.

[0008] Optionally, the input unit includes a first acquisition subunit, used to acquire reference prediction models corresponding to multiple reference operation types, and a training sample set corresponding to each reference operation type, wherein the model type of the reference prediction model corresponding to each reference operation type is different; a training subunit, used to use multiple training sample sets to perform model training on multiple reference prediction models respectively, to obtain multiple prediction models; a second acquisition subunit, used to acquire a target prediction model corresponding to the operation type from multiple prediction models; an input subunit, used to input the account level, operation sensitivity, and operation time sensitivity into the target prediction model to obtain a model prediction result.

[0009] Optionally, the above-mentioned training subunit includes a first determination module, which is used to determine any reference prediction model among multiple reference prediction models as the current prediction model, and determine a first training sample set corresponding to the current prediction model from multiple training sample sets; a preprocessing module, which is used to perform sample preprocessing on the first training sample set to obtain a second training sample set, wherein the sample preprocessing operation is used to improve the sample data quality; a feature engineering module, which is used to perform feature engineering operations on the second training sample set to obtain a third training sample set, and use the third training sample set to iteratively train the current prediction model, and determine the current prediction model whose iterative training results meet the preset training results as the reference prediction model; a second determination module, which is used to determine any untrained reference prediction model among multiple reference prediction models except the current prediction model as the current prediction model.

[0010] Optionally, the feature engineering module includes a feature extraction submodule, which is used to perform feature extraction on the second training sample set to obtain a first sample subset, wherein the feature extraction is used to extract valid sample features from the second training sample set, and the valid sample features include a reference operation account, a reference operation type, and a reference operation timestamp; a feature combination submodule, which is used to perform feature combination on the first sample subset to obtain a second sample subset, wherein the feature combination is used to improve model performance; a feature selection submodule, which is used to perform feature selection on the second sample subset based on the correlation between the reference operation type corresponding to the second training sample set and the second sample subset to obtain a third training sample set.

[0011] Optionally, the above-mentioned second determination unit includes a first determination subunit, which is used to determine the target authorization level as a first authorization level when the model prediction result indicates that the target operation can be authorized; determine the target authorization level as a second authorization level when the model prediction result indicates that the target operation can be balanced authorized, wherein the second authorization level is lower than the first authorization level; when the model prediction result indicates that the target operation cannot be authorized, determine the target authorization level as a third authorization level, wherein the third authorization level is lower than the second authorization level.

[0012] Optionally, the above-mentioned second determination unit also includes a second determination sub-unit, which is used to determine that the operation authentication mode is a device authentication mode when the target authorization level is a first authorization level; when the target authorization level is a second authorization level, determine the operation authentication mode as a device authentication mode and a face recognition authentication mode, and the device authentication mode takes precedence over the face recognition authentication mode; when the target authorization level is a third authorization level, determine the operation authentication mode as a face recognition authentication mode and an iris authentication mode, and the face recognition authentication mode takes precedence over the iris authentication mode.

[0013] Optionally, the above-mentioned first determination unit includes: a third determination sub-unit, used to determine the first operation time sensitivity according to the operation time period; a fourth determination sub-unit, used to determine the reference operation sensitivity corresponding to the reference operation time period as the second operation time sensitivity when the reference operation sensitivity corresponding to the operation time period is included in multiple reference operation time sensitivities, and to determine the second operation time sensitivity corresponding to the operation time period according to a preset authorization rule when the reference operation sensitivity corresponding to the operation time period is not included in the multiple reference operation time sensitivities; a fifth determination sub-unit, used to determine the sum of the first operation time sensitivity and the second operation time sensitivity as the operation time sensitivity.

[0014] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the above dynamic authorization method.

[0015] According to another aspect of the embodiments of the present application, an electronic device is also provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the dynamic authorization method as described above.

[0016] Through the above dynamic authorization method, accurate authorization of different operations of the same account can be achieved, thereby improving the accuracy of the dynamic authorization method. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 is a schematic diagram of a hardware environment of an optional dynamic authorization method according to an embodiment of the present invention; Figure 2 is a flow chart of an optional dynamic authorization method according to an embodiment of the present invention; Figure 3 is a schematic structural diagram of an optional dynamic authorization device according to an embodiment of the present invention; Figure 4 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the drawings and in conjunction with the embodiments.

[0021] In order to solve the problem of low accuracy of authorization methods in the prior art, the present application embodiment provides a dynamic authorization method. As an optional implementation, the above dynamic authorization method can be applied to, but is not limited to, Figure 1 In the dynamic authorization system composed of the terminal device 102 and the server 104 shown in FIG. Figure 1 As shown, the terminal device 102 is connected to the server 104 through the network 110. The network 110 may include but is not limited to: a wired network, a wireless network. The terminal device 102 is also provided with a display 106, a processor 108 and a memory 112. The display 106 can be used to display the operation interface corresponding to the target operation and the operation information filled in by the target user when using the target account to perform the target operation, etc. The processor 108 can be used to process the operation request corresponding to the target operation, and the memory 112 can be used to store the relevant information involved in this application; the server 104 can be a single server, or a server cluster composed of multiple servers, or a cloud server. The server 104 includes a database 114 and a processing engine 116. Among them, the database 114 can be used to store the target account, account level, operation type, operation timestamp, operation sensitivity, etc., and the processing engine 116 is used to process the target account, account level, operation type, operation timestamp, operation sensitivity, etc.

[0022] According to one aspect of the embodiment of the present invention, the above-mentioned dynamic authorization system may further perform the following steps: First, the terminal device 102 executes S102 to send an operation request corresponding to the target operation to the server 104 through the network 110; then, the server 104 executes Figure 1 S104 to S110 shown, thereby completing the authorization result and operation authentication method of the target operation.

[0023] Through the above dynamic authorization method, more flexible authorization of target operations can be achieved, thereby improving the flexibility of the authorization method.

[0024] The above is only an example and is not limited in this embodiment.

[0025] As an optional implementation, please refer to Figure 2 The flowchart of the dynamic authorization method shown in FIG. The method may include the following steps: S202, obtaining an account level of a target account, an operation type and an operation timestamp of a target operation performed by the target account on the trading platform, and determining an operation sensitivity according to the operation type, wherein the target account is an account used by the target user to log in to the trading platform; S204, determining an operation time period corresponding to the operation time stamp according to the operation time stamp, and determining the operation time sensitivity according to the operation time period; S206, inputting the account level, operation sensitivity, and operation time sensitivity into a target prediction model corresponding to the operation type to obtain a model prediction result, wherein the account level is used to indicate a user role corresponding to the target account; S208, determining a target authorization level according to the model prediction result, and determining an operation authentication method corresponding to the target operation according to the target authorization level.

[0026] The target account in the above S202 can be understood as, but not limited to, the account of the target user to log in to the trading platform. The trading platform is a platform on which the target user can perform the target operation. The above operation sensitivity can be understood as, but not limited to, the weight corresponding to the operation type, or the privacy level corresponding to the operation type, etc. The above operation timestamp is the timestamp when the target user initiates the operation request corresponding to the target operation through the target account (i.e., the timestamp when the target operation is triggered). For example, when the target operation is a query operation, the operation timestamp is the timestamp when the user clicks the query. When the target operation is a payment operation, the operation timestamp is the timestamp when the user clicks the "Payment" control or the "Submit" control after entering the payment information.

[0027] Determining the operation time period corresponding to the operation timestamp according to the operation time period in the above S204 includes: obtaining multiple preset time periods, selecting a preset time period matching the operation timestamp from the multiple preset time periods, and determining the selected preset time period as the operation time period, and the preset time period matching the operation timestamp can be understood as, but not limited to, a preset time period including the operation timestamp. Different preset time periods correspond to different time sensitivities, wherein the multiple preset time periods and the multiple time sensitivities are both pre-set time periods and sensitivities corresponding to time periods. After determining the operation time period, the time sensitivity corresponding to the operation time period can be determined from the multiple time sensitivities, and the determined time sensitivity is determined as the operation time sensitivity.

[0028] The target prediction model in the above S206 can be understood, but is not limited to, as a model obtained by pre-training the reference prediction model with training samples (the following training sample set), and the model prediction result output by the target prediction model is used to indicate whether the target operation can be authorized. The above model prediction results include: indicating that the target operation can be authorized (that is, the target operation can be authorized), indicating that the target operation can be authorized in a balanced manner (that is, the ratio of authorization to non-authorization is equal. In this case, the identity of the target user corresponding to the target account can be verified, so as to determine whether authorization can be obtained based on the verification result. For example, the ID number and mobile phone number of the target user are verified. If the verification is passed, the target operation can be authorized. It should be noted that the verification at this time is different from the authentication performed by the operation authentication method); indicating that the target operation cannot be authorized (that is, the target operation cannot be authorized).

[0029] The target authorization level in the above S208 can be understood, but not limited to, as the authorization level corresponding to the information indicated by the model prediction result, and the above operation authentication method can be understood, but not limited to, as a secondary verification of the authorization, that is, in this application, it is not directly determined whether to authorize or not the target operation based on the model prediction result, but regardless of whether the model prediction result indicates that the target operation is authorized, a secondary verification of the authorization will be performed, thereby ensuring the flexibility of the authorization of the target operation while ensuring the reliability of the authorization of the target operation.

[0030] It should be noted that after determining the operation authentication method corresponding to the target operation in the above S208, the target operation can be authenticated according to the operation authentication method. If the operation authentication passes, the target account is allowed to perform the target operation on the trading platform during the operation time period (the time period corresponding to the operation timestamp) (that is, the target account is authorized to perform the target operation). If the operation authentication fails, the target account is not allowed to perform the target operation on the trading platform during the operation time period (that is, the target account is not authorized to perform the target operation).

[0031] Through the above dynamic authorization method, different operations performed by the same user can be flexibly authorized corresponding to the operations, which solves the problem of low flexibility of the authorization method in the prior art and improves the flexibility of the authorization method.

[0032] As an optional implementation, the account level, operation sensitivity, and operation time sensitivity are input into a target prediction model corresponding to the operation type to obtain a model prediction result, including: S1, obtaining reference prediction models corresponding to multiple reference operation types, and a training sample set corresponding to each reference operation type; S2, using multiple training sample sets to respectively train multiple reference prediction models to obtain multiple prediction models; S3, obtaining a target prediction model corresponding to the operation type from multiple prediction models; S4, input the account level, operation sensitivity, and operation time sensitivity into the target prediction model to obtain the model prediction result.

[0033] It should be noted that the operation in the above S1 can be but is not limited to being understood as obtaining reference prediction models corresponding to multiple reference operation types from multiple initial prediction models, wherein the model types corresponding to the multiple initial prediction models are different, and the model types of the reference prediction models corresponding to each reference operation type may be the same or different.

[0034] The operations in S1 above specifically include: obtaining multiple reference account levels corresponding to the trading platform; obtaining reference operation types of multiple reference operations corresponding to each reference account level according to the multiple reference account levels, and obtaining multiple reference operation types; determining the reference prediction model corresponding to each reference operation type according to the multiple reference operation types and multiple reference account levels (specifically including: determining any operation type among the multiple reference operation types as the current operation type, obtaining the reference prediction model corresponding to the current operation type from multiple initial prediction models according to the current operation type and the reference account level corresponding to the current operation type, and determining any reference operation type other than the current operation type among the multiple reference operation types as the current operation type), and obtaining multiple reference prediction models; determining the training sample set corresponding to each reference prediction model according to the multiple reference prediction models. Each reference prediction model corresponds to a training sample set, and the reference prediction model is trained using the training sample set corresponding to the reference prediction model, so as to obtain prediction models corresponding to each of the multiple reference operation types. The model types of the above multiple initial prediction models are different, and the multiple initial prediction models include: logistic regression model, decision tree model, random forest model and neural network model.

[0035] By selecting the target prediction model corresponding to the operation type from the prediction models trained for each reference operation type for authorization prediction in the present application, a more accurate model prediction result corresponding to the operation type and operation timestamp can be obtained.

[0036] As an optional implementation, multiple training sample sets are used to perform model training on multiple reference prediction models respectively to obtain multiple prediction models, including: S1, determining any reference prediction model among multiple reference prediction models as a current prediction model, and determining a first training sample set corresponding to the current prediction model from multiple training sample sets; S2, performing sample preprocessing on the first training sample set to obtain a second training sample set, wherein the sample preprocessing operation is used to improve the sample data quality; S3, performing feature engineering operations on the second training sample set to obtain a third training sample set, and iteratively training the current prediction model using the third training sample set, and determining the current prediction model whose iterative training results meet the preset training results as a reference prediction model; S4, determining any untrained reference prediction model other than the current prediction model among the multiple reference prediction models as the current prediction model.

[0037] It should be noted that the above S1 to S4 can be understood, but not limited to, as: determining any untrained reference prediction model as the current prediction model, and determining a first training sample set corresponding to the current prediction model from multiple training sample sets, and then performing sample preprocessing on the first training sample set to improve the sample data quality. The sample preprocessing includes sample missing value processing, data cleaning operations, data conversion operations, and data standardization operations. Among them, sample missing value processing is used to improve the integrity of sample data, specifically including sample missing value filling, sample deletion, etc., data cleaning operations are used to process abnormal samples and noise data, data conversion operations are used to digitize or encode certain data in the sample data (for example, class data, such as operation type, is one-hot encoded), and data standardization operations are used to ensure that the value ranges of different sample data are similar, so as to avoid the deviation of certain sample data on model training. Large impact.

[0038] After that, feature engineering operation is performed on the second training sample set, and the feature engineering operation is used to extract more representative sample data from the second training sample set, so as to ensure the accuracy of model training. In S3, feature engineering operation is performed on the second training sample to obtain the third training sample set, including: S3-1, feature extraction is performed on the second training sample set to obtain the first sample subset, wherein the feature extraction is used to extract valid sample features from the second training sample set, and the valid sample features include the reference operation account, the reference operation type and the reference operation timestamp; feature combination is performed on the first sample subset to obtain the second sample subset, wherein the feature combination is used to improve the model performance; according to the correlation between the reference operation type corresponding to the second training sample set and the second sample subset, feature selection is performed on the second sample subset to obtain the third training sample set. The above feature combination is used to generate new features or cross features in combination with the extracted valid sample features to improve the model performance. The above valid sample features also include the sample operation time period and sample operation time sensitivity corresponding to the reference operation timestamp, and the reference operation sensitivity corresponding to the reference operation type.

[0039] Through the above-mentioned implementation manner of the present application, the reference prediction model corresponding to each reference operation type can be trained more accurately, so as to obtain the prediction model corresponding to each reference operation type.

[0040] As an optional implementation, determining the target authorization level according to the model prediction result includes: S1, when the model prediction result indicates that the target operation is authorizable, determining the target authorization level to be the first authorization level; S2, when the model prediction result indicates that the target operation can be authorized in a balanced manner, determining the target authorization level to be a second authorization level, wherein the second authorization level is lower than the first authorization level; S3: When the model prediction result indicates that the target operation cannot be authorized, determine the target authorization level to be a third authorization level, wherein the third authorization level is lower than the second authorization level.

[0041] It should be noted that the model prediction result indicates three situations, one is the situation that the target operation can be authorized (i.e. the situation in S1 above), one is the situation that the probability of the target operation being authorized and not being authorized is equal (i.e. the situation in S2 above), and the other is the situation that the target operation cannot be authorized (i.e. the situation in S3 above), and the different situations indicated by the model prediction results correspond to different authorization levels. The authorization level corresponding to each model prediction result can be pre-set, and the first authorization level is higher than the second authorization level, and the second authorization level is higher than the third authorization level. After that, the operation authentication method corresponding to the target operation can be determined according to the specific target authorization level.

[0042] Determining the operation authentication method corresponding to the target operation according to the target authorization level includes: S4, when the target authorization level is the first authorization level, determining the operation authentication method as the device authentication method; S5, when the target authorization level is the second authorization level, determining the operation authentication method as the device authentication method and the face recognition authentication method, and the device authentication method takes precedence over the face recognition authentication method; S6, when the target authorization level is the third authorization level, determining the operation authentication method as the face recognition authentication method and the iris authentication method, and the face recognition authentication method takes precedence over the iris authentication method.

[0043] The device authentication method in the above S4 can be understood, but not limited to, as an authentication method corresponding to the device, the device is a device running the trading platform, the device is, for example, a mobile phone, and the device authentication method is, for example, a digital password unlocking method, a fingerprint unlocking method, a pattern unlocking method, and a face-swiping unlocking method of the mobile phone, etc. The above situation exists in the operation authentication method when the target authorization level is the first authorization level and the device has a device authentication method, and when the target authorization level is the first authorization level and the device does not have a corresponding device authentication method, the operation authentication method is determined to be an OTP (one-time password) authentication method (at this time, this operation authentication method is also regarded as the device authentication method described below), that is, a one-time verification code is sent to the device, and the target user enters the accurate one-time verification code within the specified time. If the input is correct, the operation authentication is successful, and the target account is allowed to perform the target operation. If the input is incorrect, the operation authentication is unsuccessful, and the target account is not allowed to perform the target operation. The above face-swiping authentication method can be understood, but not limited to, as performing face recognition on the target user corresponding to the target account. When the device authentication passes and the face recognition passes, the target account is allowed to perform the target operation. When the device authentication fails (failed) or the face recognition fails (failed), the target account is not allowed to perform the target operation. The above-mentioned iris authentication method can be understood, but is not limited to, as iris recognition of the target user corresponding to the target account (a biometric identification technology based on the iris in the eye for identity recognition. The iris is the annular part located between the through hole and the sclera, on which there are many interlaced spots, filaments, crowns, stripes and other detailed features, which do not change as a person grows, and are therefore unique). In the event that face recognition and iris authentication are successful, the target account is not allowed to perform the target operation; in the event that face recognition fails (failed) or iris authentication fails (failed), the target user is not allowed to perform the target operation.

[0044] It should be noted that when performing operation authentication according to the device authentication method, it is only necessary to perform operation authentication according to one of the device authentication methods, and there is no need to perform operation authentication for multiple device authentication methods. That is, when the device authentication methods include password unlocking method, fingerprint unlocking method, pattern unlocking method, and face recognition unlocking method, etc., it is sufficient to randomly select one device authentication method from the multiple device authentication methods for operation authentication.

[0045] Through the above-mentioned implementation mode of the present application, different operation authentication methods can be determined according to different authorization levels, so as to accurately authorize operations of different operation types of different accounts.

[0046] As an optional implementation, determining the operation time sensitivity according to the operation time period includes: S1, determining a first operation time sensitivity according to the operation time period; S2, when the multiple reference operation time sensitivities include a reference operation sensitivity corresponding to the operation time period, determining the reference operation sensitivity corresponding to the reference operation time period as a second operation time sensitivity; S3, when the multiple reference operation time sensitivities do not include the reference operation sensitivity corresponding to the operation time period, determining a second operation time sensitivity corresponding to the operation time period according to a preset authorization rule; S4: Determine the sum of the first operation time sensitivity and the second operation time sensitivity as the operation time sensitivity.

[0047] The operation in S1 above can be understood, but not limited to, as obtaining a first operation time sensitivity corresponding to the operation time period from a plurality of preset operation time sensitivities according to the operation time period, wherein the plurality of preset operation time sensitivities are pre-set time sensitivities corresponding to different time periods. That is, the first operation sensitivity above can be understood, but not limited to, as a basic sensitivity corresponding to the operation time period. The plurality of reference operation time sensitivities in S2 to S3 above can be understood, but not limited to, as a plurality of reference operation time sensitivities corresponding to the target operation corresponding to the account level of the target account, wherein each reference operation time sensitivity corresponds to a different time period for performing the target operation, the preset authorization rule is an authorization rule for performing the target operation in different pre-set time periods for the target operation, and the second operation time sensitivity corresponding to the operation time period determined according to the preset authorization rule can be understood, but not limited to, as a second operation time sensitivity determined according to the account level, the target operation and the operation time period (because when the preset authorization rule is pre-set, different authorization rules will be pre-set for different operations performed by accounts of different levels on the trading platform, so that the set sensitivity can be consistent with the account level and the corresponding operation).

[0048] Through the above-mentioned implementation mode of the present application, the accuracy of authorization of the target account to perform the target operation on the trading platform can be further improved by accurately determining the time sensitivity of the operation.

[0049] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0050] According to another aspect of the embodiment of the present invention, a dynamic authorization device for implementing the above dynamic authorization method is also provided. Figure 3 As shown, the device comprises: The acquisition unit 302 is used to acquire the account level of the target account, the operation type and operation timestamp of the target operation performed by the target account on the trading platform, and determine the operation sensitivity according to the operation type, wherein the target account is the account used by the target user to log in to the trading platform; A first determining unit 304, configured to determine an operation time period corresponding to the operation time stamp according to the operation time stamp, and determine an operation time sensitivity according to the operation time period; An input unit 306, used to input the account level, operation sensitivity, and operation time sensitivity into a target prediction model corresponding to the operation type to obtain a model prediction result, wherein the account level is used to indicate a user role corresponding to the target account; The second determining unit 308 is used to determine a target authorization level according to the model prediction result, and determine an operation authentication method corresponding to the target operation according to the target authorization level.

[0051] The specific manner in which each unit in the above device embodiment performs operations has been described in detail in the embodiment of the method, and will not be elaborated on again here.

[0052] According to another aspect of the embodiment of the present invention, an electronic device for implementing the above dynamic authorization method is also provided. The electronic device may be as follows: Figure 4 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a terminal device as an example. Figure 4 As shown, the electronic device includes: at least one processor 404; and a memory 402 in communication with the at least one processor 404; wherein the memory 402 stores a computer program that can be executed by the at least one processor 404, and the computer program is executed by the at least one processor 404, so that the at least one processor 404 performs the steps in any one of the above method embodiments. The electronic device can be located in at least one network device among multiple network devices of a computer network. The processor can be configured to execute the above dynamic authorization method through the computer program.

[0053] Alternatively, a person skilled in the art may understand that: Figure 4 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 4 The structure of the electronic device is not limited. For example, the electronic device may also include Figure 4 More or fewer components (such as network interfaces, etc.) as shown in, or with Figure 4 Different configurations shown.

[0054] Among them, the memory 402 can be used to store software programs and modules, such as program instructions / modules corresponding to the dynamic authorization method and device in the embodiments of the present invention. The processor 404 executes various functional applications and data processing by running the software programs and modules stored in the memory 402, thereby realizing the above-mentioned dynamic authorization method.

[0055] The memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 402 may further include a memory remotely arranged relative to the processor 404, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. Among them, the memory 402 may be specifically, but not limited to, used to store various data involved in the above-mentioned dynamic authorization method. As an example, the above-mentioned electronic device is used to implement the above-mentioned dynamic authorization method, and the above-mentioned memory 402 may include, but is not limited to, the acquisition unit 302, the first determination unit 304, the input unit 306, and the second determination unit 308 in the above-mentioned dynamic authorization device. In addition, it may also include, but is not limited to, other module units in the above-mentioned dynamic authorization device, which will not be repeated in this example.

[0056] Optionally, the transmission device 406 is used to receive or send data via a network. Specific examples of the network may include wired networks and wireless networks. In one example, the transmission device 406 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 406 is a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly. In addition, the electronic device also includes: a display 408, and a connection bus 410, which is used to connect the various module components in the electronic device.

[0057] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above-mentioned dynamic authorization method.

[0058] Those skilled in the art will appreciate that the implementation of all or part of the processes in the above method embodiments can be accomplished by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include processes such as those in the above method embodiments.

[0059] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A dynamic authorization method, characterized in that: include: Obtaining the account level of the target account, the operation type and operation timestamp of the target operation performed by the target account on the trading platform, and determining the operation sensitivity according to the operation type, wherein the target account is the account used by the target user to log in to the trading platform; Determine an operation time period corresponding to the operation time stamp according to the operation time stamp, and determine an operation time sensitivity according to the operation time period; Inputting the account level, the operation sensitivity, and the operation time sensitivity into a target prediction model corresponding to the operation type to obtain a model prediction result, wherein the account level is used to indicate a user role corresponding to the target account; A target authorization level is determined according to the model prediction result, and an operation authentication method corresponding to the target operation is determined according to the target authorization level.

2. The method according to claim 1, characterized in that Inputting the account level, the operation sensitivity, and the operation time sensitivity into a target prediction model corresponding to the operation type to obtain a model prediction result, including: Obtain reference prediction models corresponding to a plurality of reference operation types, and a training sample set corresponding to each reference operation type; Using a plurality of the training sample sets to respectively perform model training on a plurality of the reference prediction models to obtain a plurality of prediction models; Acquire a target prediction model corresponding to the operation type from the plurality of prediction models; The account level, the operation sensitivity, and the operation time sensitivity are input into the target prediction model to obtain a model prediction result.

3. The method according to claim 2, characterized in that Using the plurality of training sample sets to respectively perform model training on the plurality of reference prediction models, a plurality of prediction models are obtained, including: Determine any reference prediction model among the multiple reference prediction models as a current prediction model, and determine a first training sample set corresponding to the current prediction model from the multiple training sample sets; Performing sample preprocessing on the first training sample set to obtain a second training sample set, wherein the sample preprocessing operation is used to improve sample data quality; Performing feature engineering operations on the second training sample set to obtain a third training sample set, and iteratively training the current prediction model using the third training sample set, and determining the current prediction model whose iterative training results meet the preset training results as the reference prediction model; Any untrained reference prediction model among the multiple reference prediction models except the current prediction model is determined as the current prediction model.

4. The method according to claim 3, characterized in that Performing feature engineering operations on the second training samples to obtain a third training sample set includes: Performing feature extraction on the second training sample set to obtain a first sample subset, wherein the feature extraction is used to extract valid sample features from the second training sample set, and the valid sample features include a reference operation account, a reference operation type, and a reference operation timestamp; Performing feature combination on the first sample subset to obtain a second sample subset, wherein the feature combination is used to improve model performance; According to the correlation between the reference operation type corresponding to the second training sample set and the second sample subset, feature selection is performed on the second sample subset to obtain the third training sample set.

5. The method according to claim 1, characterized in that Determining a target authorization level according to the prediction results of the model includes: When the model prediction result indicates that the target operation is authorizable, determining the target authorization level to be a first authorization level; When the model prediction result indicates that the target operation can be authorized in a balanced manner, determining the target authorization level to be a second authorization level, wherein the second authorization level is lower than the first authorization level; When the model prediction result indicates that the target operation cannot be authorized, the target authorization level is determined to be a third authorization level, wherein the third authorization level is lower than the second authorization level.

6. The method according to claim 5, characterized in that Determining an operation authentication method corresponding to the target operation according to the target authorization level includes: When the target authorization level is the first authorization level, determining that the operation authentication mode is a device authentication mode; When the target authorization level is the second authorization level, determining that the operation authentication mode is a device authentication mode and a face recognition authentication mode, and the device authentication mode is prior to the face recognition authentication mode; When the target authorization level is the third authorization level, the operation authentication mode is determined to be a face recognition authentication mode and an iris recognition authentication mode, and the face recognition authentication mode is performed prior to the iris recognition authentication mode.

7. The method according to claim 1, characterized in that Determining the operation time sensitivity according to the operation time period includes: determining a first operation time sensitivity according to the operation time period; In a case where the plurality of reference operation time sensitivities include a reference operation sensitivity corresponding to the operation time period, determining the reference operation sensitivity corresponding to the reference operation time period as a second operation time sensitivity; In a case where the reference operation time sensitivity corresponding to the operation time period is not included in the multiple reference operation time sensitivities, determining a second operation time sensitivity corresponding to the operation time period according to a preset authorization rule; A sum of the first operation time sensitivity and the second operation time sensitivity is determined as the operation time sensitivity.

8. A dynamic authorization device, characterized in that: include: an acquisition unit, configured to acquire an account level of a target account, an operation type and an operation timestamp of a target operation performed by the target account on the trading platform, and determine an operation sensitivity according to the operation type, wherein the target account is an account used by a target user to log in to the trading platform; A first determining unit, configured to determine an operation time period corresponding to the operation time stamp according to the operation time stamp, and determine an operation time sensitivity according to the operation time period; An input unit, used to input the account level, the operation sensitivity, and the operation time sensitivity into a target prediction model corresponding to the operation type to obtain a model prediction result, wherein the account level is used to indicate a user role corresponding to the target account; The second determination unit is used to determine a target authorization level according to the model prediction result, and determine an operation authentication method corresponding to the target operation according to the target authorization level.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the dynamic authorization method described in any one of claims 1 to 7.

10. An electronic device comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor is configured to execute the dynamic authorization method according to any one of claims 1 to 7 through the computer program.

Images