User permission determination method and device, equipment, medium and program product

Abstract

The invention provides a user permission determination method, and relates to the field of information security, the field of artificial intelligence, the field of financial science and technology or other technical fields. The method comprises the steps that in response to a user permission determination request, N permission attributes of a user are obtained, the permission attributes comprise attributes related to user identity information and access information, and N is an integer larger than or equal to 1; obtaining access data of the user to a plurality of application services based on the N permission attributes; the N permission attributes and the access data are input into a permission determination model, and the permission determination model is a machine learning model obtained by training a user access sample in advance; and obtaining a user permission determination result of at least one application service in the plurality of application services output by the permission determination model. The invention further provides a user permission determination device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, artificial intelligence, financial technology or other technical fields, and more specifically, to a method, apparatus, device, medium and program product for determining user authority. Background Art

[0002] User permissions are closely related to the data scope that can be obtained by accessing application services. For example, you can pre-define an access control expression associated with the access interface. When a user accesses, the target access control expression corresponding to the access user identity is determined in the access control expression, thereby filtering the data that matches the target access control expression. Here, the access control expression plays a role in controlling user permissions and the scope of access data.

[0003] In the process of implementing the inventive concept of the present disclosure, the inventors discovered that the access control expressions in the prior art are predefined and lack a dynamic adjustment mechanism, and are unable to automatically adjust user permissions based on user behavior and historical access records. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for realizing dynamic adjustment of user rights determination.

[0005] According to a first aspect of the present disclosure, a user authority determination method is provided, comprising: in response to a user authority determination request, obtaining N authority attributes of a user, wherein the authority attributes include attributes related to user identity information and access information, and N is an integer greater than or equal to 1; obtaining access data of the user to multiple application services based on the N authority attributes; inputting the N authority attributes and the access data into a authority determination model, wherein the authority determination model is a machine learning model pre-trained using user access samples; and obtaining a user authority determination result for at least one application service among the multiple application services output by the authority determination model.

[0006] According to an embodiment of the present disclosure, multiple access policies corresponding one-to-one to the multiple application services are uniformly stored in a configuration center. For each application service, the method further includes: if a user permission determination result of the application service is inconsistent with the user permissions in its access policy, the configuration center adjusts the user permissions in its access policy based on the user permission determination result of the application service.

[0007] According to an embodiment of the present disclosure, the N permission attributes include at least one of the following: a role attribute, used to characterize the identity role of the user; a device attribute, used to characterize at least one of the device type and device identification used by the user; a location attribute, used to characterize the location information when the user accesses at least one of the multiple application services; a time attribute, used to characterize the time information when the user accesses at least one of the multiple application services.

[0008] According to an embodiment of the present disclosure, the multiple application services include a target application service. Before obtaining N permission attributes of the user in response to a user permission determination request, the method also includes: generating the user permission determination request in response to a first access request of the user to the target application service; wherein the N permission attributes include at least one permission attribute obtained based on a current state of the user accessing the target application service.

[0009] According to an embodiment of the present disclosure, the user authority determination result of at least one application service among the multiple application services includes the user authority determination result of the target application service, and the method further includes: obtaining M business attributes associated between the target application service and at least one remaining candidate application service among the multiple application services, where M is an integer greater than or equal to 1; and adjusting the user authority of each of the candidate application services according to the user authority involved in the M business attributes in the user authority determination result of the target application service.

[0010] According to an embodiment of the present disclosure, the multiple application services are used to provide financial business services, and the M business attributes include business attributes related to the financial business services; obtaining the M business attributes associated between the target application service and at least one remaining candidate application service among the multiple application services includes: obtaining the financial business service content of the target application service, and the financial business service content of each of the candidate application services; based on the similarity of the financial business service content between the target application service and each of the candidate application services, obtaining the associated M business attributes.

[0011] According to an embodiment of the present disclosure, the user authority determination result of at least one application service among the multiple application services includes the user authority determination result of the target application service, and the method further includes: adjusting the user authority of the user to access the target application service based on the user authority determination result of the target application service; obtaining the request data in the first access request from the target application service based on the adjusted user authority of the target application service; encrypting the sensitive information in the request data and returning it to the user, wherein the sensitive information is determined according to the adjusted user authority of the target application service.

[0012] According to an embodiment of the present disclosure, the user authority determination result of at least one application service among the multiple application services includes the user authority determination result of the target application service, and the method further includes: when the user authority determination result of the target application service indicates specific user authority, generating disguised reply data in response to the first access request; and returning the disguised reply data to the user.

[0013] According to an embodiment of the present disclosure, after returning the disguised reply data to the user, the method further includes: in response to a second access request from the user based on the disguised reply data, providing a simulated application service to interact with the user to obtain decoy access data.

[0014] Another aspect of an embodiment of the present disclosure provides a user authority determination device, including: a first acquisition module, used to obtain N authority attributes of a user in response to a user authority determination request, wherein the authority attributes include attributes related to user identity information and access information, and N is an integer greater than or equal to 1; a second acquisition module, used to obtain the user's access data to multiple application services based on the N authority attributes; a model input module, used to input the N authority attributes and the access data into a authority determination model, wherein the authority determination model is a machine learning model pre-trained using user access samples; and a model output module, used to obtain a user authority determination result of at least one application service among the multiple application services output by the authority determination model.

[0015] Another aspect of an embodiment of the present disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method described above.

[0016] Another aspect of an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes the method as described above.

[0017] Another aspect of an embodiment of the present disclosure provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0018] One or more of the above-mentioned embodiments have the following beneficial effects: on the basis of considering one or more permission attributes of the user, the access data of multiple application services are also comprehensively considered. By introducing a permission determination model based on machine learning for intelligent analysis and permission optimization, the correlation of access data between different application services can be analyzed, and user behavior patterns can be revealed from a more macro perspective. Potential security threats and abnormal behaviors can be identified. While dynamically adjusting user permissions, access to information can be controlled at a finer granularity, thereby improving data security and optimizing user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0020] Figure 1 The following schematically shows an application scenario diagram of the method for determining user authority according to an embodiment of the present disclosure;

[0021] Figure 2 A flowchart of a method for determining user authority according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 3 Schematically shows an architecture diagram including a configuration center and multiple application services according to an embodiment of the present disclosure;

[0023] Figure 4 A flowchart of a method for determining user authority according to another embodiment of the present disclosure is schematically shown;

[0024] Figure 5 A flowchart of adjusting user rights of each candidate application service according to an embodiment of the present disclosure is schematically shown;

[0025] Figure 6 A flowchart for obtaining M service attributes according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 7 A flowchart of sensitive information encryption according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 8 A flowchart of a fake reply according to an embodiment of the present disclosure is schematically shown;

[0028] Fig. 9 A structural block diagram of a user authority determination device according to an embodiment of the present disclosure is schematically shown; and

[0029] Fig.10 A block diagram of an electronic device suitable for implementing a method for determining user authority according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0030] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0031] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0032] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0033] Figure 1 The following schematically shows an application scenario diagram of the method for determining user rights according to an embodiment of the present disclosure. It should be noted that: Figure 1 What is shown are merely examples to which the embodiments of the present disclosure can be applied, so as to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0034] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0035] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to send an access request to the application service on the server side, and the server side returns the data accessed by the user according to the dynamically adjusted user rights. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0037] The server 105 may be a server that provides various services, such as a background management server that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (for example only). The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. For example, the server 105 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud computing, network services, and middleware services.

[0038] It should be noted that the user authority determination method provided in the embodiment of the present disclosure can generally be executed by at least one of a terminal device or a server. Accordingly, the user authority determination device provided in the embodiment of the present disclosure can generally be set in at least one of a terminal device or a server.

[0039] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0040] The following will be based on Figure 1 The scene described by Figure 2~Figure 8 The user authority determination method of the embodiment of the present disclosure is described in detail.

[0041] Figure 2 The flowchart of the method for determining user authority according to an embodiment of the present disclosure is schematically shown.

[0042] like Figure 2As shown, this embodiment includes:

[0043] In operation S210, in response to a user authority determination request, N authority attributes of the user are obtained, where the authority attributes include attributes related to user identity information and access information, and N is an integer greater than or equal to 1.

[0044] For example, a user authority determination request may be generated periodically, or may be generated in response to a triggering event (such as a function update, data update, data migration, user registration, etc.), or may be generated in response to a user's access request.

[0045] In some embodiments, the N permission attributes include at least one of the following:

[0046] Role attributes are used to characterize the user's identity role; the user's initial access rights can be determined based on the user's role in the organization. When a user logs in for the first time, they enter their username and password for role authentication. Verify the user's identity information (such as username and password) and confirm the user's role (such as ordinary user, advanced user, administrator, etc.). Assign preliminary access rights to the user based on his or her role.

[0047] Device attributes are used to characterize at least one of the device type and device identification used by the user; the user's identity and access rights can be further confirmed based on the device type and device identification used by the user. When a user accesses the system through a device (such as a computer, mobile phone, tablet), the system will record the device's unique identification (such as MAC address, device ID). The security of the device is then verified, for example, whether it is a device that the user often uses and whether there are abnormal behaviors (such as frequent device changes). Adjust the user's access rights based on the credibility and type of the device. For example, when using a company-registered device to access, the permissions may be higher; when using an unfamiliar device to access, the permissions may be restricted.

[0048] Location attributes are used to characterize the location information when a user accesses at least one of multiple application services; the user's access rights can be determined based on their geographic location. The user's geographic location (such as network address, satellite positioning) is obtained when the user accesses. Determine whether the user's location is legal, for example, whether it is in the company's internal network or in a specific geographical area. Dynamically adjust access rights based on the user's location. For example, when accessing in the company's internal network, the information returned may be more detailed; when accessing in an external network, the information returned may be limited.

[0049] The time attribute is used to characterize the time information when the user accesses at least one of the multiple application services. The access rights of the user are determined based on the time of access. When the user accesses the system at different times, the access time is recorded. The system determines the legitimacy of the access time, for example, whether it is within normal office hours or within a specific time period. The access rights are dynamically adjusted based on the access time. For example, when accessing during normal office hours, the information returned may be more detailed; when accessing outside office hours, the rights may be restricted.

[0050] For example, when a user accesses an application service, they first complete a multi-level identity authentication. Multi-level identity authentication is not only based on roles, but can also consider multiple factors such as device, location, time, etc. to determine the final access rights. For example, when a user accesses in the company's internal network, the information returned may be more detailed; when the user accesses in an external network, the information returned may be limited.

[0051] According to the embodiments of the present disclosure, the multi-level identity authentication mechanism can flexibly and accurately determine the user's access rights, and build a more secure and flexible access control system by introducing multiple factors such as role, device, location, time, etc. For example, multi-level authentication can effectively prevent unauthorized access and protect sensitive information from being leaked. Under the multiple protections of factors such as device authentication, location authentication, and time authentication, even if the user's username and password are leaked, it is difficult for an attacker to obtain complete access rights.

[0052] In operation S220, access data of the user to multiple application services is obtained based on the N permission attributes.

[0053] Multiple application services may include multiple applications in a one-to-one correspondence, or multiple functional services in the same application. Application services include services provided by the server, such as transfer, loan application, account inquiry, etc. For example, a user may request access to the "account inquiry" service. Access data includes access records to each application service based on one or more permission attributes, including role, access location, access time, access frequency, etc. For example, by analyzing the user's access log, the access frequency, time, and access content can be obtained.

[0054] The user can be a customer who uses the functions provided by the application service, or an employee of an organization that provides multiple application services. The access data interfaces of multiple application services can use the same or different protocols. By accessing the access data interface of each application service to obtain the access data of a specific user, data sharing of multiple application services can be achieved in the process of determining user permissions.

[0055] In an embodiment of the present disclosure, before obtaining the user's information, the user's consent or authorization may be obtained. For example, before operation S210 and operation S220, a request to obtain the user's information may be issued to the user. When the user agrees or authorizes that the user's information may be obtained, operation S210 and operation S220 are performed.

[0056] In operation S230, N permission attributes and access data are input into a permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples.

[0057] For example, a machine learning model may include a model constructed by a decision tree algorithm, a random forest algorithm, a neural network algorithm, etc. For example, a permission determination model may include a decision tree model, a random forest model, a deep neural network model, or a generative natural language model, etc.

[0058] Exemplarily, first, the bank collects user access sample data, which includes the user's historical access data to one or more application services, and extracts one or more permission attributes from the historical access data. For example, the historical access data includes user role, access location, access time, transaction history, login behavior, account balance query and other access records. Then, the user access samples are vectorized to form a feature set that can be recognized by the permission determination model. Then, during the model training process, cross entropy, mean square error, etc. can be used as loss functions to optimize model parameters and improve the generalization ability of the model. The permission determination model is deployed after verification and testing. The permission determination model can be continuously incrementally learned and updated in the future to adapt to the behavioral changes of different users and ensure the optimization and security of access policies.

[0059] In operation S240, a user authority determination result of at least one application service among the plurality of application services output by the authority determination model is obtained.

[0060] The user authority determination result indicates the data range that the user has access to. For example, if the user authority determination result indicates that the user has access to the "account query" service, the user can be allowed to query. Alternatively, if the user authority determination result indicates that the user has access to the data of one or more accounts in the "account query", the data within the data range can be returned to the user.

[0061] For example, application service A provides an interface for querying employee information, which includes information such as department, job level, corporate email, and contact number. When a user requests the interface, role authentication, device authentication, location authentication, and time authentication are further performed, and the user's access data is obtained based on at least one of multiple permission attributes. The permission attributes and access data are input into the permission determination model together, and the model is used to evaluate the credibility of the device, the legitimacy of the geographic location, and the rationality of the access time. For example, the user permission determination result indicates that the user has ordinary user permissions, and the only information returned is the department and email address; but if it is an advanced user permission, complete information will be returned.

[0062] The permission determination model can be used to comprehensively adjust user access rights. For example, when a user uses a company-registered device, accesses the company's internal network, and accesses during normal office hours, he or she may be granted the highest permissions; while when using an unfamiliar device, external network, or accessing during non-office hours, the permissions may be significantly reduced. For example, based on multi-level identity authentication, high-level user permissions can be further adjusted, if the high-level user accesses from the company network during office hours, complete information is returned; when the user accesses from the external network during non-office hours, only partial information is returned.

[0063] In the embodiments of the present disclosure, a corresponding operation entry may be provided for the user to choose to agree or reject the automated decision result. That is, before the user information is processed by the authority determination model, the user's instruction to agree or reject the processing / decision input through the corresponding operation entry may be obtained. If the user agrees to process / decide, the user information is processed by the authority determination model, that is, step S230 is executed. If the user refuses to perform the above processing, the expert decision process is entered.

[0064] According to the embodiments of the present disclosure, in addition to considering one or more permission attributes of the user, the access data of multiple application services are also comprehensively considered. By introducing a permission determination model based on machine learning for intelligent analysis and permission optimization, it is possible to analyze the correlation of access data between different application services, reveal user behavior patterns from a more macro perspective, identify potential security threats and abnormal behaviors, and dynamically adjust user permissions while controlling access to information with a finer granularity, thereby improving data security and optimizing user experience.

[0065] Figure 3 The schematic diagram shows an architecture diagram including a configuration center and multiple application services according to an embodiment of the present disclosure.

[0066] In some embodiments, multiple access policies corresponding to multiple application services are uniformly stored in a configuration center. For each application service, if the user permission determination result of the application service is inconsistent with the user permissions in its access policy, the configuration center adjusts the user permissions in its access policy based on the user permission determination result of the application service.

[0067] For example, the configuration center stores all access policies and application configurations, including user permission configurations for different roles, data desensitization and encryption policies, etc. Differentiate the data returned by user requests based on the access policies preset in the service configuration center. The configuration center can be dynamically adjusted through the management interface, and access policies can be modified and updated manually or based on model output.

[0068] like Figure 3 As shown, the configuration center can be the middleware between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the application service 1, the application service 2 and the application service 3. The configuration center can be used to process the user's access request, for example, after receiving the access request, a user authority determination request is generated, and operations S210 to S240 are performed. Alternatively, the configuration center can be used to uniformly manage the access policies of various application services, and after the access policies are modified (for example, the access rights of a certain user are modified), they are synchronized to various application services.

[0069] According to the embodiments of the present disclosure, a configuration center is utilized to provide flexible policy configuration and dynamic adjustment capabilities, so that multiple application services can quickly adapt to different scenarios and permission adjustment requirements.

[0070] Figure 4 The following schematically shows a flow chart of a method for determining user authority according to another embodiment of the present disclosure.

[0071] The plurality of application services include a target application service, and before obtaining N permission attributes of a user in response to a user permission determination request, such as Figure 4 As shown, this embodiment includes:

[0072] In operation S410 , a user authority determination request is generated in response to a first access request of a user to a target application service.

[0073] The N permission attributes include at least one permission attribute acquired according to a current state of the user accessing the target application service.

[0074] Among them, operation S210 to operation S240 are the same as the above Figure 2 The description is consistent with that of , and will not be repeated here.

[0075] For example, each access request received by the target application service can be called a first access request, that is, operations S210 to S240 are performed for each access, which can improve data security. For another example, only specific access requests received by the target application service can be called first access requests, such as access requests from specific user roles, specific IP addresses, specific time periods, etc.

[0076] Figure 5 A flowchart for adjusting user rights of each candidate application service according to an embodiment of the present disclosure is schematically shown.

[0077] The user authority determination result of at least one application service among the multiple application services includes the user authority determination result of the target application service. This embodiment is a user authority determination method of another embodiment. Figure 4 On the basis of Figure 5 As shown, it also includes:

[0078] In operation S510, M business attributes associated between a target application service and at least one remaining candidate application service among a plurality of application services are obtained, where M is an integer greater than or equal to 1.

[0079] Candidate application services include other application services associated with the target application service during the permission adjustment process. Business attributes include functional attributes related to the business handling provided by the application service. In the banking scenario, for example, payment attributes, transfer attributes, and balance query attributes are included.

[0080] In operation S520, the user rights of each candidate application service are adjusted according to the user rights of the M business attributes involved in the user rights determination result of the target application service.

[0081] According to the user permissions determined in the target application service, the permissions of the corresponding users in the candidate application service are adjusted. For example, if a user is restricted from querying the balance of a certain account in the "financial product system", then it is difficult for the user to query the balance of the account in the "online e-commerce payment system".

[0082] According to the embodiments of the present disclosure, considering business relevance, when a user accesses a target application service and thus dynamically adjusts his user rights, the user rights of other application services can be adjusted in conjunction, so that the rights in different application services remain consistent.

[0083] Figure 6 The flowchart of acquiring M service attributes according to an embodiment of the present disclosure is schematically shown.

[0084] Multiple application services are used to provide financial business services, and the M business attributes include business attributes related to financial business services; Figure 6As shown, this embodiment is one of the embodiments of operation S510, including:

[0085] In operation S610, the financial business service content of the target application service and the financial business service content of each candidate application service are acquired.

[0086] Financial business services include services related to fund management, investment, lending, etc. provided by banks or other financial institutions. For example, a bank may provide financial business services such as "deposit services", "loan services", and "payment services".

[0087] The financial business service content includes the specific content and scope of the financial services provided by each application service. For example, the function introduction or product specification of the target application service or candidate application service can be obtained to extract the financial business service content.

[0088] In operation S620, based on the similarity of the financial business service content between the target application service and each candidate application service, M associated business attributes are obtained.

[0089] In the context of financial business services, similarity indicates the degree of similarity between different financial business services in terms of business attributes, service objectives, operation processes, etc. For example, if two financial services both involve "loan services", then the content about loan services is similar.

[0090] According to the embodiments of the present disclosure, by identifying the similarities of financial business services between different application services to obtain one or more business attributes, user permissions between different application services can be more accurately and collaboratively adjusted, and financial risks can be more effectively controlled. For example, when a user operates across multiple application services, permissions can be responded to and adjusted in a timely manner to prevent potential risks.

[0091] In some embodiments, on the basis of determining the business attributes based on the calculation similarity method, the business attributes can also be determined according to the operation sequence of the financial business service. For example, when a customer makes an online payment, the order of checking the balance, comparing the payment amount, direct payment or credit loan (such as credit card) is executed. For example, before obtaining the user authority determination result, the user enters the password of a certain account incorrectly for many times. When the user is not allowed to check the balance of the account, the payment authority is restricted accordingly.

[0092] Figure 7 The flowchart of sensitive information encryption according to an embodiment of the present disclosure is schematically shown.

[0093] This embodiment is a method for determining user rights in another embodiment. Figure 4 On the basis of Figure 7 As shown, it also includes:

[0094] In operation S710 , based on a result of determining the user rights of the target application service, the user rights of the user accessing the target application service are adjusted.

[0095] In operation S720 , request data in the first access request is obtained from the target application service based on the adjusted user authority of the target application service.

[0096] In operation S730, the sensitive information in the request data is encrypted and returned to the user, wherein the sensitive information is determined according to the adjusted user authority of the target application service.

[0097] For example, before returning data, the configuration center can desensitize or encrypt sensitive information. For example, for ordinary users, partially desensitized data is returned; for advanced users, complete data is returned, and some encrypted information of the data can also be attached for decryption. Data desensitization includes but is not limited to masking sensitive information such as name, phone number, address, etc. to prevent data leakage.

[0098] Figure 8 The flowchart of the fake reply according to the embodiment of the present disclosure is schematically shown.

[0099] This embodiment is a method for determining user rights in another embodiment. Figure 4 On the basis of Figure 8 As shown, it also includes:

[0100] In operation S810, in a case where a user authority determination result of a target application service indicates a specific user authority, fake reply data is generated in response to a first access request.

[0101] In operation S820, the fake reply data is returned to the user.

[0102] For example, a user attempts to access data marked as confidential by his organization, but theoretically his employee level cannot know the confidential data, and the corresponding user rights are restricted. In this case, the user rights determination result can indicate that access is completely prohibited (i.e., specific user rights), and high-risk warning content can also be output. In this case, disguised confidential data (disguised reply data) can be generated, which prevents information leakage while avoiding suspicion or distrust that may be caused by directly rejecting employee access requests, leaving enough time for defense.

[0103] In some embodiments, after returning the disguised reply data to the user, the method further includes: in response to a second access request from the user based on the disguised reply data, providing a simulated application service to interact with the user to obtain decoy access data.

[0104] For example, an access request containing information in the fake reply data is marked as a second access request. The simulated application service includes a virtual, simulated application environment for interacting with users and collecting user behavior data without affecting the real production environment. The decoy access data includes user access behavior data obtained by interacting with users through simulated application services, which can be used to analyze user intentions and behavior patterns.

[0105] For example, a user attempts to access sensitive financial data by first providing fake financial statements (fake response data). When the user initiates further queries or operation requests based on these statements (second access request), a simulated financial system (simulated application service) is provided to collect query parameters, operation habits, user location, access time and other behavioral data (decoy access data).

[0106] According to the embodiments of the present disclosure, decoy access data can be collected to achieve in-depth analysis of user behavior without affecting the real production environment.

[0107] Based on the above user authority determination method, the present disclosure also provides a user authority determination device. Fig. 9 The device is described in detail.

[0108] Fig. 9 The structure block diagram of the user authority determination device according to an embodiment of the present disclosure is schematically shown.

[0109] like Fig. 9 As shown, the user authority determination device 900 of this embodiment includes a first acquisition module 910 , a second acquisition module 920 , a model input module 930 and a model output module 940 .

[0110] The first acquisition module 910 may perform operation S210 to acquire N permission attributes of the user in response to a user permission determination request, wherein the permission attributes include attributes related to user identity information and access information, and N is an integer greater than or equal to 1.

[0111] The second acquisition module 920 may perform operation S220 to acquire user access data to multiple application services based on N permission attributes.

[0112] The model input module 930 may perform operation S230 for inputting N permission attributes and access data into a permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples.

[0113] The model output module 940 may perform operation S240 for obtaining a user authority determination result of at least one application service among the plurality of application services output by the authority determination model.

[0114] In some embodiments, multiple access policies corresponding to multiple application services are uniformly stored in a configuration center, and the user authority determination device 900 may further include a first adjustment module. For each application service, if the user authority determination result of the application service is inconsistent with the user authority in its access policy, the first adjustment module is used to adjust the user authority in its access policy based on the user authority determination result of the application service in the configuration center.

[0115] In some embodiments, the user authority determination apparatus 900 may further include a request generation module, configured to generate a user authority determination request in response to a first access request of a user to a target application service.

[0116] In some embodiments, the user authority determination device 900 may further include a second adjustment module, which is used to obtain M business attributes associated between the target application service and at least one remaining candidate application service among multiple application services, where M is an integer greater than or equal to 1; and adjust the user authority of each candidate application service according to the user authority involving the M business attributes in the user authority determination result of the target application service.

[0117] In some embodiments, the second adjustment module is used to obtain the financial business service content of the target application service and the financial business service content of each candidate application service; based on the similarity of the financial business service content between the target application service and each candidate application service, obtain the associated M business attributes.

[0118] In some embodiments, the user authority determination device 900 may further include a third adjustment module and an encryption module, wherein the third adjustment module is used to adjust the user authority of the user to access the target application service based on the user authority determination result of the target application service; the encryption module is used to obtain the request data in the first access request from the target application service based on the adjusted user authority of the target application service; and the sensitive information in the request data is encrypting and returned to the user, wherein the sensitive information is determined according to the adjusted user authority of the target application service.

[0119] In some embodiments, the user authority determination device 900 may further include a decoy module for generating disguised reply data in response to the first access request when the user authority determination result of the target application service indicates specific user authority; and returning the disguised reply data to the user.

[0120] In some embodiments, the decoy module is further used to respond to a second access request from a user based on disguised reply data, provide simulated application services to interact with the user, and obtain decoy access data.

[0121] For the parts not mentioned in the device part, they can be understood with reference to the various embodiments of the above method. That is, the device part includes modules for executing the various steps of any one of the method embodiments described above. In addition, the implementation methods, technical problems solved, functions implemented, and technical effects achieved of each module / unit / subunit, etc. in the device part embodiment are respectively the same or similar to the implementation methods, technical problems solved, functions implemented, and technical effects achieved of each corresponding step in the method part embodiment, and will not be repeated here.

[0122] According to an embodiment of the present disclosure, any multiple modules among the first acquisition module 910, the second acquisition module 920, the model input module 930 and the model output module 940 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0123] According to an embodiment of the present disclosure, at least one of the first acquisition module 910, the second acquisition module 920, the model input module 930 and the model output module 940 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or may be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware and firmware or by an appropriate combination of any of them. Alternatively, at least one of the first acquisition module 910, the second acquisition module 920, the model input module 930 and the model output module 940 may be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function may be executed.

[0124] Fig.10 A block diagram of an electronic device suitable for implementing a method for determining user authority according to an embodiment of the present disclosure is schematically shown.

[0125] like Fig.10As shown, the electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 to a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include an onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0126] In RAM 1003, various programs and data required for the operation of electronic device 1000 are stored. Processor 1001, ROM 1002 and RAM 1003 are connected to each other via bus 1004. Processor 1001 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1002 and / or RAM 1003. It should be noted that the program can also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0127] According to an embodiment of the present disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The electronic device 1000 may further include one or more of the following components connected to the input / output (I / O) interface 1005: an input portion 1006 including a keyboard, a mouse, etc.; an output portion 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1008 including a hard disk, etc.; and a communication portion 1009 including a network interface card such as a LAN card, a modem, etc. The communication portion 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the input / output (I / O) interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage portion 1008 as needed.

[0128] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0129] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1002 and / or RAM 1003 described above and / or one or more memories other than ROM 1002 and RAM 1003.

[0130] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0131] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1001. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0132] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1009, and / or installed from the removable medium 1011. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0133] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0134] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0135] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0136] Those skilled in the art will appreciate that the features described in the various embodiments of the present disclosure may be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments of the present disclosure may be combined and / or combined in various ways without departing from the spirit and teachings of the present disclosure.

[0137] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for determining user rights, comprising: In response to the user authority determination request, obtain N authority attributes of the user, wherein the authority attributes include attributes related to user identity information and access information, and N is an integer greater than or equal to 1; Acquire access data of the user to multiple application services based on the N permission attributes; Inputting the N permission attributes and the access data into a permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples; A user authority determination result of at least one application service among the multiple application services output by the authority determination model is obtained.

2. The method according to claim 1, characterized in that Multiple access policies corresponding to the multiple application services are uniformly stored in the configuration center. For each application service, the method further includes: If the user rights determination result of the application service is inconsistent with the user rights in its access policy, the configuration center adjusts the user rights in its access policy based on the user rights determination result of the application service.

3. The method according to claim 1, characterized in that: The N permission attributes include at least one of the following: Role attributes, used to characterize the identity role of the user; Device attributes, used to characterize at least one of a device type and a device identifier used by the user; a location attribute, used to characterize location information when the user accesses at least one of the multiple application services; The time attribute is used to represent the time information when the user accesses at least one of the multiple application services.

4. The method according to any one of claims 1 to 3, characterized in that The multiple application services include a target application service. Before obtaining N permission attributes of the user in response to the user permission determination request, the method further includes: In response to a first access request by the user to the target application service, generating the user authority determination request; The N permission attributes include at least one permission attribute acquired according to a current state of the user accessing the target application service.

5. The method according to claim 4, characterized in that The user authority determination result of at least one application service among the multiple application services includes the user authority determination result of the target application service, and the method further includes: Acquire M business attributes associated between the target application service and at least one remaining candidate application service among the multiple application services, where M is an integer greater than or equal to 1; The user rights of each of the candidate application services are adjusted according to the user rights of the M business attributes involved in the user rights determination result of the target application service.

6. The method according to claim 5, characterized in that The multiple application services are used to provide financial business services, and the M business attributes include business attributes related to the financial business services; The acquiring of M business attributes associated between the target application service and at least one remaining candidate application service among the multiple application services includes: Acquire the financial business service content of the target application service and the financial business service content of each of the candidate application services; Based on the similarity of the financial business service content between the target application service and each of the candidate application services, the associated M business attributes are obtained.

7. The method according to claim 4, characterized in that The user authority determination result of at least one application service among the multiple application services includes the user authority determination result of the target application service, and the method further includes: Based on the user authority determination result of the target application service, adjusting the user authority of the user to access the target application service; Based on the adjusted user rights of the target application service, obtaining request data in the first access request from the target application service; The sensitive information in the request data is encrypted and returned to the user, wherein the sensitive information is determined according to the adjusted user authority of the target application service.

8. The method according to claim 4, characterized in that The user authority determination result of at least one application service among the multiple application services includes the user authority determination result of the target application service, and the method further includes: generating disguised reply data in response to the first access request if the user authority determination result of the target application service indicates specific user authority; The disguised reply data is returned to the user.

9. The method according to claim 8, characterized in that After returning the disguised reply data to the user, the method further includes: In response to the second access request of the user based on the disguised reply data, a simulated application service is provided to interact with the user to obtain decoy access data.

10. A user authority determination device, comprising: A first acquisition module, configured to acquire N permission attributes of a user in response to a user permission determination request, wherein the permission attributes include attributes related to user identity information and access information, and N is an integer greater than or equal to 1; A second acquisition module, configured to acquire access data of the user to multiple application services based on the N permission attributes; A model input module, used to input the N permission attributes and the access data into a permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples; The model output module is used to obtain a user authority determination result of at least one application service among the multiple application services output by the authority determination model.

11. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images