User permission determination method, apparatus, device, medium, and program product

Abstract

The present disclosure provides a user permission determination method, which relates to the field of information security, the field of artificial intelligence, the field of financial technology or other technical fields. The method comprises: in response to a user permission determination request, obtaining N permission attributes of a user, wherein the permission attributes comprise attributes related to user identity information and access information, and N is an integer greater than or equal to 1; obtaining access data of the user to a plurality of application services based on the N permission attributes; inputting the N permission attributes and the access data into a permission determination model, wherein the permission determination model is a machine learning model trained in advance using user access samples; and obtaining a user permission determination result of at least one application service in the plurality of application services output by the permission determination model. The present disclosure also provides a user permission determination apparatus, device, storage medium and program product.

Description

Technical Field

[0001] This disclosure relates to the fields of information security, artificial intelligence, fintech, or other technical fields, and more specifically, to a method, apparatus, device, medium, and program product for determining user permissions. Background Technology

[0002] User permissions are closely related to the range of data they can access through application services. For example, access control expressions can be predefined and associated with access interfaces. When a user accesses an application, the target access control expression corresponding to the user's identity is determined from the access control expression, thereby filtering data that matches the target access control expression. Here, the access control expression plays a role in controlling user permissions and the range of data accessed.

[0003] In the process of realizing the inventive concept disclosed herein, the inventors discovered that the access control expressions of the prior art are predefined and lack a dynamic adjustment mechanism, making it impossible to automatically adjust user permissions based on user behavior and historical access records. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a method, apparatus, device, medium and program product for dynamically adjusting user rights determination.

[0005] According to a first aspect of this disclosure, a user permission determination method is provided, comprising: in response to a user permission determination request, obtaining N permission attributes of a user, wherein the permission attributes include attributes relating to user identity information and access information, and N is an integer greater than or equal to 1; obtaining access data of the user to multiple application services based on the N permission attributes; inputting the N permission attributes and the access data into a permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples; and obtaining a user permission determination result for at least one of the multiple application services output by the permission determination model.

[0006] According to embodiments of this disclosure, multiple access policies corresponding one-to-one with the multiple application services are uniformly stored in a configuration center. For each application service, the method further includes: if the user permission determination result of the application service is inconsistent with the user permissions in its access policy, adjusting the user permissions in its access policy in the configuration center based on the user permission determination result of the application service.

[0007] According to embodiments of this disclosure, the N permission attributes include at least one of the following: a role attribute, used to characterize the user's identity role; a device attribute, used to characterize at least one of the device type and device identifier used by the user; a location attribute, used to characterize the location information of the user when accessing at least one of the plurality of application services; and a time attribute, used to characterize the time information when the user accesses at least one of the plurality of application services.

[0008] According to an embodiment of this disclosure, the plurality of application services includes a target application service. Before obtaining N permission attributes of the user in response to a user permission determination request, the method further includes: generating the user permission determination request in response to a first access request of the user to the target application service; wherein the N permission attributes include at least one permission attribute obtained based on the current state of the user's access to the target application service.

[0009] According to embodiments of this disclosure, the user permission determination result of at least one application service among the plurality of application services includes the user permission determination result of the target application service. The method further includes: obtaining M business attributes associated between the target application service and at least one other candidate application service among the plurality of application services, where M is an integer greater than or equal to 1; and adjusting the user permissions of each candidate application service according to the user permissions involving the M business attributes in the user permission determination result of the target application service.

[0010] According to embodiments of this disclosure, the plurality of application services are used to provide financial business services, and the M business attributes include business attributes related to the financial business services; obtaining the M business attributes associated with the target application service and at least one other candidate application service among the plurality of application services includes: obtaining the financial business service content of the target application service and the financial business service content of each candidate application service; and obtaining the associated M business attributes based on the similarity of the financial business service content between the target application service and each candidate application service.

[0011] According to embodiments of this disclosure, the user permission determination result of at least one of the plurality of application services includes the user permission determination result of the target application service. The method further includes: adjusting the user permission of the user accessing the target application service based on the user permission determination result of the target application service; obtaining request data from the first access request from the target application service based on the adjusted user permission of the target application service; encrypting sensitive information in the request data and returning it to the user, wherein the sensitive information is determined according to the adjusted user permission of the target application service.

[0012] According to an embodiment of this disclosure, the user permission determination result of at least one of the plurality of application services includes the user permission determination result of the target application service, and the method further includes: generating fake response data in response to the first access request when the user permission determination result of the target application service indicates a specific user permission; and returning the fake response data to the user.

[0013] According to an embodiment of this disclosure, after returning the fake response data to the user, the method further includes: in response to a second access request from the user based on the fake response data, providing a simulated application service to interact with the user and obtaining decoy access data.

[0014] Another aspect of this disclosure provides a user permission determination apparatus, comprising: a first acquisition module, configured to acquire N permission attributes of a user in response to a user permission determination request, wherein the permission attributes include attributes relating to user identity information and access information, and N is an integer greater than or equal to 1; a second acquisition module, configured to acquire access data of the user to multiple application services based on the N permission attributes; a model input module, configured to input the N permission attributes and the access data into a permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples; and a model output module, configured to obtain the user permission determination result of at least one application service among the multiple application services output by the permission determination model.

[0015] Another aspect of this disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the method as described above.

[0016] Another aspect of this disclosure provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, causes the processor to perform the method described above.

[0017] Another aspect of this disclosure provides a computer program product including a computer program that, when executed by a processor, implements the method described above.

[0018] The above one or more embodiments have the following beneficial effects: Based on considering one or more user permission attributes, and also comprehensively considering access data from multiple application services, by introducing a machine learning-based permission determination model for intelligent analysis and permission optimization, it is possible to analyze the correlation of access data between different application services, reveal user behavior patterns from a more macro perspective, identify potential security threats and abnormal behaviors, and while dynamically adjusting user permissions, control information access with more granular control, improve data security, and optimize user experience. Attached Figure Description

[0019] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 This diagram illustrates an application scenario of the user permission determination method according to an embodiment of the present disclosure.

[0021] Figure 2 A flowchart illustrating a user permission determination method according to an embodiment of the present disclosure is shown schematically.

[0022] Figure 3 This schematically illustrates an architecture diagram including a configuration center and multiple application services according to an embodiment of the present disclosure;

[0023] Figure 4 A flowchart illustrating a user rights determination method according to another embodiment of this disclosure is shown schematically;

[0024] Figure 5 A flowchart illustrating the adjustment of user permissions for each candidate application service according to an embodiment of this disclosure is shown schematically.

[0025] Figure 6 A flowchart illustrating the acquisition of M service attributes according to an embodiment of the present disclosure is shown schematically.

[0026] Figure 7 A flowchart illustrating the encryption of sensitive information according to embodiments of this disclosure is shown schematically.

[0027] Figure 8 A flowchart illustrating a spoofed response according to an embodiment of this disclosure is shown schematically;

[0028] Figure 9 This schematically illustrates a structural block diagram of a user rights determination device according to an embodiment of the present disclosure; and

[0029] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing a user rights determination method according to an embodiment of the present disclosure. Detailed Implementation

[0030] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0031] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0032] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this disclosure all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0033] Figure 1 The diagram illustrates an application scenario of a user permission determination method according to an embodiment of this disclosure. It should be noted that... Figure 1 The examples shown are merely examples to illustrate the application of the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure. However, they do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments, or scenarios.

[0034] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0035] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to send access requests to the application services on the server. The server returns the accessed data to the user based on dynamically adjusted user permissions. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0037] Server 105 can be a server providing various services, such as a backend management server supporting websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. For example, server 105 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud computing, network services, and middleware services.

[0038] It should be noted that the user permission determination method provided in the embodiments of this disclosure can generally be executed by at least one of the terminal device or the server. Accordingly, the user permission determination device provided in the embodiments of this disclosure can generally be set in at least one of the terminal device or the server.

[0039] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0040] The following will be based on Figure 1 The described scene, through Figures 2-8 The user permission determination method according to the embodiments of this disclosure will be described in detail.

[0041] Figure 2 A flowchart illustrating a user rights determination method according to an embodiment of the present disclosure is shown schematically.

[0042] like Figure 2As shown, this embodiment includes:

[0043] In operation S210, in response to the user permission determination request, N permission attributes of the user are obtained, where the permission attributes include attributes involving user identity information and access information, and N is an integer greater than or equal to 1.

[0044] For example, user permission confirmation requests can be generated periodically, or in response to specific events (such as feature updates, data updates, data migrations, user registrations, etc.), or in response to user access requests.

[0045] In some embodiments, the N permission attributes include at least one of the following:

[0046] Role attributes are used to characterize a user's role within the organization; initial access permissions can be determined based on the user's role. Upon first login, users authenticate their role by entering their username and password. The system verifies the user's identity information (username, password) and confirms their role (e.g., regular user, senior user, administrator, etc.). Based on the user's role, initial access permissions are assigned.

[0047] Device attributes are used to characterize at least one of the following: device type and device identifier. The user's identity and access permissions can be further confirmed based on the device type and device identifier. When a user accesses the system through a device (such as a computer, mobile phone, or tablet), the system records the device's unique identifier (such as MAC address or device ID). The system then verifies the device's security, for example, whether it is a frequently used device or whether there is any abnormal behavior (such as frequent device changes). User access permissions are adjusted based on the device's trustworthiness and type. For example, access may be granted higher privileges when using a company-registered device, while access may be restricted when using an unfamiliar device.

[0048] Location attributes characterize a user's location when accessing at least one of multiple application services; access permissions can be determined based on the user's geographic location. The system retrieves the user's geographic location (e.g., network address, satellite positioning) upon access. It then determines the legitimacy of the user's location, such as whether they are on the company's internal network or in a specific geographical area. Access permissions are dynamically adjusted based on the user's location. For example, access within the company's internal network may return more detailed information, while access from an external network may return more limited information.

[0049] The time attribute is used to represent the time information when a user accesses at least one of multiple application services. Access permissions are determined based on the time of user access. Access times are recorded when a user accesses the system at different times. The system judges the legality of the access time, for example, whether it falls within normal office hours or a specific time period. Access permissions are dynamically adjusted based on the access time. For example, access during normal office hours may return more detailed information; access outside of office hours may result in restricted permissions.

[0050] For example, when a user accesses an application service, they first complete multi-layered authentication. Multi-layered authentication is not only based on roles, but can also consider factors such as device, location, and time to determine the final access permissions. For instance, when a user accesses the service within a company's internal network, the returned information may be more detailed; while when a user accesses the service from an external network, the returned information may be more restrictive.

[0051] According to embodiments of this disclosure, a multi-layered authentication mechanism can flexibly and accurately determine user access permissions. By introducing multiple factors such as roles, devices, locations, and times, a more secure and flexible access control system can be constructed. For example, multi-layered authentication can effectively prevent unauthorized access and protect sensitive information from being leaked. With multiple safeguards such as device authentication, location authentication, and time authentication, even if a user's username and password are leaked, attackers will find it difficult to obtain complete access permissions.

[0052] In operation S220, user access data for multiple application services is obtained based on N permission attributes.

[0053] Multiple application services can include multiple applications that correspond one-to-one, or multiple functional services within the same application. Application services include services provided by the server, such as money transfers, loan applications, and account inquiries. For example, a user might request access to the "account inquiry" service. Access data includes access records for each application service based on one or more permission attributes, including role, access location, access time, and access frequency. For example, by analyzing user access logs, access frequency, time, and content can be obtained.

[0054] Users can be customers who utilize the functionality provided by the application services, or employees within an organization that provides multiple application services. The access data interfaces of multiple application services can use the same or different protocols. By accessing the access data interface of each application service, access data for a specific user can be obtained, enabling data sharing among multiple application services during the user permission determination process.

[0055] In embodiments of this disclosure, user consent or authorization may be obtained before acquiring user information. For example, a request to acquire user information may be sent to the user before operations S210 and S220. Operations S210 and S220 are performed only if the user consents or authorizes the acquisition of user information.

[0056] In operation S230, N permission attributes and access data are input into the permission determination model, where the permission determination model is a machine learning model pre-trained using user access samples.

[0057] For example, machine learning models can include models built using decision tree algorithms, random forest algorithms, neural network algorithms, etc. For instance, permission determination models can include decision tree models, random forest models, deep neural network models, or generative natural language models.

[0058] For example, firstly, the bank collects user access sample data, including historical access data for one or more application services. One or more permission attributes are extracted from this historical access data, such as user role, access location, access time, transaction history, login behavior, account balance inquiry, and other access records. Then, the user access samples are vectorized to form a feature set that the permission determination model can recognize. During model training, cross-entropy, mean squared error, etc., can be used as loss functions to optimize model parameters and improve the model's generalization ability. After validation and testing, the permission determination model is deployed. The permission determination model can then be continuously incrementally learned and updated to adapt to changes in different user behaviors, ensuring the optimization and security of access policies.

[0059] In operation S240, the user permission determination result of at least one application service among multiple application services output by the permission determination model is obtained.

[0060] The user permission determination result indicates the scope of data the user is authorized to access. For example, if the user permission determination result indicates that the user has permission to access the "Account Inquiry" service, the user can be allowed to perform the inquiry. Alternatively, if the user permission determination result indicates that the user has permission to access data for one or more accounts in the "Account Inquiry" service, the data within that scope can be returned to the user.

[0061] For example, application service A provides an interface for querying employee information, including department, job level, corporate email, and contact number. When a user requests this interface, further role authentication, device authentication, location authentication, and time authentication are performed. Access data for the user is obtained based on at least one of several permission attributes. These permission attributes and access data are then input into a permission determination model, which evaluates the trustworthiness of the device, the legitimacy of the geographical location, and the reasonableness of the access time. For instance, if the user's permission determination result indicates that the user has ordinary user permissions, only the department and email address will be returned; however, if the user has advanced user permissions, complete information will be returned.

[0062] The permission determination model allows for comprehensive adjustment of user access permissions. For example, a user might be granted the highest level of access when using a company-registered device, accessing the company intranet, or during normal office hours; while access might be significantly reduced when using an unfamiliar device, accessing an external network, or accessing outside of office hours. For instance, based on multi-layered authentication, advanced user permissions can be further adjusted: if a high-level user accesses the company network during office hours, complete information is returned; but if the user accesses the external network outside of office hours, only partial information is returned.

[0063] In the embodiments of this disclosure, a corresponding operation entry point can be provided to the user, allowing the user to choose to agree to or reject the automated decision-making result. That is, before processing the user information using the permission determination model, the user's instruction to agree to or reject the processing / decision can be obtained through the corresponding operation entry point. If the user agrees to the processing / decision, the user information is processed using the permission determination model, i.e., step S230 is executed. If the user refuses to perform the above processing, the expert decision-making process is initiated.

[0064] According to embodiments of this disclosure, in addition to considering one or more user permission attributes, access data from multiple application services are also comprehensively considered. By introducing a machine learning-based permission determination model for intelligent analysis and permission optimization, the correlation of access data between different application services can be analyzed, revealing user behavior patterns from a more macro perspective. Potential security threats and abnormal behaviors can be identified, and while dynamically adjusting user permissions, information access can be controlled with more granularity, improving data security and optimizing user experience.

[0065] Figure 3 An architectural diagram illustrating an embodiment of the present disclosure, comprising a configuration center and multiple application services, is shown.

[0066] In some embodiments, multiple access policies corresponding to multiple application services are uniformly stored in the configuration center. For each application service, if the user permission determination result of the application service is inconsistent with the user permission in its access policy, the user permission in its access policy is adjusted in the configuration center based on the user permission determination result of the application service.

[0067] For example, the configuration center stores all access policies and application configurations, including user permission configurations for different roles, data anonymization, and encryption policies. Based on the pre-defined access policies in the service configuration center, the data returned for user requests is processed differently. The configuration center can be dynamically adjusted through a management interface, and access policies can be modified and updated manually or based on model outputs.

[0068] like Figure 3 As shown, the configuration center can be middleware between the first terminal device 101, the second terminal device 102, the third terminal device 103, and application services 1, 2, and 3. The configuration center can be used to process user access requests; for example, upon receiving an access request, it can generate a user permission confirmation request and execute operations S210 to S240. Alternatively, the configuration center can be used to uniformly manage the access policies of each application service, and synchronize any changes to the access policies (e.g., modifying a user's access permissions) to all application services.

[0069] According to embodiments of this disclosure, the configuration center provides flexible policy configuration and dynamic adjustment capabilities, enabling multiple application services to quickly adapt to different scenarios and permission adjustment needs.

[0070] Figure 4 A flowchart illustrating a user rights determination method according to another embodiment of this disclosure is shown.

[0071] Multiple application services, including the target application service, before obtaining the user's N permission attributes in response to a user permission confirmation request, such as... Figure 4 As shown, this embodiment includes:

[0072] When operating S410, in response to the user's first access request to the target application service, a user permission confirmation request is generated.

[0073] Among them, the N permission attributes include at least one permission attribute obtained based on the current state of the user accessing the target application service.

[0074] Among them, operations S210 to S240 are the same as those described above. Figure 2 The description is consistent with that, so I will not repeat it here.

[0075] For example, each access request received by the target application service can be called a first access request, meaning that operations S210 to S240 will be executed for each access, which can improve data security. Alternatively, only specific access requests received by the target application service can be called first access requests, such as access requests from specific user roles, specific IPs, or specific time periods.

[0076] Figure 5 A flowchart illustrating the adjustment of user permissions for each candidate application service according to an embodiment of this disclosure is shown.

[0077] The user permission determination result of at least one of the multiple application services includes the user permission determination result of the target application service. This embodiment is another embodiment of the user permission determination method. Figure 4 On the basis of, such as Figure 5 As shown, it also includes:

[0078] In operation S510, M business attributes associated with the target application service and at least one other candidate application service among multiple application services are obtained, where M is an integer greater than or equal to 1.

[0079] Candidate application services include other application services associated with the target application service during the permission adjustment process. Business attributes include functional attributes related to the business transactions provided by the application service. In a banking scenario, these might include payment attributes, transfer attributes, and balance inquiry attributes.

[0080] In S520, based on the user permissions of M business attributes involved in the user permission determination results of the target application service, the user permissions of each candidate application service are adjusted.

[0081] Based on the user permissions defined in the target application service, adjust the permissions of the corresponding users in the candidate application services. For example, if a user is restricted from checking the balance of a certain account in the "Financial Product System," then the same user will also have difficulty checking the balance of that account in the "Online E-commerce Payment System."

[0082] According to embodiments of this disclosure, considering business relevance, when a user's access to a target application service leads to a dynamic adjustment of their user permissions, the user permissions of other application services can be adjusted in conjunction with this adjustment, so that permissions remain consistent across different application services.

[0083] Figure 6 A flowchart illustrating the acquisition of M service attributes according to an embodiment of the present disclosure is shown.

[0084] Multiple application services are used to provide financial business services, and M business attributes include business attributes related to financial business services; such as Figure 6As shown, this embodiment is one example of operating S510, including:

[0085] In operation S610, the financial business service content of the target application service and the financial business service content of each candidate application service are obtained.

[0086] Financial services include services provided by banks or other financial institutions related to fund management, investment, and lending. For example, banks may provide financial services such as "deposit services," "loan services," and "payment services."

[0087] Financial service content includes the specific details and scope of the financial services offered by each application service. For example, you can obtain a functional overview or product description of the target or candidate application service to extract the financial service content.

[0088] In operation S620, based on the similarity of financial business service content between the target application service and each candidate application service, M related business attributes are obtained.

[0089] In the context of financial services, similarity indicates the degree of similarity between different financial services in terms of business attributes, service objectives, and operational processes. For example, if two financial services both involve "loan services," then the content related to loan services is similar.

[0090] According to embodiments of this disclosure, by identifying the similarity of financial business services among different application services to obtain one or more business attributes, user permissions among different application services can be adjusted more accurately and more effectively to control financial risks. For example, when a user operates across multiple application services, permissions can be responded to and adjusted in a timely manner to prevent potential risks.

[0091] In some embodiments, in addition to determining business attributes based on computational similarity, business attributes can also be determined according to the operational sequence of financial services. For example, when a customer makes an online payment, the process is executed in the order of checking the balance, comparing the payment amount, and direct payment or credit loan (such as a credit card). For instance, if a user repeatedly enters the wrong password for an account before obtaining the user's permission determination result, and the user is not allowed to check the balance of that account, then the payment permission is restricted accordingly.

[0092] Figure 7 A flowchart illustrating the encryption of sensitive information according to an embodiment of this disclosure is shown schematically.

[0093] This embodiment is another example of a user permission determination method. Figure 4 On the basis of, such as Figure 7 As shown, it also includes:

[0094] When operating S710, adjust the user permissions for accessing the target application service based on the user permission determination results of the target application service.

[0095] When operating S720, based on the adjusted user permissions of the target application service, the request data in the first access request is obtained from the target application service.

[0096] When operating S730, sensitive information in the requested data is encrypted and returned to the user. The sensitive information is determined based on the user permissions of the adjusted target application service.

[0097] For example, before returning data, the configuration center can anonymize or encrypt sensitive information. For instance, it might return partially anonymized data to regular users, while returning complete data to advanced users, possibly along with some encrypted information for decryption. Data anonymization includes, but is not limited to, masking sensitive information such as names, phone numbers, and addresses to prevent data leakage.

[0098] Figure 8 A flowchart illustrating a spoofed response according to an embodiment of this disclosure is shown schematically.

[0099] This embodiment is another example of a user permission determination method. Figure 4 On the basis of, such as Figure 8 As shown, it also includes:

[0100] When operating S810, if the user permission determination result of the target application service indicates specific user permissions, a fake response data is generated in response to the first access request.

[0101] When operating the S820, fake response data is returned to the user.

[0102] For example, a user attempts to access data within their organization that has been marked as confidential, data that, theoretically, should not be accessible to their employee level. In this case, the user's access permissions are restricted. The result of the user permission assessment can be a complete denial of access (i.e., specific user permissions), or a high-risk warning can be output. Alternatively, disguised confidential data (disguised response data) can be generated to prevent information leakage while avoiding the suspicion or distrust that might arise from directly rejecting the employee's access request, allowing sufficient time for defense.

[0103] In some embodiments, after returning the fake response data to the user, the method further includes: in response to a second access request from the user based on the fake response data, providing a simulated application service to interact with the user and obtaining decoy access data.

[0104] For example, an access request containing information from a spoofed response is marked as a second access request. Simulated application services include virtual, simulated application environments used to interact with users and collect user behavioral data without affecting the real production environment. Decoy access data includes user access behavior data obtained through interactions with users via simulated application services, which can be used to analyze user intent and behavioral patterns.

[0105] For example, when a user attempts to access sensitive financial data, a fake financial statement is first provided (fake response data). When the user initiates further queries or operation requests based on these statements (secondary access request), a simulated financial system (simulated application service) is provided to collect behavioral data such as query parameters, operation habits, user location, and access time (bait access data).

[0106] According to embodiments of this disclosure, it is possible to collect decoy access data to achieve in-depth analysis of user behavior without affecting the real production environment.

[0107] Based on the above-described user permission determination method, this disclosure also provides a user permission determination device. The following will be combined with... Figure 9 The device is described in detail.

[0108] Figure 9 A schematic block diagram of a user rights determination device according to an embodiment of the present disclosure is shown.

[0109] like Figure 9 As shown, the user permission determination device 900 in this embodiment includes a first acquisition module 910, a second acquisition module 920, a model input module 930, and a model output module 940.

[0110] The first acquisition module 910 can perform operation S210, which is used to obtain N permission attributes of the user in response to the user permission determination request. The permission attributes include attributes involving user identity information and access information, and N is an integer greater than or equal to 1.

[0111] The second acquisition module 920 can perform operation S220, which is used to acquire user access data for multiple application services based on N permission attributes.

[0112] The model input module 930 can perform operation S230 to input N permission attributes and access data into the permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples.

[0113] The model output module 940 can perform operation S240 to obtain the user permission determination result of at least one application service among multiple application services output by the permission determination model.

[0114] In some embodiments, multiple access policies corresponding one-to-one with multiple application services are uniformly stored in a configuration center, and the user permission determination device 900 may further include a first adjustment module. For each application service, if the user permission determination result of the application service is inconsistent with the user permissions in its access policy, the first adjustment module is used to adjust the user permissions in its access policy in the configuration center based on the user permission determination result of the application service.

[0115] In some embodiments, the user permission determination device 900 may further include a request generation module for generating a user permission determination request in response to a user's first access request to a target application service.

[0116] In some embodiments, the user permission determination device 900 may further include a second adjustment module, configured to obtain M business attributes associated between the target application service and at least one other candidate application service among a plurality of application services, where M is an integer greater than or equal to 1; and adjust the user permissions of each candidate application service according to the user permissions involving the M business attributes in the user permission determination result of the target application service.

[0117] In some embodiments, the second adjustment module is used to obtain the financial business service content of the target application service and the financial business service content of each candidate application service; and to obtain M associated business attributes based on the similarity of the financial business service content between the target application service and each candidate application service.

[0118] In some embodiments, the user permission determination device 900 may further include a third adjustment module and an encryption module. The third adjustment module is used to adjust the user permission of the user accessing the target application service based on the user permission determination result of the target application service. The encryption module is used to obtain the request data in the first access request from the target application service based on the adjusted user permission of the target application service. The sensitive information in the request data is encrypted and returned to the user, wherein the sensitive information is determined according to the adjusted user permission of the target application service.

[0119] In some embodiments, the user permission determination device 900 may further include a decoy module, which is used to generate fake response data in response to a first access request when the user permission determination result of the target application service indicates a specific user permission; and return the fake response data to the user.

[0120] In some embodiments, the decoy module is also configured to respond to a second access request from a user based on spoofed response data, provide simulated application services to interact with the user, and obtain decoy access data.

[0121] For any parts not mentioned in the apparatus section, please refer to the various embodiments of the above method for understanding. That is, the apparatus section includes modules for performing each step of any of the method embodiments described above. Furthermore, the implementation methods, technical problems solved, functions achieved, and technical effects of each module / unit / subunit in the apparatus section embodiments are the same as or similar to the implementation methods, technical problems solved, functions achieved, and technical effects of the corresponding steps in the method section embodiments, and will not be repeated here.

[0122] According to embodiments of this disclosure, any plurality of modules among the first acquisition module 910, the second acquisition module 920, the model input module 930, and the model output module 940 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module.

[0123] According to embodiments of this disclosure, at least one of the first acquisition module 910, the second acquisition module 920, the model input module 930, and the model output module 940 can be at least partially implemented as hardware circuits, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or any other reasonable means of integrating or packaging circuits, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the first acquisition module 910, the second acquisition module 920, the model input module 930, and the model output module 940 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0124] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing a user rights determination method according to an embodiment of the present disclosure.

[0125] like Figure 10As shown, an electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0126] RAM 1003 stores various programs and data required for the operation of electronic device 1000. Processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Processor 1001 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1002 and / or RAM 1003. It should be noted that programs may also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in one or more memories.

[0127] According to embodiments of this disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to a bus 1004. The electronic device 1000 may also include one or more of the following components connected to the input / output (I / O) interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the input / output (I / O) interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1010 as needed so that computer programs read from it can be installed into the storage section 1008 as needed.

[0128] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0129] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1002 and / or RAM 1003 and / or one or more memories other than ROM 1002 and RAM 1003 described above.

[0130] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0131] When the computer program is executed by the processor 1001, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0132] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0133] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by processor 1001, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0134] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0135] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0136] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure.

[0137] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for determining user permissions, comprising: In response to a user permission determination request, obtain N permission attributes of the user, wherein the permission attributes include attributes related to user identity information and access information, and N is an integer greater than or equal to 1; Based on the N permission attributes, the user's access data to multiple application services is obtained, and the access data of the multiple application services is shared during the user permission determination process. The N permission attributes and the access data are input into the permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples, the user access samples are obtained based on the user's historical access data to one or more application services, and the multiple application services are used to provide financial business services. Obtain the user permission determination result of at least one application service among the multiple application services output by the permission determination model; Based on the similarity of financial business service content between the target application service and each candidate application service, M associated business attributes are obtained; wherein, the M business attributes include business attributes related to the financial business service, and the similarity indicates the degree of similarity between different financial business services in at least one aspect of business attributes, service objectives, and operation processes, and the candidate application services include other application services associated with the target application service during the permission adjustment process; Based on the user permissions determination results involving M business attributes of the target application service, adjust the user permissions of each candidate application service, where M is an integer greater than or equal to 1.

2. The method according to claim 1, characterized in that, Multiple access policies corresponding one-to-one with the multiple application services are uniformly stored in the configuration center. For each application service, the method further includes: If the user permission determination result of the application service is inconsistent with the user permissions in its access policy, the configuration center adjusts the user permissions in its access policy based on the user permission determination result of the application service.

3. The method according to claim 1, characterized in that, The N permission attributes include at least one of the following: Role attributes are used to characterize the user's identity role; Device attributes, used to characterize at least one of the device type and device identifier used by the user; Location attribute, used to characterize the location information of the user when the user accesses at least one of the plurality of application services; The time attribute is used to characterize the time information when the user accesses at least one of the multiple application services.

4. The method according to any one of claims 1 to 3, characterized in that, The plurality of application services include a target application service. Before obtaining the user's N permission attributes in response to a user permission determination request, the method further includes: In response to the user's first access request to the target application service, the user permission determination request is generated; The N permission attributes include at least one permission attribute obtained based on the current state of the user's access to the target application service.

5. The method according to claim 4, characterized in that, The user permission determination result of at least one of the multiple application services includes the user permission determination result of the target application service, and the method further includes: Obtain M business attributes associated with the target application service and at least one other candidate application service among the plurality of application services, including: obtaining the financial business service content of the target application service, and the financial business service content of each of the candidate application services.

6. The method according to claim 4, characterized in that, The user permission determination result of at least one of the multiple application services includes the user permission determination result of the target application service, and the method further includes: Based on the user permission determination result of the target application service, adjust the user's access permissions to the target application service; Based on the adjusted user permissions of the target application service, obtain the request data from the first access request from the target application service; Sensitive information in the requested data is encrypted and returned to the user, wherein the sensitive information is determined based on the adjusted user permissions of the target application service.

7. The method according to claim 4, characterized in that, The user permission determination result of at least one of the multiple application services includes the user permission determination result of the target application service, and the method further includes: If the user permission determination result of the target application service indicates a specific user permission, a fake response data is generated in response to the first access request, wherein the specific user permission is to restrict user access; The fake response data is returned to the user.

8. The method according to claim 7, characterized in that, After returning the fake response data to the user, the method further includes: In response to the user's second access request based on the fake reply data, a simulated application service is provided to interact with the user and obtain decoy access data.

9. A user permission determination device, comprising: The first acquisition module is used to acquire N permission attributes of the user in response to the user permission determination request, wherein the permission attributes include attributes related to user identity information and access information, and N is an integer greater than or equal to 1; The second acquisition module is used to acquire the user's access data to multiple application services based on the N permission attributes, and the access data of the multiple application services is shared during the user permission determination process. The model input module is used to input the N permission attributes and the access data into the permission determination model, wherein the permission determination model is a machine learning model pre-trained using user access samples, the user access samples are obtained based on the user's historical access data to one or more application services, and the multiple application services are used to provide financial business services. The model output module is used to obtain the user permission determination result of at least one application service among the multiple application services output by the permission determination model; The second adjustment module is used to obtain M associated business attributes based on the similarity of financial business service content between the target application service and each candidate application service; wherein, the M business attributes include business attributes related to the financial business service, and the similarity indicates the degree of similarity between different financial business services in at least one aspect of business attributes, service objectives, and operation processes; the candidate application services include other application services associated with the target application service during the permission adjustment process; and Based on the user permissions determination results involving M business attributes of the target application service, adjust the user permissions of each candidate application service, where M is an integer greater than or equal to 1.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images