User authority management method, system, equipment and medium

Abstract

The invention discloses a user authority management method, system and device and a medium, and relates to the technical field of cloud computing. The method comprises the following steps: acquiring operation data of a target user in a cloud storage system in real time; performing permission prediction on the operation data by using a pre-trained large model to output the required permission of the target user; monitoring an operation behavior of the target user according to the operation data, and when it is monitored that behavior change exists in the target user, dynamically adjusting the required permission based on a preset permission adjustment mechanism, and generating a permission change record; and performing security auditing on the operation data and the permission change record and generating a corresponding auditing report so as to adjust a security policy of the cloud storage system according to the auditing report. According to the technical scheme, the accuracy and flexibility of authority management are remarkably improved, and the risk of data leakage is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a user authority management method, system, device and medium. Background Art

[0002] With the rapid development of information technology, cloud storage systems have been widely used in various businesses due to their convenience, flexibility and cost-effectiveness. Users can access, manage and share data anytime and anywhere through cloud storage platforms, which greatly improves work efficiency. However, as more and more data is stored in the cloud, the issues of data security and privacy protection become more prominent.

[0003] In cloud storage environments, user rights management is a key link in protecting data security. The purpose of user rights management is to ensure that only authorized users can access, modify or delete specific data. Traditional rights management methods mainly rely on static role-based rights models or rule-based rights settings. This method often cannot quickly respond to changes in user needs when facing complex business scenarios, resulting in improper rights configuration. The allocation of rights is often done manually, lacking intelligence and automation, and also has corresponding security risks. In order to solve the above problems, rights management methods based on artificial intelligence and machine learning technologies have gradually been proposed in recent years. These methods attempt to use data analysis and model prediction to achieve dynamic rights management, and can intelligently adjust user rights based on the user's actual behavior and contextual information. However, existing AI-based rights management methods still face challenges in practical applications, such as insufficient model training data, high computational complexity, and difficulty in integration.

[0004] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a user rights management method, system, device and medium, which can significantly improve the accuracy and flexibility of rights management and effectively reduce the risk of data leakage. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a user rights management method, comprising:

[0007] Obtain the target user's operation data in the cloud storage system in real time;

[0008] Using a pre-trained large model to predict permissions for the operation data, so as to output the required permissions for the target user;

[0009] The operation behavior of the target user is monitored according to the operation data, and when the behavior of the target user is detected to have changed, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated;

[0010] A security audit is performed on the operation data and the permission change record and a corresponding audit report is generated, so as to adjust the security policy of the cloud storage system according to the audit report.

[0011] Optionally, the real-time acquisition of the target user's operation data in the cloud storage system includes:

[0012] Acquire the operation behavior and context information of the target user in the cloud storage system recorded in the log, and determine the operation data according to the operation behavior and the context information;

[0013] Correspondingly, after obtaining the target user's operation data in the cloud storage system in real time, it also includes:

[0014] The behavior pattern of the target user is analyzed according to the context information, and the operation behavior is analyzed by a preset analysis algorithm to detect potential access patterns and / or abnormal operation behaviors of the target user.

[0015] Optionally, the training process of the large model includes:

[0016] Obtain historical permission management data and historical operation data of different users to generate training data sets;

[0017] Acquire multiple model architectures of the large model, and perform model training on the large models of the multiple model architectures using the training data set in an incremental learning manner, so as to select a large model of a target model architecture from the multiple model architectures;

[0018] Accordingly, the use of the pre-trained large model to perform permission prediction on the operation data to output the required permissions of the target user includes:

[0019] Performing data preprocessing on the operation data to generate a feature data set that can be input into a large model of the target model architecture;

[0020] The feature data set is input into the large model of the target model architecture for permission prediction to output the required permissions for the target user.

[0021] Optionally, after using the pre-trained large model to perform permission prediction on the operation data to output the required permissions of the target user, the method further includes:

[0022] According to the required permissions, the large model is used to output a permission configuration policy for the target user; wherein the permission configuration policy can ensure that the target user only has the minimum permissions required to perform the current operation behavior.

[0023] Optionally, when a behavior change of the target user is detected, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated, including:

[0024] When a behavior change of the target user is detected, the required permissions are dynamically adjusted according to the permission configuration policy, and a permission change record is generated, and the permission change record is approved through a preset review interface.

[0025] Optionally, the performing a security audit on the operation data and the permission change record and generating a corresponding audit report includes:

[0026] The operation data is audited in real time through a preset machine learning algorithm, and the permission change records are audited regularly and corresponding audit reports are generated.

[0027] Optionally, the user rights management method further includes:

[0028] When the target user's access request for unauthorized resources is monitored, the target user is prompted through a visual interface that the target user has insufficient authority, and a permission application suggestion is provided to the target user so that the target user can submit a permission application corresponding to the access request through the visual interface based on the permission application suggestion.

[0029] In a second aspect, the present application discloses a user rights management system, comprising:

[0030] The data acquisition module is used to acquire the target user's operation data in the cloud storage system in real time;

[0031] A permission prediction module, used to use a pre-trained large model to perform permission prediction on the operation data to output the required permissions of the target user;

[0032] A permission adjustment module, used to monitor the operation behavior of the target user according to the operation data, and when the behavior of the target user is monitored to change, dynamically adjust the required permissions based on a preset permission adjustment mechanism, and generate a permission change record;

[0033] The security audit module is used to perform security audit on the operation data and the permission change record and generate a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0034] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the user authority management method as described above.

[0035] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the user authority management method as described above.

[0036] The present application provides a user authority management method, comprising: acquiring operation data of a target user in a cloud storage system in real time; using a pre-trained large model to perform authority prediction on the operation data to output the required authority of the target user; monitoring the operation behavior of the target user according to the operation data, and when a behavior change of the target user is detected, dynamically adjusting the required authority based on a preset authority adjustment mechanism, and generating a authority change record; performing a security audit on the operation data and the authority change record and generating a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0037] The beneficial technical effect of the present application is: by using a large model to analyze and predict the permissions of the user's operation data in the cloud storage system obtained in real time, the permissions required by the user are obtained. Further, by analyzing the user's operation data in real time, abnormal behavior is promptly identified and responded to, and the user's required permissions are dynamically adjusted, thereby reducing the risk of data leakage and abuse while realizing dynamic permission management. The dynamic permission adjustment mechanism ensures that the user's permissions can be automatically adjusted according to their actual needs and operating behaviors, avoiding the limitations of static permission settings in traditional methods, and making permission allocation more flexible and accurate. In addition, the introduction of auditing and monitoring functions and the generation of detailed audit reports help to quickly discover and resolve security issues and provide decision support for management.

[0038] In addition, the present application provides a user authority management system, device, and storage medium, which correspond to the above-mentioned user authority management method and have the same effects as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1A flow chart of a user rights management method disclosed in this application;

[0041] Figure 2 A schematic diagram of the structure of a user rights management system disclosed in this application;

[0042] Figure 3 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] In a cloud storage environment, user rights management is a key step in protecting data security. Traditional rights management methods mainly rely on static role-based rights models or rule-based rights settings. This method often cannot quickly respond to changes in user needs when faced with complex business scenarios, resulting in improper rights configuration. Rights allocation is often done manually, lacking intelligence and automation, which may lead to the following problems:

[0045] 1. Excessive or insufficient permissions: Due to the limitations of static models, users may be given excessive or insufficient permissions. For example, some users may need to temporarily access specific data, but due to inflexible permission settings, this need cannot be met in time, affecting work efficiency.

[0046] 2. Security risks: In a dynamic business environment, the roles and needs of users may change at any time, and static permission management methods are difficult to keep up with these changes, leading to increased risks of data leakage or abuse. Especially when sensitive data is involved, mistakes in permission control may lead to serious consequences.

[0047] 3. Auditing difficulties: Traditional methods lack comprehensive monitoring and auditing capabilities for permission management, and cannot record permission changes and user activities in real time, making subsequent audits difficult. This defect makes it difficult to ensure data compliance, especially as the challenges of complying with laws and regulations (such as GDPR and CCPA) increase.

[0048] In order to solve the above problems, permission management methods based on artificial intelligence and machine learning technologies have gradually been proposed in recent years. These methods attempt to use data analysis and model prediction to achieve dynamic permission management, and can intelligently adjust user permissions based on the user's actual behavior and contextual information. However, existing AI-based permission management methods still face the following challenges in practical applications:

[0049] 1. Insufficient model training data: Most existing methods rely on historical data during the training process, which is often incomplete or inaccurate, resulting in insufficient model performance.

[0050] 2. High computational complexity: Some models based on complex algorithms may experience computational delays during real-time permission prediction, affecting the system’s response speed.

[0051] 3. Integration difficulty: Existing methods often need to be integrated with traditional permission management systems, which brings high implementation difficulty and cost.

[0052] To this end, this application provides a user rights management solution that can effectively solve the above problems and improve the flexibility, security and intelligence level of user rights management in cloud storage systems, which has important practical significance and application value.

[0053] The embodiment of the present invention discloses a method for managing user rights. Figure 1 As shown, the method includes:

[0054] Step S11: Acquire the target user's operation data in the cloud storage system in real time.

[0055] In the embodiment of the present application, the operation data of the target user in the cloud storage system is acquired in real time, and the operation data can be acquired by using a variety of collection methods. The operation data mainly includes the operation behavior of the user and the corresponding context information.

[0056] Specifically, the real-time acquisition of the target user's operation data in the cloud storage system includes: acquiring the target user's operation behavior and context information in the cloud storage system recorded in the log, and determining the operation data according to the operation behavior and the context information.

[0057] It should be pointed out that the log records every operation of the target user, including the specific operation time of login and logout, file access, operation type, file ID, etc. Furthermore, context information collection is performed to collect user context information, such as the device used (mobile phone, computer, etc.), network environment (Wi-Fi, mobile data, etc.), geographic location, etc.

[0058] In the embodiment of the present application, after obtaining the operation data of the target user, the context information therein can be used to help analyze the behavior pattern of the target user. User behavior analysis can be performed on the operation behavior of the target user, and the user's historical operation behavior can be analyzed by an algorithm to discover potential access patterns and / or abnormal operation behaviors.

[0059] Specifically, after obtaining the target user's operation data in the cloud storage system in real time, it also includes: analyzing the target user's behavior pattern according to the context information, and analyzing the operation behavior through a preset analysis algorithm to detect the target user's potential access pattern and / or abnormal operation behavior.

[0060] Step S12: Use a pre-trained large model to perform permission prediction on the operation data to output the required permissions of the target user.

[0061] In view of the current shortcomings of insufficient model training data and high computational complexity in AI-based rights management, in the embodiments of the present application, user rights management is implemented based on a large model. The large model is significantly better than the traditional AI model in terms of real-time prediction speed, and because the large model is trained on a large amount of data, it can capture ubiquitous patterns and therefore has better generalization ability when processing new data. This means that the large model can maintain good performance even when facing unseen data.

[0062] Among them, the training process for the large model mainly includes the following steps:

[0063] Obtain historical permission management data and historical operation data of different users to generate training data sets;

[0064] Acquire multiple model architectures of the large model, and perform model training on the large model of the multiple model architectures using the training data set in an incremental learning manner to select a large model of a target model architecture from the multiple model architectures.

[0065] It is understandable that there are multiple options for the model architecture of the large model, and different model architectures have their own characteristics and are suitable for different tasks and application scenarios. In the embodiment of the present application, in order to determine the most suitable model architecture, multiple models with different model architectures (such as deep neural networks, enhanced learning models, etc.) are designed and compared. When training the model, an incremental learning training strategy is adopted, and the training data set generated by the historical permission management data and historical operation data of different users is used for model training to adapt to dynamically changing user needs.

[0066] In addition, the large model can achieve self-optimization and gradually improve the accuracy of permission prediction by continuously learning user behavior and permission usage patterns.

[0067] In an embodiment of the present application, a trained big model is used to analyze the operation data of the target user to predict the permissions required by the target user. Specifically, the operation data is preprocessed to generate a feature data set that can be input into the big model of the target model architecture; the feature data set is input into the big model of the target model architecture for permission prediction to output the required permissions for the target user. Among them, the data preprocessing process is a process of cleaning, denoising, and feature extracting the collected operation data to generate a feature set suitable for model input. When the user performs an operation, the operation data collected in real time is input into the big model, and the model predicts the permissions required by the user based on the user's current behavior and contextual information.

[0068] In addition, it is worth noting that, in a feasible implementation, in order to improve the intelligent level of permission management, the present invention can also introduce an intelligent decision support function. Based on the prediction results of the large model, the system can provide intelligent decision support and recommend the best permission configuration for users in specific situations. Specifically, according to the required permissions, the large model is used to output a permission configuration strategy for the target user. Among them, the permission configuration strategy can ensure that the target user only has the minimum permissions required to perform the current operation behavior.

[0069] It can be seen that, combined with the intelligent decision-making function of the big model, the system can provide intelligent permission management suggestions based on the user's behavior patterns and permission requirements. This intelligent decision support can help users and administrators better understand the use of permissions and make more appropriate permission configuration decisions. It ensures that users only obtain the minimum permissions required to perform the current operation, thereby improving data security.

[0070] Step S13: monitoring the operation behavior of the target user according to the operation data, and when detecting a change in the behavior of the target user, dynamically adjusting the required permissions based on a preset permission adjustment mechanism, and generating a permission change record.

[0071] In an embodiment of the present application, the user's permission settings are dynamically adjusted based on the required permissions of the target user output by the large model prediction to ensure the minimization and dynamic adaptation of permissions. Specifically, when the target user's behavior changes are monitored, the required permissions are dynamically adjusted according to the permission configuration policy. It is understandable that when a change in user behavior is detected (for example, an increase in the frequency of access to a specific file), the user's access rights are automatically adjusted to ensure that they can obtain the necessary access rights. After the permission is changed, the detailed information of all permission changes is automatically recorded, including the change time, reason for change, approver, etc., to generate a complete permission change record.

[0072] Furthermore, in the embodiment of the present application, a permission approval mechanism is provided. Since the large model can give permission change suggestions for dynamically adjusting the required permissions of users, a corresponding review interface is provided for the administrator, through which the administrator can review and confirm the permission change records generated after each dynamic adjustment of the required permissions to ensure system security.

[0073] It can be seen that by automating the permission management process, manual intervention and management costs are reduced. The system's automatic review and permission adjustment functions reduce the burden on administrators and improve management efficiency.

[0074] Step S14: Perform a security audit on the operation data and the permission change record and generate a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0075] In the embodiments of the present application, in order to enhance the security of the system, the audit and monitoring functions are introduced to help quickly discover and solve security problems and reduce potential financial losses. The audit function helps ensure compliance, meet various legal and regulatory requirements, and provide decision support for management.

[0076] Specifically, when conducting a security audit, a preset machine learning algorithm is used to perform a security audit on the operation data in real time, and a security audit on the permission change records is performed regularly and a corresponding audit report is generated.

[0077] It is understandable that the machine algorithm can be used to monitor the abnormal behavior of the target user's operation data obtained in real time, and identify abnormal access patterns (such as frequent logins from different locations, frequent changes in permissions in a short period of time, etc.). When the user's abnormal operation behavior is found, an alarm will be triggered. In addition, the user's permission change records are audited regularly, and the user's access behavior is monitored according to the user's permission usage, potential security risks are identified, and the security of the system is enhanced.

[0078] After the security audit is completed, a comprehensive audit report will be generated to help administrators understand the system's permission usage in a timely manner and provide a basis for subsequent security policy adjustments.

[0079] The present application provides a user authority management method, comprising: acquiring operation data of a target user in a cloud storage system in real time; using a pre-trained large model to perform authority prediction on the operation data to output the required authority of the target user; monitoring the operation behavior of the target user according to the operation data, and when a behavior change of the target user is detected, dynamically adjusting the required authority based on a preset authority adjustment mechanism, and generating a authority change record; performing a security audit on the operation data and the authority change record and generating a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0080] The beneficial technical effect of the present application is: by using a large model to analyze and predict the permissions of the user's operation data in the cloud storage system obtained in real time, the permissions required by the user are obtained. Further, by analyzing the user's operation data in real time, abnormal behavior is promptly identified and responded to, and the user's required permissions are dynamically adjusted, thereby reducing the risk of data leakage and abuse while realizing dynamic permission management. The dynamic permission adjustment mechanism ensures that the user's permissions can be automatically adjusted according to their actual needs and operating behaviors, avoiding the limitations of static permission settings in traditional methods, and making permission allocation more flexible and accurate. In addition, the introduction of auditing and monitoring functions and the generation of detailed audit reports help to quickly discover and resolve security issues and provide decision support for management.

[0081] Based on the above embodiments, in a feasible implementation, in order to improve the user's interactive experience, a user interaction and feedback mechanism is provided in the embodiments of the present application. Specifically, the following steps may be included:

[0082] When the target user's access request for unauthorized resources is monitored, the target user is prompted through a visual interface that the target user has insufficient authority, and a permission application suggestion is provided to the target user so that the target user can submit a permission application corresponding to the access request through the visual interface based on the permission application suggestion.

[0083] In the embodiment of the present application, a user visualization interface is designed for the user, so that the user can clearly view his or her permission status and change history, thereby increasing the user's trust and satisfaction with the system. At the same time, when the user performs file operations, the system can also provide timely feedback through the visualization interface based on the user's current permissions. For example, when a user attempts to perform an unauthorized operation to access an unauthorized resource, the system will prompt the user that the permission is insufficient through the visualization interface, and give suggestions for applying for permissions, thereby improving the user experience and the transparency of permission management. Furthermore, if the user has the need to access unauthorized resources, he or she can submit a permission application through the visualization interface and execute the permission application process. The system automatically records the reason for the application and notifies the relevant administrator for review.

[0084] It can be seen that when users access and share data, the system can provide real-time feedback based on their behavior and requests, significantly improving the user experience. Users can apply for permissions more conveniently and receive corresponding reviews and feedback, which enhances their trust in the system.

[0085] In addition, in a feasible implementation, in order to ensure the performance of the system in high-concurrency scenarios, the present invention also considers the scalability and optimization of the system. Specifically, load balancing technology can be used to distribute user requests to multiple servers to improve the response speed and processing power of the system. User data can be stored in shards to avoid single-point bottlenecks and improve data access efficiency. At the same time, in order to achieve model acceleration, a distributed computing framework (such as Apache Spark, TensorFlow) can also be used to train and predict the model to improve the real-time performance and accuracy of the model.

[0086] The present invention can also be combined with future technologies (such as AI, blockchain, etc.) to continuously update and optimize user rights management strategies, adapt to the ever-changing security environment and user needs, and provide enterprises with continuous competitive advantages.

[0087] Accordingly, the present application also discloses a user rights management system, see Figure 2 As shown, the device comprises:

[0088] The data acquisition module 11 is used to acquire the target user's operation data in the cloud storage system in real time;

[0089] The permission prediction module 12 is used to use a pre-trained large model to perform permission prediction on the operation data to output the required permissions of the target user;

[0090] The permission adjustment module 13 is used to monitor the operation behavior of the target user according to the operation data, and when the behavior change of the target user is detected, dynamically adjust the required permission based on a preset permission adjustment mechanism, and generate a permission change record;

[0091] The security audit module 14 is used to perform a security audit on the operation data and the permission change record and generate a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0092] In a feasible implementation, the present invention can be seamlessly integrated with the existing cloud storage system to ensure simple and efficient implementation. Specifically, through the standardized API interface, the data acquisition module can obtain user operation data in real time; the authority prediction module can quickly process and analyze data; and the authority adjustment module can be connected to the existing user authority system through the system's authority management interface. It can be seen that the system architecture supports seamless integration with existing cloud storage systems and has good scalability. In addition, the system can be flexibly deployed in different environments, supports deployment in public clouds, private clouds, and hybrid cloud environments, meets the needs of different users and businesses, and provides flexible configuration options.

[0093] Among them, for more specific working processes of the above-mentioned modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0094] It can be seen that the above scheme of this embodiment includes: obtaining the operation data of the target user in the cloud storage system in real time; using a pre-trained large model to predict the permissions of the operation data to output the required permissions of the target user; monitoring the operation behavior of the target user according to the operation data, and when it is detected that the target user has a behavior change, dynamically adjusting the required permissions based on a preset permission adjustment mechanism, and generating a permission change record; performing a security audit on the operation data and the permission change record and generating a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0095] The beneficial technical effect of the present application is: by using a large model to analyze and predict the permissions of the user's operation data in the cloud storage system obtained in real time, the permissions required by the user are obtained. Further, by analyzing the user's operation data in real time, abnormal behavior is promptly identified and responded to, and the user's required permissions are dynamically adjusted, thereby reducing the risk of data leakage and abuse while realizing dynamic permission management. The dynamic permission adjustment mechanism ensures that the user's permissions can be automatically adjusted according to their actual needs and operation behaviors, avoiding the limitations of static permission settings in traditional methods, and making permission allocation more flexible and accurate. In addition, the introduction of auditing and monitoring functions and the generation of detailed audit reports help to quickly discover and resolve security issues and provide decision-making support for management. These modules work together to achieve comprehensive management and monitoring of user permissions, and have broad application prospects.

[0096] Furthermore, the present application also discloses an electronic device. Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0097] Figure 3A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the user rights management method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be a computer.

[0098] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0099] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222 and data 223, etc. The data 223 may include various data. The storage method may be temporary storage or permanent storage.

[0100] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the user rights management method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0101] Furthermore, the embodiment of the present application also discloses a computer-readable storage medium, wherein the computer-readable storage medium mentioned here includes a random access memory (Random Access Memory, RAM), a memory, a read-only memory (Read-Only Memory, ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a magnetic disk or an optical disk, or any other form of storage medium known in the technical field. Wherein, when the computer program is executed by the processor, the aforementioned user rights management method is implemented. For the specific steps of the method, reference can be made to the corresponding contents disclosed in the aforementioned embodiment, which will not be repeated here.

[0102] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0103] The steps of the user rights management method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0104] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0105] The user authority management method, system, device and medium provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A user rights management method, characterized in that: include: Obtain the target user's operation data in the cloud storage system in real time; Using a pre-trained large model to predict permissions for the operation data, so as to output the required permissions for the target user; The operation behavior of the target user is monitored according to the operation data, and when the behavior of the target user is detected to have changed, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated; A security audit is performed on the operation data and the permission change record and a corresponding audit report is generated, so as to adjust the security policy of the cloud storage system according to the audit report.

2. The user rights management method according to claim 1, characterized in that: The real-time acquisition of the target user's operation data in the cloud storage system includes: Acquire the operation behavior and context information of the target user in the cloud storage system recorded in the log, and determine the operation data according to the operation behavior and the context information; Correspondingly, after obtaining the target user's operation data in the cloud storage system in real time, it also includes: The behavior pattern of the target user is analyzed according to the context information, and the operation behavior is analyzed by a preset analysis algorithm to detect potential access patterns and / or abnormal operation behaviors of the target user.

3. The user rights management method according to claim 1, characterized in that: The training process of the large model includes: Obtain historical permission management data and historical operation data of different users to generate training data sets; Acquire multiple model architectures of the large model, and perform model training on the large models of the multiple model architectures using the training data set in an incremental learning manner, so as to select a large model of a target model architecture from the multiple model architectures; Accordingly, the use of the pre-trained large model to perform permission prediction on the operation data to output the required permissions of the target user includes: Performing data preprocessing on the operation data to generate a feature data set that can be input into a large model of the target model architecture; The feature data set is input into the large model of the target model architecture for permission prediction to output the required permissions for the target user.

4. The user rights management method according to claim 1, characterized in that: After the pre-trained large model is used to predict the permissions of the operation data to output the required permissions of the target user, the method further includes: According to the required permissions, the large model is used to output a permission configuration policy for the target user; wherein the permission configuration policy can ensure that the target user only has the minimum permissions required to perform the current operation behavior.

5. The user rights management method according to claim 4, characterized in that: When the behavior of the target user is detected to have changed, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated, including: When a behavior change of the target user is detected, the required permissions are dynamically adjusted according to the permission configuration policy, and a permission change record is generated, and the permission change record is approved through a preset review interface.

6. The user rights management method according to claim 1, characterized in that: The performing of security audit on the operation data and the permission change record and generating a corresponding audit report includes: The operation data is audited in real time through a preset machine learning algorithm, and the permission change records are audited regularly and corresponding audit reports are generated.

7. The user rights management method according to any one of claims 1 to 6, characterized in that: Also includes: When the target user's access request for unauthorized resources is monitored, the target user is prompted through a visual interface that the target user has insufficient authority, and a permission application suggestion is provided to the target user so that the target user can submit a permission application corresponding to the access request through the visual interface based on the permission application suggestion.

8. A user rights management system, characterized in that: include: The data acquisition module is used to acquire the target user's operation data in the cloud storage system in real time; A permission prediction module, used to use a pre-trained large model to perform permission prediction on the operation data to output the required permissions of the target user; A permission adjustment module, used to monitor the operation behavior of the target user according to the operation data, and when the behavior of the target user is detected to have changed, dynamically adjust the required permissions based on a preset permission adjustment mechanism, and generate a permission change record; The security audit module is used to perform security audit on the operation data and the permission change record and generate a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

9. An electronic device, characterized in that: The electronic device comprises a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the user authority management method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein the computer program, when executed by the processor, implements the user rights management method as described in any one of claims 1 to 7.

Images