A user permission management method, system, device and medium

Abstract

The application discloses a user permission management method, system, device and medium, and relates to the technical field of cloud computing. The method comprises the following steps: acquiring operation data of a target user in a cloud storage system in real time; using a pre-trained large model to predict the permission of the operation data, so as to output the required permission of the target user; monitoring the operation behavior of the target user according to the operation data, and when it is monitored that the target user has a behavior change, dynamically adjusting the required permission based on a pre-set permission adjustment mechanism, and generating a permission change record; performing security auditing on the operation data and the permission change record and generating a corresponding auditing report, so as to adjust the security policy of the cloud storage system according to the auditing report. Through the technical scheme of the application, the accuracy and flexibility of permission management are significantly improved, and the risk of data leakage is effectively reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing, and in particular to a user permission management method, system, device and medium. BACKGROUND

[0002] With the rapid development of information technology, cloud storage systems are widely used in various businesses due to their convenience, flexibility and cost-effectiveness. Users can access, manage and share data anytime and anywhere through cloud storage platforms, which greatly improves work efficiency. However, as more and more data is stored in the cloud, data security and privacy protection issues have become increasingly prominent.

[0003] In the cloud storage environment, user permission management is a key link to protect data security. The purpose of user permission management is to ensure that only authorized users can access, modify or delete specific data. Traditional permission management methods mainly rely on static role permission models or rule-based permission settings. This method often cannot quickly respond to changes in user needs in complex business scenarios, leading to improper permission configuration. The allocation of permissions is often done manually, lacking intelligence and automation, and there are also corresponding security risks. In order to solve the above problems, in recent years, permission management methods based on artificial intelligence and machine learning technology have been gradually proposed. These methods attempt to use data analysis and model prediction to achieve dynamic permission management, which can intelligently adjust the user's permissions according to the user's actual behavior and context information. However, existing AI-based permission management methods still face challenges such as insufficient model training data, high computational complexity, and difficulty in integration in practical applications.

[0004] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a user permission management method, system, device and medium that can significantly improve the accuracy and flexibility of permission management and effectively reduce the risk of data leakage. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a user permission management method, comprising:

[0007] real-time acquisition of operation data of a target user in a cloud storage system;

[0008] using a pre-trained large model to predict the permissions of the operation data to output the required permissions of the target user;

[0009] According to the operation data, the operation behavior of the target user is monitored, and when it is monitored that the target user has a behavior change, the required permission is dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated;

[0010] The operation data and the permission change record are subjected to security audit and a corresponding audit report is generated, so that the security policy of the cloud storage system is adjusted according to the audit report.

[0011] Optionally, the operation data of the target user in the cloud storage system is obtained in real time, including:

[0012] The operation behavior and the context information of the target user in the cloud storage system recorded in the log are obtained, and the operation data is determined according to the operation behavior and the context information;

[0013] Correspondingly, after the operation data of the target user in the cloud storage system is obtained in real time, it further includes:

[0014] According to the context information, the behavior mode of the target user is analyzed, and the operation behavior is analyzed through a preset analysis algorithm to detect the potential access mode and / or abnormal operation behavior of the target user.

[0015] Optionally, the training process of the large model includes:

[0016] The historical permission management data and the historical operation data of different users are obtained to generate a training data set;

[0017] A plurality of model architectures of the large model are obtained, and the large model is trained by using the training data set in an incremental learning manner to select a large model with a target model architecture from the plurality of model architectures;

[0018] Correspondingly, the large model is used to predict the permission of the operation data to output the required permission of the target user, including:

[0019] The operation data is subjected to data preprocessing to generate a feature data set that can be input into the large model with the target model architecture;

[0020] The feature data set is input into the large model with the target model architecture for permission prediction to output the required permission of the target user.

[0021] Optionally, after the large model is used to predict the permission of the operation data to output the required permission of the target user, it further includes:

[0022] According to the required permissions, a permission configuration strategy is output for the target user by using the large model; wherein the permission configuration strategy can ensure that the target user only has the minimum permissions required to perform the current operation behavior.

[0023] Optionally, when the behavior change of the target user is monitored, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated, including:

[0024] When the behavior change of the target user is monitored, the required permissions are dynamically adjusted according to the permission configuration strategy, and a permission change record is generated, and the permission change record is approved through a preset audit interface.

[0025] Optionally, the security audit is performed on the operation data and the permission change record, and a corresponding audit report is generated, including:

[0026] The operation data is audited in real time by a preset machine learning algorithm, and the permission change record is audited periodically and a corresponding audit report is generated.

[0027] Optionally, the user permission management method further includes:

[0028] When the access request of the target user to the unauthorized resource is monitored, the target user is prompted for insufficient permissions through a visual interface, and permission application suggestions are provided for the target user, so that the target user submits a permission application corresponding to the access request through the visual interface according to the permission application suggestions.

[0029] In a second aspect, the application discloses a user permission management system, including:

[0030] A data acquisition module is configured to acquire operation data of a target user in a cloud storage system in real time.

[0031] A permission prediction module is configured to predict the permissions of the operation data by using a pre-trained large model to output the required permissions of the target user.

[0032] A permission adjustment module is configured to monitor the operation behavior of the target user according to the operation data, and dynamically adjust the required permissions based on a preset permission adjustment mechanism when the behavior change of the target user is monitored, and generate a permission change record.

[0033] A security audit module is configured to perform security audit on the operation data and the permission change record, and generate a corresponding audit report, so as to adjust the security strategy of the cloud storage system according to the audit report.

[0034] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the memory is configured to store a computer program, which is loaded and executed by the processor to implement the user permission management method as described above.

[0035] In a fourth aspect, the present application discloses a computer readable storage medium configured to store a computer program; wherein the computer program is executed by a processor to implement the user permission management method as described above.

[0036] The present application provides a user permission management method, comprising: acquiring operation data of a target user in a cloud storage system in real time; using a pre-trained large model to perform permission prediction on the operation data to output required permissions of the target user; monitoring operation behavior of the target user according to the operation data, and when a behavior change of the target user is monitored, dynamically adjusting the required permissions based on a preset permission adjustment mechanism, and generating a permission change record; performing security audit on the operation data and the permission change record and generating a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0037] The beneficial technical effects of the present application are: by using a large model to analyze and predict the operation data of the user in the cloud storage system in real time, the required permissions of the user are obtained. Further, by analyzing the operation data of the user in real time, abnormal behavior is identified and responded in time, and the required permissions of the user are dynamically adjusted, which reduces the risk of data leakage and abuse while realizing dynamic permission management. The dynamic permission adjustment mechanism ensures that the permissions of the user can be automatically adjusted according to the actual needs and operation behavior, avoiding the limitations of static permission setting in traditional methods, making the permission allocation more flexible and accurate. In addition, the introduction of audit and monitoring functions generates detailed audit reports, which helps to quickly find and solve security problems, and provides decision support for management.

[0038] In addition, the user permission management system, device and storage medium provided by the present application correspond to the above-mentioned user permission management method, and have the same effects. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description only constitute the embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of the provided drawings.

[0040] Figure 1A user permission management method flowchart disclosed by the present application;

[0041] Figure 2 A user permission management system structure schematic diagram disclosed by the present application;

[0042] Figure 3 An electronic device structure diagram disclosed by the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0044] In a cloud storage environment, user permission management is a key link to protect data security. Traditional permission management methods mainly rely on static role permission models or rule-based permission settings. This method often cannot quickly respond to changes in user needs when facing complex business scenarios, leading to improper permission configuration. The allocation of permissions is often done manually, lacking intelligence and automation, which may lead to the following problems:

[0045] 1. Excessive or insufficient permissions: due to the limitations of static models, users may have too many or too few permissions. For example, some users may need temporary access to specific data, but due to inflexible permission settings, this demand cannot be met in a timely manner, affecting work efficiency.

[0046] 2. Security risks: In a dynamic business environment, users' roles and needs may change at any time, and static permission management methods are difficult to keep up with these changes, leading to an increased risk of data leakage or misuse. Especially when sensitive data is involved, a mistake in permission control can lead to serious consequences.

[0047] 3. Audit difficulties: Traditional methods lack comprehensive monitoring and auditing capabilities for permission management, and cannot record permission changes and user activities in real time, making subsequent audits difficult. This defect makes it difficult to ensure data compliance, especially in the face of increasing challenges in complying with laws and regulations (such as GDPR, CCPA).

[0048] In order to solve the above problems, in recent years, permission management methods based on artificial intelligence and machine learning technology have been gradually proposed. These methods attempt to use data analysis and model prediction to achieve dynamic permission management, which can intelligently adjust users' permissions based on their actual behavior and contextual information. However, existing AI-based permission management methods still face the following challenges in practical application:

[0049] 1. Insufficient model training data: Most existing methods rely on historical data during the training process, which often has incomplete or inaccurate problems, resulting in insufficient model performance.

[0050] 2. High computational complexity: Some models based on complex algorithms may have computational delays when predicting real-time permissions, affecting the response speed of the system.

[0051] 3. Difficulty in integration: Existing methods often need to be integrated with traditional permission management systems, resulting in high implementation difficulty and cost.

[0052] Therefore, the present application provides a user permission management scheme, which can effectively solve the above problems and improve the flexibility, security and intelligence level of user permission management in cloud storage systems, having important practical significance and application value.

[0053] The embodiment of the application discloses a user permission management method, referring to Figure 1 The method comprises the following steps:

[0054] Step S11: Real-time acquisition of operation data of the target user in the cloud storage system.

[0055] In the embodiment of the application, the operation data of the target user in the cloud storage system is acquired in real time, and the operation data can be acquired by using various collection methods. The operation data mainly includes the operation behavior and the corresponding context information.

[0056] Specifically, the real-time acquisition of the operation data of the target user in the cloud storage system comprises: acquiring the operation behavior and the context information of the target user in the cloud storage system recorded in the log, and determining the operation data according to the operation behavior and the context information.

[0057] It should be pointed out that the log records each operation behavior of the target user, including the specific operation time of login and logout, file access, operation type, file ID and other information. Further, the context information is collected, such as the use of devices (mobile phones, computers, etc.), network environment (Wi-Fi, mobile data, etc.), geographic location, etc.

[0058] In the embodiment of the application, after the operation data of the target user is acquired, the context information can help analyze the behavior pattern of the target user. The user behavior analysis of the operation behavior of the target user can analyze the historical operation behavior of the user by algorithm, so as to find the potential access pattern and / or abnormal operation behavior.

[0059] Specifically, after the operation data of the target user in the cloud storage system is acquired in real time, the method further includes: analyzing a behavior mode of the target user according to the context information, and analyzing the operation behavior by using a preset analysis algorithm to detect a potential access mode and / or an abnormal operation behavior of the target user.

[0060] Step S12: performing permission prediction on the operation data by using the pre-trained large model to output required permissions of the target user.

[0061] To address the defects of insufficient model training data and high computational complexity in current AI-based permission management, in the embodiments of the present application, a large model is used to implement permission management of users. The large model is significantly superior to traditional AI models in real-time prediction speed, and since the large model is trained on a large amount of data, it can capture generally existing patterns, and thus has good generalization ability when processing new data. This means that the large model can also maintain good performance when facing unseen data.

[0062] The training process of the large model mainly includes the following steps:

[0063] Obtaining historical permission management data and historical operation data of different users to generate a training data set;

[0064] Obtaining a plurality of model architectures of the large model, and performing model training on the large model with the plurality of model architectures by using the training data set in an incremental learning manner to select a large model with a target model architecture from the plurality of model architectures.

[0065] It can be understood that the model architecture of the large model can have multiple choices, and different model architectures have different characteristics and are suitable for different tasks and application scenarios. In the embodiments of the present application, in order to determine the most suitable model architecture, a plurality of models with different model architectures (such as deep neural networks, reinforcement learning models, etc.) are designed and compared. When performing model training, an incremental learning manner is used for training strategy, and the training data set generated by the historical permission management data and the historical operation data of different users is used for model training to adapt to dynamic changes in user demand.

[0066] In addition, the large model can realize self-optimization by continuously learning user behavior and permission usage patterns, gradually improving the accuracy of permission prediction.

[0067] In the embodiments of the present application, the trained large model is used to analyze the operation data of the target user, thereby predicting the required permissions of the target user. Specifically, the operation data is pre-processed to generate a feature data set that can be input into the large model of the target model architecture; the feature data set is input into the large model of the target model architecture for permission prediction to output the required permissions of the target user. The data preprocessing process is a process of cleaning, denoising, and feature extraction of the collected operation data to generate a feature set suitable for model input. When the user operates, the real-time collected operation data is input into the large model, and the model predicts the required permissions based on the current behavior and context information of the user.

[0068] In addition, it is worth noting that in a feasible implementation, to improve the intelligent level of permission management, the present application can also introduce intelligent decision support function. Based on the prediction results of the large model, the system can provide intelligent decision support to suggest the best permission configuration of the user in a specific situation. Specifically, according to the required permissions, the large model outputs a permission configuration strategy for the target user. The permission configuration strategy can ensure that the target user only has the minimum permissions required to perform the current operation behavior.

[0069] As can be seen, combined with the intelligent decision function of the large model, the system can provide intelligent permission management suggestions according to the behavior patterns and permission requirements of the user. This intelligent decision support can help users and administrators better understand the permission usage and make more appropriate permission configuration decisions. Ensuring that the user only obtains the minimum permissions required to perform the current operation improves the security of the data.

[0070] Step S13: According to the operation data, the operation behavior of the target user is monitored, and when the target user is detected to have a behavior change, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated.

[0071] In the embodiments of the present application, the required permissions of the target user predicted by the large model are used to dynamically adjust the permission settings of the user, ensuring the minimization and dynamic adaptation of the permissions. Specifically, when the target user is detected to have a behavior change, the required permissions are dynamically adjusted according to the permission configuration strategy. It can be understood that when the user behavior change (for example, increasing the frequency of accessing a specific file) is detected, the user's access permissions are automatically adjusted to ensure that the necessary access permissions are obtained. After the permission is changed, all detailed information of the permission change is automatically recorded, including the change time, the change reason, the approver, etc., to generate a complete permission change record.

[0072] Further, the application embodiments provide a permission approval mechanism. Since the large model can give permission change suggestions for dynamically adjusting the required permissions of the user, the administrator is provided with a corresponding review interface. The administrator can review and confirm the permission change records generated after each dynamic adjustment of the required permissions through the interface, ensuring system security.

[0073] As can be seen, through the automated permission management process, manual intervention and management costs are reduced. The automatic review and permission adjustment functions of the system reduce the burden on administrators and improve management efficiency.

[0074] Step S14: Perform security audit on the operation data and the permission change records and generate a corresponding audit report to adjust the security policy of the cloud storage system according to the audit report.

[0075] In the application embodiments, to enhance the security of the system, audit and monitoring functions are introduced, which help to quickly discover and solve security problems and reduce potential financial losses. The audit function helps to ensure compliance, meet various legal and regulatory requirements, and provide decision support for management.

[0076] Specifically, when performing security audit, the operation data is audited in real time by a pre-set machine learning algorithm, and the permission change records are audited periodically and a corresponding audit report is generated.

[0077] It can be understood that the operation data of the target user obtained in real time can be monitored for abnormal behavior of the user by a machine algorithm, and abnormal access patterns (such as frequent login from different locations, frequent permission modification in a short period of time, etc.) are identified. When abnormal operation behavior of the user is found, an alarm is triggered. In addition, the user's permission change records are audited periodically, the user's access behavior is monitored according to the user's permission usage, potential security risks are identified, and the security of the system is enhanced.

[0078] After the security audit is completed, a comprehensive audit report will be generated to help administrators understand the permission usage of the system in a timely manner and provide a basis for subsequent security policy adjustments.

[0079] The application provides a user permission management method, comprising: acquiring operation data of a target user in a cloud storage system in real time; using a pre-trained large model to predict the permissions of the operation data to output the required permissions of the target user; monitoring the operation behavior of the target user according to the operation data, and when a behavior change of the target user is monitored, dynamically adjusting the required permissions based on a preset permission adjustment mechanism, and generating a permission change record; performing security auditing on the operation data and the permission change record and generating a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0080] The beneficial technical effects of the application are: by using a large model to analyze and predict the permissions of the operation data of the user in the cloud storage system acquired in real time, the required permissions of the user are obtained. Further, by analyzing the operation data of the user in real time, abnormal behavior is identified and responded in time, and the required permissions of the user are dynamically adjusted, thereby reducing the risk of data leakage and abuse and realizing dynamic permission management. The dynamic permission adjustment mechanism ensures that the permissions of the user can be automatically adjusted according to the actual needs and operation behavior, avoiding the limitations of static permission setting in traditional methods, making the permission allocation more flexible and accurate. In addition, the introduction of the auditing and monitoring functions generates detailed audit reports, which helps to quickly discover and solve security problems and provides decision support for the management.

[0081] Based on the above embodiments, in a feasible implementation, in order to improve the interactive experience of the user, the application embodiments provide a user interaction and feedback mechanism. Specifically, the following steps can also be included:

[0082] When the access request of the target user to the unauthorized resource is monitored, the target user is prompted by the visual interface that the permissions are insufficient, and the target user is provided with permission application suggestions, so that the target user submits the permission application corresponding to the access request through the visual interface according to the permission application suggestions.

[0083] In the application embodiments, the user visual interface designed for the user enables the user to clearly view the permission status and change history, increasing the trust and satisfaction of the user to the system. At the same time, when the user performs file operations, the system can also provide timely feedback through the visual interface according to the current permissions. For example, when the user attempts to perform unauthorized operations to access unauthorized resources, the system will prompt the user that the permissions are insufficient through the visual interface and give suggestions for applying for permissions, improving the user experience and the transparency of permission management. Further, when the user has the demand to access unauthorized resources, the user submits the permission application through the visual interface and performs the permission application process. The system automatically records the application reason and notifies the relevant administrator to perform auditing.

[0084] As can be seen, when accessing and sharing data, the system can provide real-time feedback according to the behavior and request of the user, significantly improving the user experience. The user can more conveniently apply for permission and obtain corresponding review and feedback, enhancing the user's trust in the system.

[0085] In addition, in a feasible implementation, in order to ensure the performance of the system in a high concurrency scenario, the scalability and optimization of the system are also considered. Specifically, load balancing technology can be used to distribute user requests to multiple servers, improving the response speed and processing capacity of the system. User data can be stored in shards to avoid single-point bottlenecks and improve data access efficiency. At the same time, in order to realize model acceleration, distributed computing frameworks (such as Apache Spark, TensorFlow) can also be used for model training and prediction to improve the real-time performance and accuracy of the model.

[0086] The present application can also be combined with future technologies (such as AI, blockchain, etc.) to continuously update and optimize user permission management strategies, adapt to changing security environments and user needs, and provide continuous competitive advantage for enterprises.

[0087] Correspondingly, the present application also discloses a user permission management system, as shown in Figure 2 The device comprises:

[0088] The data acquisition module 11 is configured to acquire operation data of a target user in a cloud storage system in real time.

[0089] The permission prediction module 12 is configured to use a pre-trained large model to predict the required permissions of the target user from the operation data.

[0090] The permission adjustment module 13 is configured to monitor the operation behavior of the target user according to the operation data, and when a behavior change of the target user is monitored, dynamically adjust the required permissions based on a pre-set permission adjustment mechanism, and generate a permission change record.

[0091] The security audit module 14 is configured to perform security audit on the operation data and the permission change record and generate a corresponding audit report, so as to adjust the security policy of the cloud storage system according to the audit report.

[0092] In a feasible implementation, the present application can be seamlessly integrated with existing cloud storage systems to ensure simple and efficient implementation. Specifically, through a standardized API interface, the data acquisition module can acquire user operation data in real time; the permission prediction module can quickly process and analyze the data; and the permission adjustment module can be connected to the existing user permission system through the system's permission management interface. It can be seen that the system architecture supports seamless integration with existing cloud storage systems and has good scalability. In addition, the system can be flexibly deployed in different environments, supporting deployment in public clouds, private clouds and hybrid cloud environments to meet the needs of different users and businesses, while providing flexible configuration options.

[0093] Wherein, the more specific working process of each module described above can refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0094] It can be seen that through the above scheme of the present embodiment, the operation data of the target user in the cloud storage system is acquired in real time; the operation data is predicted by using a pre-trained large model to output the required permissions of the target user; the operation behavior of the target user is monitored according to the operation data, and when the target user has a behavior change, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated; the operation data and the permission change record are audited for security and a corresponding audit report is generated, so that the security policy of the cloud storage system is adjusted according to the audit report.

[0095] The beneficial technical effects of the present application are: by using a large model to analyze and predict the operation data of the user in the cloud storage system in real time, the required permissions of the user are obtained. Further, by analyzing the operation data of the user in real time, abnormal behavior is identified and responded in time, and the required permissions of the user are dynamically adjusted, which reduces the risk of data leakage and abuse while realizing dynamic permission management. The dynamic permission adjustment mechanism ensures that the user's permissions can be automatically adjusted according to his actual needs and operation behavior, avoiding the limitations of static permission setting in traditional methods, making the permission allocation more flexible and accurate. In addition, the introduction of audit and monitoring functions generates detailed audit reports, which helps to quickly discover and solve security problems and provides decision support for management. These modules work together to realize comprehensive management and monitoring of user permissions, and have wide application prospects.

[0096] Further, the present application embodiment also discloses an electronic device, Figure 3 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be considered as any limitation on the use range of the present application.

[0097] Figure 3A structural schematic diagram of an electronic device 20 is provided in the embodiments of the present application. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. The memory 22 is configured to store a computer program, and the processor 21 is configured to load and execute the computer program to implement the related steps in the user permission management method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in the embodiments of the present application can be specifically a computer.

[0098] In the embodiments of the present application, the power supply 23 is configured to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 is capable of creating a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which is not specifically limited herein; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which is not specifically limited herein.

[0099] In addition, the memory 22 as a carrier for storing resources can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222 and data 223, etc., and the data 223 can include various data. The storage mode can be temporary storage or permanent storage.

[0100] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the user permission management method executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include a computer program capable of completing other specific work.

[0101] Further, the embodiments of the present application also disclose a computer readable storage medium, which includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a magnetic disk or an optical disk or any other form of storage medium known in the technical field. The computer program is executed by the processor to implement the foregoing user permission management method. The specific steps of the method can refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0102] The various embodiments described in the specification are progressive in nature, and each embodiment highlights the differences from other embodiments. The same or similar parts among the various embodiments can be mutually referred to. For the apparatus disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method.

[0103] The steps of the user permission management method or algorithm described in combination with the embodiments disclosed herein can be implemented directly by hardware, software modules executed by a processor, or a combination of both. The software modules can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0104] Finally, it should be noted that in this document, relational terms such as first and second, and the like, are used solely to distinguish one entity or action from another entity or action, without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by an indefinite article "a" or "an" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the defined element.

[0105] The above describes in detail the user permission management method, system, device, and medium provided by the present application. The principles and implementation manners of the present application are described by applying specific examples. The above embodiment descriptions are only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range can be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A user access control method, characterized in that, include: Real-time acquisition of target user's operation data in the cloud storage system; A pre-trained large model is used to predict permissions on the operation data to output the required permissions for the target user. The operation behavior of the target user is monitored based on the operation data, and when a change in the target user's behavior is detected, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated. The operation data and permission change records are subjected to security audits, and corresponding audit reports are generated so that the security policy of the cloud storage system can be adjusted according to the audit reports. The training process of the large model includes: Obtain historical permission management data and historical operation data of different users to generate a training dataset; Multiple model architectures of the large model are obtained, and the large model of the multiple model architectures is trained using the training dataset through incremental learning, so as to select the target model architecture from the multiple model architectures. Accordingly, the step of using a pre-trained large model to predict permissions on the operation data to output the required permissions for the target user includes: The operational data is preprocessed to generate a feature dataset for a large model that can be input into the target model architecture; The feature dataset is input into the large model of the target model architecture to predict permissions, and output the required permissions for the target user. After using a pre-trained large model to predict permissions on the operational data and output the required permissions for the target user, the method further includes: Based on the required permissions, the large model is used to output a permission configuration strategy for the target user; wherein, the permission configuration strategy can ensure that the target user only has the minimum permissions required to perform the current operation. When a change in the target user's behavior is detected, the required permissions are dynamically adjusted based on a preset permission adjustment mechanism, and a permission change record is generated, including: When a change in the behavior of the target user is detected, the required permissions are dynamically adjusted according to the permission configuration policy, a permission change record is generated, and the permission change record is approved through a preset review interface. The user permission management method further includes: When an unauthorized access request from the target user is detected, the system prompts the target user that their permissions are insufficient through a visual interface and provides permission request suggestions to the target user so that the target user can submit a permission request corresponding to the access request through the visual interface based on the permission request suggestions.

2. The user access control method according to claim 1, characterized in that, The real-time acquisition of target user's operation data in the cloud storage system includes: Obtain the target user's operation behavior and context information recorded in the log in the cloud storage system, and determine the operation data based on the operation behavior and the context information; Correspondingly, after acquiring the target user's operation data in the cloud storage system in real time, it also includes: The target user's behavior pattern is analyzed based on the context information, and the operation behavior is analyzed through a preset analysis algorithm to detect the target user's potential access patterns and / or abnormal operation behavior.

3. The user access control method according to claim 1, characterized in that, The process of performing security audits on the operation data and the permission change records, and generating corresponding audit reports, includes: The operation data is audited in real time using a preset machine learning algorithm, and the permission change records are audited periodically to generate corresponding audit reports.

4. A user access control system, characterized in that, include: The data acquisition module is used to acquire the target user's operation data in the cloud storage system in real time; The permission prediction module is used to predict permissions on the operation data using a pre-trained large model, so as to output the required permissions for the target user. The permission adjustment module is used to monitor the operation behavior of the target user based on the operation data, and when the target user's behavior changes are detected, dynamically adjust the required permissions based on a preset permission adjustment mechanism and generate a permission change record. The security audit module is used to perform security audits on the operation data and the permission change records and generate corresponding audit reports, so as to adjust the security policy of the cloud storage system according to the audit reports. The user access control system is also used for: Obtain historical permission management data and historical operation data of different users to generate a training dataset; Multiple model architectures of the large model are obtained, and the large model of the multiple model architectures is trained using the training dataset through incremental learning, so as to select the target model architecture from the multiple model architectures. Based on the required permissions, the large model is used to output a permission configuration strategy for the target user; wherein, the permission configuration strategy can ensure that the target user only has the minimum permissions required to perform the current operation. When an access request from the target user to an unauthorized resource is detected, the system prompts the target user that the user does not have sufficient permissions through a visual interface and provides permission request suggestions to the target user so that the target user can submit a permission request corresponding to the access request through the visual interface based on the permission request suggestions. The permission prediction module is specifically used for: The operational data is preprocessed to generate a feature dataset for a large model that can be input into the target model architecture; The feature dataset is input into the large model of the target model architecture to predict permissions, and output the required permissions for the target user. The permission adjustment module is specifically used for: When a change in the behavior of the target user is detected, the required permissions are dynamically adjusted according to the permission configuration policy, a permission change record is generated, and the permission change record is approved through a preset audit interface.

5. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the user rights management method as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein the computer programs, when executed by a processor, implement the user rights management method as described in any one of claims 1 to 3.

Images