Risk processing method, target component, project system front end and cloud system

Abstract

The embodiment of the invention provides a risk processing method, a target component, a project system front end and computing equipment, the risk processing method is applied to the target component of the project system front end, and the target component records an identity label of a user. The identity label is generated when the project system front end calls a target component to collect user information in each project platform; the risk processing method comprises the steps that project operation of a target user is received, and the project operation carries operation attributes and target user information of the target user; determining a target identity label of the target user based on the target user information; according to the operation attribute and the target identity identifier, identifying whether the project operation is a risk operation; and under the condition that the project operation is the risk operation, performing risk processing on the project operation. Unified authentication and management of user identities in different project platforms and processing of risk operations of users are realized, and the security and reliability of each project platform management system are guaranteed.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and in particular to a risk management method and a target component, a project system front end, and a cloud system. Background Art

[0002] With the development of science and technology, the popularization of enterprise informatization and digital application platforms has made cross-platform user behavior management an important need.

[0003] At present, the user behavior management technology mainly relies on the identity authentication and permission control system independently configured in each project platform. Users log in to multiple project platforms separately, and then each project platform system only logs the user's operations on the project platform, and provides basic risk management functions by configuring complex permission rules. At the same time, in order to enhance security, multi-factor authentication is used to verify the user's identity when logging into the project platform.

[0004] However, although these technologies guarantee security and compliance to a certain extent, they still have some limitations in practical applications. The control systems of each project platform are different, and the configuration and maintenance are relatively complex, requiring the support of professional technical personnel; at the same time, the interoperability between different platforms is poor, which leads to serious information island phenomenon and affects the overall management efficiency. Therefore, a more flexible, efficient and easy-to-integrate cross-platform risk management method is urgently needed. Summary of the invention

[0005] In view of this, an embodiment of this specification provides a risk management method. One or more embodiments of this specification also involve a target component, a project system front end, a computing device, a computer-readable storage medium and a computer program product to solve the technical defects existing in the prior art.

[0006] An embodiment of the present specification provides a risk handling method, which is applied to a target component of a project system front end, wherein the target component records a user's identity, and the identity is generated by the project system front end calling the target component to collect user information in each project platform; the method includes: receiving a project operation of a target user, wherein the project operation carries an operation attribute and target user information of the target user; Determine a target identity of the target user based on the target user information; Identify whether a project operation is a risky operation based on the operation attributes and target identity; When the project operation is a risky operation, risk management shall be performed on the project operation.

[0007] The user's identity is recorded through the target component of the project system front end, and when receiving the project operation of the target user, the target identity is determined based on the carried operation attributes and target user information, thereby realizing unified authentication and management of user identities in different project platforms; whether the project operation is a risky operation is identified based on the operation attributes and target identity, and targeted risk processing is performed for cases confirmed as risky operations, ensuring the effective recording and management of cross-platform user behavior, being able to accurately process the user's risky operations, and taking timely measures when risky project operations are detected, thereby ensuring the security and reliability of each project platform management system. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 It is a schematic diagram of the system architecture of a project system front end provided by an embodiment of this specification; Figure 2 is a flow chart of a risk handling method provided by an embodiment of this specification; Figure 3 It is a schematic diagram of button configuration rules for operating exemption permissions in a risk handling method provided in an embodiment of this specification; Figure 4 It is a schematic diagram of the structure of a technical support plug-in provided by an embodiment of this specification; Figure 5 It is a schematic diagram of the process of initializing a technical support plug-in in a risk handling method provided by an embodiment of this specification; Figure 6 It is a process flow chart of a risk handling method provided by an embodiment of this specification; Figure 7 is a schematic diagram of a structure of a target component provided by an embodiment of this specification; Figure 8 It is a structural diagram of a project front-end system provided by an embodiment of this specification; Fig. 9 It is a structural diagram of a target component and a target sub-component in a project front-end system provided by an embodiment of the present specification; Fig.10 It is a schematic diagram of the structure of a cloud system provided by an embodiment of this specification; Fig.11 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0009] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0010] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0011] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0012] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0013] First, the terms involved in one or more embodiments of this specification are explained.

[0014] Extensible Markup Language: Extensible Markup Language (XML) is a simple, platform-independent text format for storing and transmitting data that allows users to define their own tags to describe the structure and meaning of data.

[0015] Hypertext Markup Language: Hypertext Markup Language (HTML) is a standard markup language used to create web pages, define the structure and content of web pages, and is often used with JavaScript to build interactive Internet pages.

[0016] XML Path Language: XML Path Language (XPath) is a language used to locate and select nodes in XML or HTML documents, using path expressions to select specific elements, attributes, or text.

[0017] Document Object Model: Document Object Model (DOM) is a programming interface used to represent and manipulate the structure of HTML and XML documents. It represents documents as node trees, allowing developers to dynamically access and modify document content through programming languages.

[0018] Markov Chain Model: The Markov Chain Model is a random process model in which the state of the system at any given time depends only on the previous state and has nothing to do with earlier states. It is often used to predict the behavior of sequence data.

[0019] Hash algorithm: A hash algorithm is an algorithm that maps data of arbitrary length to a fixed-length value (hash value). It is widely used in data indexing, cryptography, and data integrity checking.

[0020] With the development of science and technology, the popularization of enterprise informatization and digital application platforms has made cross-platform user behavior management an important demand. At present, the user behavior management technology mainly relies on the identity authentication and permission control system independently configured in each project platform. Users log in to multiple project platforms separately, and then each project platform system only records the user's operation log on the project platform, and provides basic risk handling functions by configuring complex permission rules. At the same time, in order to enhance security, multi-factor authentication will be used to verify the user's identity when logging into the project platform.

[0021] However, although these technologies have guaranteed security and compliance to a certain extent, they still have some limitations in practical applications. The control systems of each project platform are different, and the configuration and maintenance are relatively complex, requiring the support of professional technical personnel; at the same time, the interoperability between different platforms is poor, which leads to serious information island phenomenon and affects the overall management efficiency.

[0022] In actual applications, when users log in to each project platform through the project system front end, they need to use different user information to log in for different project platforms. In this case, they can only rely on the complex permission rules configured in each project platform to provide basic risk management functions. Once the user changes the project platform or performs operations across project platforms, the user operation monitoring and risk management will be lost. In response to the above problems, this manual adopts the architecture of setting target components in the project system front end to solve them. See Figure 1 , Figure 1 A schematic diagram of the system architecture of a project system front end provided according to an embodiment of this specification is shown. Figure 1 As shown: By setting the target component in the front end of the project system, when the user logs in to each project platform according to the front end of the project system and performs project operations, the user's project operations are acquired and risks are handled through the target component. Since the target component is set at the front end of the project system, it will not affect the original functions or architectures of each project platform, and will not be restricted by the non-intercommunication of configurations between project platforms. It realizes the acquisition and risk handling of users' cross-platform operations and ensures the security and reliability of the project system.

[0023] Corresponding to the architecture of the above-mentioned project system, especially corresponding to the target component, this specification provides a risk management method. One or more embodiments of this specification also involve a target component, a project system front end, a computing device, a computer-readable storage medium and a computer program product, which are described in detail one by one in the following embodiments.

[0024] See also Figure 2 , Figure 2 A flow chart of a risk management method provided according to an embodiment of the present specification is shown. The method is applied to a target component of a project system front end. The target component records the user's identity. The identity is generated by the project system front end calling the target component to collect user information in each project platform. The method specifically includes the following steps. Step 202: Receive a project operation of a target user, wherein the project operation carries operation attributes and target user information of the target user.

[0025] The project system front end is the part of the software or website used by the project system to interact directly with users or administrators. For example, the project system front end can be a browser, an application or a small program, etc., which can be applied to a personal computer, a server, a mobile device, etc. Exemplarily, in a cloud computing environment, the project system front end can be an Internet application program interface deployed in the cloud.

[0026] The target component is a small module or plug-in used in the front end of the project system to implement specific functions or perform specific tasks. The target component can be an independent functional unit or a component integrated into a larger system. For example, the target component can be an extension plug-in in a web page, such as an ad blocking plug-in, an information collection plug-in, a security protection plug-in, etc. For example, in a cloud computing environment, the target component can be a cloud security plug-in used to protect the security of Internet applications in the cloud, or a database plug-in used to provide different data in a cloud development platform, etc.

[0027] Project platforms are different project systems or service platforms in a project system. Each project platform can run independent applications or different ports of the same application. Each project platform is managed by the project system and serves the project system together. For example, in a cloud computing environment, a project platform can be different independent but interrelated service platforms in a cloud service, such as a cloud storage platform, a cloud development platform, etc.

[0028] User information refers to the user's information on each project platform, including the user's registration information, login account, user name and other information on each project platform. User information corresponds to each project platform. The user information of the same user on different project platforms may be the same or different. Identity identification refers to the unique information or unique code used to identify and distinguish different users, which is generated uniformly by the project system front end calling the target component and collecting the user's user information on each project platform in the project system through the target component. In different systems and technical environments, identity identification can take a variety of forms, depending on the system's security requirements, technical implementation, and application scenarios. Generating a user's identity based on the user information on each platform can ensure that each user's project operations on each project platform in the project system front end can be accurately identified and recorded, achieving consistent identity authentication across project platforms or multi-device environments.

[0029] Project operations are specific behaviors or actions performed by the target user on the project platforms in the front end of the project system. Project operations can be any type of interactive activities, such as clicking a button, submitting a form, entering text, uploading a file, etc. The target user's project operation will carry the operation attributes of the project operation and the user information of the target user. Operation attributes are a set of parameters or metadata passed along with the project operation, which are used to describe the specific details of the project operation. Operation attributes can include data such as the specific type of the project operation, the timestamp of the project operation, and the object of the project operation.

[0030] Receiving the project operation of the target user may be performed by the target component of the project system front end. For example, in a cloud computing environment, the project operations (such as data upload operations) performed by the user on various project platforms (such as the cloud service end platform) of the cloud service application may be received by the risk identification component installed on the browser of the cloud service application.

[0031] In this step, the project operations of the target user are accurately captured and recorded, so that each project operation in the front end of the project system can be accurately identified and associated with the target user, providing a data basis for subsequent target identity identification, project operation analysis, audit tracking and risk anomaly detection.

[0032] Step 204: Determine the target identity of the target user based on the target user information.

[0033] After receiving the target user information carrying the operation attribute and the target user, the target identity of the target user can be determined according to the target user information.

[0034] Specifically, the target component may compare the collected target user information with the user information in each project platform that the target component has collected, and determine the target identity identifier of the target user information from the generated identity identifiers.

[0035] In this step, accurate identification and unified management of the target user's identity are ensured. Even if the target user operates on multiple project platforms in the project system, consistent identity authentication can be maintained, which enhances the security of the system and prevents unauthorized access. At the same time, it provides a data basis for subsequent risk identification and risk processing.

[0036] Step 206: Identify whether the project operation is a risky operation based on the operation attributes and the target identity.

[0037] Risky operations are those that may have a negative impact on system security, data integrity, or project process continuity. Risky operations usually involve the processing of sensitive information, modification or deletion of key resources, etc., and have high potential risks.

[0038] Risky operations may include but are not limited to: the target user performs project operations beyond the operation permissions corresponding to his or her own identity identification, for example, a target user who does not have data modification permissions attempts to modify data uploaded to the project platform, or a target user who does not have privacy information viewing permissions attempts to view privacy information, etc.; the target user performs project operations that do not conform to standard operation attributes, for example, in the standard operation of directly downloading data, a project operation of first modifying the data and then downloading it is performed, or in the standard operation of a project that requires data to be submitted for subsequent processes, the project operation of directly proceeding to the subsequent process without submitting the data; the target user performs project operations that exceed the threshold specified by the standard operation attributes, for example, in the project operation of making payments or transferring funds, the amount of funds paid or transferred exceeds the preset risk amount threshold, or the target user repeatedly performs project operations that exceed the preset risk number threshold, such as repeated logins, repeated data submissions, etc.

[0039] According to the operation attributes and the target identity, it is identified whether the project operation is a risk operation. Specifically, when the target identity has the operation authority corresponding to the project operation, it is possible to compare the various data included in the operation attributes with the preset standard operation attributes to determine whether the operation attributes are outside the preset standard operation attributes, thereby identifying whether the project operation is a risk operation; it is also possible to determine whether the project operation is a project operation specified in the operation authority according to the operation authority corresponding to the target identity when the operation attributes belong to the preset standard operation attributes, thereby identifying whether the project operation is a risk operation; it is also possible to identify whether the project operation is a risk operation based on a combination of the operation attributes and the target identity based on preset risk identification rules or standards. The embodiments of this specification do not make specific limitations on this.

[0040] In this step, by identifying whether the target user's project operation is a high-risk behavior that exceeds their authority, does not comply with standard procedures, or exceeds preset thresholds, corresponding risk processing can be performed for risky operations, thereby protecting system security, maintaining data integrity, and ensuring project process continuity, thereby enhancing system security and providing a solid foundation for compliance management and auditing.

[0041] Step 208: When the project operation is a risky operation, risk management is performed on the project operation.

[0042] Risk management refers to taking a series of measures to mitigate or eliminate the negative impact that may be caused by a project operation after it is identified as a risky operation. Risk management can protect the security of the system, data integrity, and continuity of project processes, etc., to ensure the normal operation of the system or avoid the loss of the actual rights and interests of users. The risk management method can be flexibly set according to different project platforms, different risk types, etc.

[0043] Optionally, risk handling can be blocking project operations, that is, directly blocking the current project operations to prevent the project operations from continuing; or warning project operations, that is, generating a warning message for the current project operations, and displaying the warning message to the target user or the project system administrator and requesting confirmation; or both blocking the current project operations and generating a warning message to display to the target user or the project system administrator, and the target user can request permission or authority for the project operation from the project system administrator based on the warning message, and continue to perform the project operation after the project system administrator authorizes it, or close the project operation after the project system administrator does not authorize it. This specification does not make specific limitations on this.

[0044] In the embodiments of the present specification, the user's identity is recorded by the target component of the project system front end, and when receiving the project operation of the target user, the target identity is determined based on the carried operation attributes and target user information, thereby realizing unified authentication and management of user identities in different project platforms; whether the project operation is a risky operation is identified based on the operation attributes and the target identity, and targeted risk processing is performed for situations confirmed as risky operations, thereby ensuring the effective recording and management of cross-platform user behaviors, being able to accurately process the user's risky operations, and taking timely measures when risky project operations are detected, thereby ensuring the security and reliability of each project platform management system.

[0045] In an optional embodiment of the present specification, the risk management method further includes: In response to the initialization request, when the project system front end logs in to each project platform, the operating environment of the project system front end is identified, and the user information in each project platform and the project platform identification of each project platform are obtained; the correspondence between the user information in each project platform and the project platform identification of each project platform is determined; based on the user information in each project platform, the project platform identification of each project platform and the correspondence, an identity identification of each user in each project platform is generated.

[0046] The initialization request is a request sent to the project system when the target component is first installed or activated in the project system front end, and is used to initialize the target component to ensure that the target component can be correctly configured and start working normally. In this embodiment, in addition to the conventional steps of requesting user consent and authorization for installation to establish a secure connection and service functions, the initialization request also includes a request to identify the operating environment of the project system front end and collect user information from each project platform logged in to the project system front end. The operating environment is the environment in which the project system front end runs, including but not limited to information such as the operating system type, browser or application version, and logged-in project platform identifier of the project system front end. Identifying the operating environment helps to ensure the compatibility of the target plug-in on the project system front end and the integrity and accuracy of the generated identity.

[0047] The correspondence refers to the mapping between user information in each project platform and the identifier of each project platform. Specifically, the correspondence refers to how each user's account information on different project platforms is associated with a specific platform identifier. The determination of the correspondence allows the same user to be managed and tracked under a unified framework even if they have different forms of identity information on multiple project platforms.

[0048] After receiving the initialization request, you need to log in to each project platform at the front end of the project system before you can continue with the subsequent steps. If the project system front end has not logged in to the project platform, the user information in the project platform and the project platform identifier of the project platform cannot be collected.

[0049] When it is determined that the project system front end logs in to each project platform, the project platform identifier of each project platform and the user information in each project platform can be obtained by identifying the operating environment of the project system front end, and the corresponding relationship can be determined based on this. Optionally, the collection of user information can be automatically identified and obtained by the target component; or the user can be guided to enter user information by displaying information collection prompt information and input windows, which is not specifically limited in the embodiments of this specification.

[0050] After determining the corresponding relationship, the identity of each user in each project platform can be generated according to the user information in each project platform, the project platform identifier of each project platform and the corresponding relationship. Specifically, the method for generating the identity can select different methods according to the actual application scenario or demand. One optional method is to generate it through a hash algorithm. The hash algorithm is a method that uses a cryptographic hash function (such as SHA-256 (Secure Hash Algorithm 256-bit) function) to process user information (user name, email address, timestamp, etc.) and project platform identifier to generate a fixed-length string as an identity; another optional method is to generate it through a globally unique identifier (GUID for short). GUID technology is a 128-bit unique identifier technology that can ensure uniqueness worldwide without relying on central server allocation. It generates a fixed 128-bit identifier based on user information and project platform identifier as an identity.

[0051] In the embodiments of this specification, by generating a unique identity, unified collection, authentication and management of user information across platforms is achieved, the security and integrity verification of the identity is enhanced, and tampering and forgery of collected user information and other data are prevented, thereby improving the overall security, reliability and compliance of the system and ensuring the secure transmission and storage of user identities.

[0052] In an optional embodiment of the present specification, after generating the identity of each user in each project platform based on the user information in each project platform, the project platform identifier of each project platform and the corresponding relationship, it also includes: The identity is encrypted to generate a digital signature; correspondingly, after determining the target identity of the target user based on the target user information, it also includes: verifying whether the digital signature of the target identity is consistent with the digital signature of the identity corresponding to the target user information in the target component.

[0053] After generating the identity of each user in each project platform, encrypting it and generating a digital signature can further enhance security and integrity verification. Specifically, encryption can be performed by the management system of the project system, and can be achieved by combining public / private key pair technology and hash algorithm, which can prove that the file or message has not been tampered with and is indeed signed by the claimed sender. That is, after obtaining the identity through the hash algorithm, the identity can be sent to the management system of the project system, and the management system uses the public key to encrypt the identity, obtain the encrypted identity, that is, the digital signature, and return it to the target component; after determining the target identity based on the target user information, the target component can decrypt the digital signature corresponding to the target identity according to the corresponding private key, and match it with the identity calculated according to the target user information to verify whether the determined target identity is correct, that is, whether the identity has not been tampered with and is indeed from a legitimate source.

[0054] Exemplarily, the project system front end includes project platforms identified as project platform A and project platform B. The user information of the target user x in project platform A is user name 001 and password XXX, and the user information in project platform B is 002 and password YYY. Then, the corresponding relationship determined by the target component is A-001-XXX, B-002-YYY, and the identity identification of the target user x is generated as X. In the target component, X represents the user name 001 in project platform A and the user name YYY in project platform B. Therefore, no matter the target user x performs project operations in project platform A with the user name 001 or in project platform B with the user name 002, the target component can represent the target user x with the identity identification X.

[0055] In the embodiments of this specification, by encrypting the identity and generating a digital signature, the reliability of user identity authentication and the security of cross-platform operations are improved, the authenticity and traceability of user behavior are ensured, and the risks of identity fraud and data tampering are effectively prevented, thereby improving the overall security, reliability and compliance of the system.

[0056] In an optional embodiment of the present specification, identifying whether a project operation is a risky operation according to the operation attribute and the target identity includes: Based on the operation attributes and the target identity, it is determined whether the target user has the operation authority for the project operation; if not, the project operation is determined to be a risky operation.

[0057] Operation permissions refer to the rights or authorizations of target users to perform certain operations on the project platform. Operation permissions can be configured by the administrator of the project system according to different identity identifiers to ensure that only authorized users can perform sensitive or critical operations. Operation permissions can be subdivided into various types, such as data read and write permissions, data modification permissions, command execution permissions, etc. Data read and write permissions can include permissions on whether data can be read and written, the method and number of data read and written; data modification permissions include permissions on whether data can be modified, the number of data modifications, the scope of data to be modified, etc.; command execution permissions include permissions on whether a certain command can be executed, etc.

[0058] Specifically, based on the operation attributes and the target identity, identifying whether the target user has the operation authority for the project operation can be achieved through the following methods: The operation attributes are obtained from the project operation, and the operation attributes include data such as the specific type of the project operation, the timestamp of the project operation, and the object of the project operation. Optionally, the operation attributes can be divided at different granularities, for example, the target user performs a certain type of project operation (such as submitting data), the target user performs a certain step in a certain type of project operation (such as the "upload data to be submitted" step in the submit data project operation), and the target user performs a certain step in a certain type of project operation by operating a specific element (such as clicking the "Submit" button to perform the upload data to be submitted step in the submit data project operation).

[0059] Determine the target identity, that is, determine the target identity according to the target user information carried in the project operation as described in the above embodiment. The specific implementation method has been described in the above embodiment and will not be repeated here.

[0060] Identification is performed based on preset permission rules. Preset permission rules are rules based on pre-configured permission identification, which can be configured by the administrator of the project system or automatically generated by the project system based on historical data. The preset permission rules determine the permission ranges of the operation attributes that different identity identifiers have for project operations. The corresponding permission range in the preset permission rules can be determined based on the target identity identifier, and then it is determined whether the operation attribute belongs to the operation attribute specified in the permission range, thereby realizing the identification of whether the target user has the operation authority for project operations.

[0061] After completing the identification of whether the target user has the operation authority for the project operation, it can be determined whether the project operation is a risky operation based on the identification result. Specifically, if the authority corresponding to the target identity of the target user does not correspond to the operation attribute of the project operation in the authority scope corresponding to the target identity of the target user, it can be judged that the project operation is a risky operation.

[0062] Exemplarily, the target user x performs a project operation of "data writing operation", and the operation attribute of the project operation is "performing the step of uploading the data to be written in the data writing operation by clicking the 'Upload data' button". Then, based on the preset permission rules, the operation permission for the "data writing operation" possessed by the target identity X of the target user x is queried and it is found that "the target identity X does not have the permission for the data writing operation". Then, the "data writing operation" is judged to be a risky operation.

[0063] In the embodiments of this specification, through accurate identification of user operation permissions, it is ensured that only target users with operation permissions for project operations can perform sensitive operations, effectively preventing security risks caused by unauthorized project operations, enhancing the overall security of the system, data integrity and flexibility of permission management, while supporting permission configuration requirements for different application scenarios, and improving the flexibility of risk identification for project operations.

[0064] In an optional embodiment of the present specification, based on the operation attribute and the target identity, identifying whether the target user has the operation authority for the project operation includes: According to the operation attributes, the predicted operation attributes of the predicted project operation of the target user at the target time are determined; when the target identity identifier and the operation attributes and the predicted operation attributes all have authority matching, it is determined that the target user has the operation authority for the project operation.

[0065] The target time is the time point predicted by the target component, which can be a few seconds, minutes, or other time intervals in the future. The selection of the specific target time depends on the specific needs of the application scenario.

[0066] Determining the predicted operation attribute of the predicted project operation of the target user at the target time according to the operation attribute is to analyze the operation attribute of the project operation of the user currently received, and predict the predicted operation attribute of the predicted project operation of the target user at the target time according to the analysis result. Among them, the analysis of the operation attribute of the project operation of the received user can be based on a variety of methods, for example, using a Markov chain model, a deep learning neural network, a time series analysis model, etc.

[0067] The predicted operation attributes of the predicted project operation have the same parameters as the operation attributes of the received project operation, ie, the specific type of the predicted project operation, the timestamp of the predicted project operation, the object of the predicted project operation and other data.

[0068] According to the target identity, the operation attributes, and the predicted operation attributes, whether the permissions match is determined, that is, according to the preset permission rules, whether the operation attributes of the acquired project operation and the predicted operation attributes of the predicted project operation at the target moment belong to the operation permissions corresponding to the target identity at the current moment and the operation permissions corresponding to the target moment. If so, it is determined that the target user has the operation permissions for the project operation.

[0069] For example, the target user x performs the project operation of "data writing operation" at 11:20 in the morning, and the operation attribute of the project operation is "performing the step of uploading the data to be written in the data writing operation by clicking the 'Upload data' button". Then, the state transition matrix in the Markov chain model is used for analysis, and the predicted operation attribute of "clicking the 'Upload data' button" is "clicking the 'Submit data' button". The interval click time is within 1 minute, so it can be predicted that the predicted operation attribute of the target user x at the target time 11:21 is "clicking the 'Submit data' button". Then, based on the preset permission rules, it is determined that the target identity X of the target user x has the operation permission of "clicking the 'Upload data' button in the data writing operation" at the current time 11:20, and the operation permission of "clicking the 'Submit data' button in the data writing operation" at the target time 11:21, then it is determined that the target user x has the operation permission of the data writing operation, and the data writing operation is not a risky operation.

[0070] In the embodiments of this specification, real-time and forward-looking evaluation of user operation permissions is implemented, which can predict and identify the further operations of the target user in advance, and determine whether there are risks, so as to perform corresponding risk management, thereby ensuring that only authorized operations are performed, enhancing the security and data integrity of the project system, and effectively preventing the occurrence of unauthorized or high-risk behaviors.

[0071] In an optional embodiment of the present specification, before identifying whether the target user has the operation authority for the project operation based on the operation attributes and the target identity, it also includes: identifying whether the project operation has exemption authority; identifying whether the target user has the operation authority for the project operation based on the operation attributes and the target identity, including: if the project operation does not have exemption authority, identifying whether the target user has the operation authority for the project operation based on the operation attributes and the target identity.

[0072] Exempt permissions refer to certain specific operations or behaviors that are pre-set by the system to be executed without regular permission verification, usually because these operations are considered low-risk, frequent, or have little impact on system security and data integrity. In this case, the project operation with exempt permissions will not be judged by the target component for operation permissions.

[0073] The setting of exemption authority can be set according to the operation attributes and actual needs of different project operations. Optionally, it can be set for low-risk or no-risk operation attributes, for example, clicking buttons for general operations such as expand and return, viewing page descriptions, page navigation and other general information, etc.; it can also be set for certain repeated operation attributes, for example, repeated page refresh operations that require real-time acquisition of certain information, etc.; it can also be set manually, for example, the administrator of the project system configures exemption authority for the operation attributes of certain specific project operations. The embodiments of this specification do not make specific limitations on this.

[0074] Before the target component identifies the operation permissions for the target user's project operation, it will first identify whether the project operation has exemption permissions. If the project operation has exemption permissions, the target component will not make subsequent operation permission judgments on the project operation, that is, it will not identify risks for project operations with exemption permissions.

[0075] For example, the target user x performs the project operation of "view page navigation" and the operation attribute is "click the 'view' button". It is identified that the project operation of "view page navigation" has exemption authority, so the subsequent operation authority identification is not performed on the project operation.

[0076] In the embodiments of this specification, by introducing exemption permissions and judging whether a project operation has exemption permissions, the permission management process is simplified and the system efficiency and user experience are improved.

[0077] In an optional embodiment of the present specification, the exemption authority includes the identity exemption authority; identifying whether the project operation has the exemption authority includes: based on the target identity identifier, identifying whether the target user has the identity exemption authority.

[0078] Exempt permissions can include identity exemption permissions. Identity exemption permissions refer to exemption permissions based on user identities, that is, certain specific users or user groups are pre-set by the target component to perform certain operations without the need to undergo regular operation permission verification. Identity exemption permissions allow users with specific identities to bypass the standard operation permission check process and directly perform project operations. Identity exemption permissions can be set for users with a sufficient level of trust, or for users whose operations have little impact on system security and data integrity, or can be set manually.

[0079] Identifying whether the target user's project operation has exemption authority can be done by identifying whether the target user has identity exemption authority. Specifically, after obtaining the target identity identifier of the target user, it can be determined whether the target identity identifier is an identity identifier with identity exemption authority, for example, through a preset list of identity exemption authorities or based on the category of the target identity identifier.

[0080] Exemplarily, when the target user y performs a project operation of a "data modification operation", the target component recognizes that the target identity Y of the target user y belongs to the "administrator identity" category before identifying the operation authority for the "data modification operation". This category of identity has identity exemption authority, and therefore the target user y can directly perform the project operation of the "data modification operation", without determining the operation authority for the target user y's "data modification operation".

[0081] In the embodiments of this specification, by introducing an identity exemption permission mechanism, the permission management process is simplified, resource utilization and operation response speed are optimized, and system efficiency and user experience are improved.

[0082] In an optional embodiment of the present specification, the exemption authority also includes operation exemption authority; and the risk handling method also includes: In the case that the target user does not have identity exemption permissions, whether the project operation has operation exemption permissions is identified based on the operation attributes.

[0083] Exempt permissions can also include operation exemption permissions. Operation exemption permissions refer to operation attributes based on specific project operations. The operation attributes are pre-set in the target component so that the corresponding project operations can be performed without operation permission verification. Operation exemption permissions allow certain types of low-risk or no-risk project operations to bypass the operation permission check process and be executed directly. Operation exemption permissions can be set according to the type of operation attribute or manually.

[0084] Optionally, the operation exemption authority can be set according to the finest granularity of the operation attribute. The finest granularity of the operation attribute is the button on the front end of the project system that is clicked. The target component can collect and configure all buttons on the front end of the project system, and then the administrator of the project system can flexibly configure the operation exemption authority with different judgment criteria for different project scenarios, project types, etc. based on the collected and configured buttons.

[0085] The target component collects and configures all buttons on the front end of the project system in a variety of ways, such as using XPath language configuration, configuring through CSS selectors (Cascading Style Sheets Selectors), etc. This specification does not make specific limitations on this.

[0086] Take XPath as an example. XPath is a language used to locate elements in XML documents or HTML documents. Nodes or node sets can be selected through path expressions.

[0087] Specifically, the DOM identification module included in the target component can be used to detect the buttons on the front end of the project system through MutationObserver to obtain the DOM nodes mounted by all buttons. Among them, the document object model DOM is used to represent and manipulate the structure of HTML documents and XML documents, and represents the document as a node tree. MutationObserver is a JavaScript interface used to monitor changes in the DOM node tree, trigger a callback function when any button is added, deleted, or has its attributes changed, and dynamically configure and load these buttons.

[0088] All buttons are configured through XPath, such as button name (id), class name (class) or tag (tag), for example, through field selection such as ".next-btn", ".ant-btn", ".tri-btn" and "a", among which ".next-btn", ".ant-btn" and ".tri-btn" represent buttons with class names of "next button", "any button" and "third-level button", and "a" represents buttons with the "a" tag.

[0089] By using XPath to configure buttons, you can automatically collect buttons in the project system front end through the target component, or you can collect them manually by clicking the mouse on the project system front end.

[0090] After obtaining all buttons on the project system front end through XPath, you can configure corresponding operation exemption permissions based on these buttons. For details, see Figure 3 , Figure 3 A schematic diagram of button configuration rules for operating exemption permissions in a risk handling method provided according to an embodiment of this specification is shown, such as Figure 3 As shown, buttons with operation exemption permissions may include the following categories: Category 1: Configuration through DOM selectors, such as menu and table paging module buttons. The configured DOM selectors can be ".teamix-pro-pagination-wrapper.next-btn" and ".next-menu-btn.next-btn".

[0091] Category 2: By configuring the whitelist text, for example, if the button ID includes corresponding keywords, such as "details, collapse, expand, return, reset, cancel" and other keywords.

[0092] Category 3: Text regular expression matching exemptions, for example, resource data displayed and clickable in some view pages (such as ECS data in the ASCM-ECS page).

[0093] Category 4: Manual configuration by the administrator, that is, buttons that require human judgment and are not easily configured or described by the above methods, such as clicking the instance name button on the list page (such as the jump to details button), the remote connection and management buttons in the operation bar of the ASCM-ECS list, etc.

[0094] Exemplarily, the target user x performs the project operation of "data modification operation". Before the target component identifies the operation permission of the "data modification operation", it identifies that the target identity X of the target user x does not belong to the category with identity exemption permission. In this case, the "data modification operation" does not have identity exemption permission. Therefore, it is necessary to further identify whether the "data modification operation" has operation exemption permission based on the operation attribute. If the operation attribute corresponding to the "data modification operation" is "click the 'Expand' button in the data modification part to expand the data table to be modified", it is judged that the button 'Expand' corresponding to the operation attribute has operation exemption permission. The target user x can directly execute the project operation of the "data modification operation" with the operation attribute of "clicking the 'Expand' button" without making a judgment on the operation permission.

[0095] In the embodiments of this specification, by introducing an operation exemption permission mechanism, the permission management process is simplified, resource utilization and operation response speed are optimized, and system efficiency and user experience are improved.

[0096] In an optional embodiment of the present specification, when the project operation is a risk operation, risk processing is performed on the project operation, including: When the project operation is a risk operation, determine the risk level of the project operation; based on the risk level, perform corresponding risk treatment on the project operation.

[0097] Risk level refers to the result of classifying and evaluating project operations based on factors such as the potential impact, complexity, and possible security threats of project operations. Risk levels can usually be divided into low risk, medium risk, and high risk according to the degree of risk, or into warning level, blocking level, etc. according to the type of risk. Different risk levels can correspond to different risk handling strategies.

[0098] The determination of the risk level can be done in a variety of ways, for example: a series of risk level identification rules can be pre-set in the target component, and risk scores of different dimensions can be performed based on the operational attributes of the project operation to determine the risk level of the project operation; it can also be analyzed based on historical data, and the risk level of the current project operation can be determined by analyzing the risk level records of project operations that are the same or similar to the project operation in the historical data; it can also be defined manually, that is, for some more complex project operations or project operations that may have different risk levels in different scenarios, they can be manually configured by administrators or security technicians. The embodiments of this specification do not make specific limitations on this.

[0099] When a project operation is determined to be a risky operation, it is necessary to determine the risk level of the project operation and then perform corresponding risk management on the project operation based on the risk level.

[0100] Specifically, different risk treatments can be adopted for different risk levels. For example, for low-risk project operations, only low-risk information needs to be recorded and the operations can be directly executed; for medium-risk project operations, warning information needs to be displayed and secondary confirmation or verification is required; for high-risk project operations, the project operations will be directly intercepted and authorization of higher project operation permissions will be requested.

[0101] Exemplarily, the target user x performs a project operation of "data writing operation", and the operation attribute of the project operation is "performing the step of uploading the data to be written in the data writing operation by clicking the 'Upload data' button". Then, based on the preset permission rule, the operation permission for the "data writing operation" possessed by the target identity X of the target user x is "the target identity X does not have the permission for the data writing operation", and the "data writing operation" is judged to be a risky operation; the risk level of the "data writing operation" is determined, and according to the preset risk level identification rule, the risk level of the project operation that does not have the corresponding operation permission is determined to be a high risk level, and the "data writing operation" is directly intercepted, and a request is made to the target user x for authorization of a higher operation permission.

[0102] In the embodiments of this specification, by introducing a risk handling mechanism, not only can targeted risk handling be performed for risk operations of different risk levels, thereby improving the flexibility and compatibility of the project system, but also the overall security of the project system is improved, ensuring that high-risk operations are strictly controlled, optimizing operating procedures, and enhancing the traceability and transparency of the system, thereby effectively improving security and user experience.

[0103] In an optional embodiment of the present specification, the risk level includes a warning level and a blocking level; according to the risk level, corresponding risk processing is performed on the project operation, including: When the risk level is a warning level, warning information of the project operation is displayed; when the risk level is a blocking level, the project operation is blocked and the blocking information of the project operation is displayed.

[0104] Warning-level risk level means that the project operation has certain risks, but it is not enough to immediately prevent the operation from being executed. Such operations usually need to attract the user's attention and perform additional confirmation or verification. For example, when performing a payment operation, the project operation of "clicking the payment button" is not a risky operation, but if the corresponding "payment amount" exceeds the preset safety threshold, that is, exceeds the normal payment amount limit, the user will be displayed a warning message for the payment operation, and the payment operation will continue after the user confirms it.

[0105] The blocking risk level indicates that the project operation has a high risk and may have a serious impact on system security, data integrity or project process. Therefore, the system will directly block the operation and display the blocking information to the user. The blocking information may include the blocked project operation, the reason for the blocking, whether to request a higher operating authority, etc.

[0106] For example, when performing a data deletion operation, "clicking the 'data deletion' button" is a risk operation with a blocking risk level, that is, the data deletion operation is blocked and the blocking information "'Data deletion operation' is blocked. The blocking reason is 'Insufficient target user operation authority'. Do you want to request authorization for the 'data deletion operation'?" is displayed.

[0107] Optionally, when blocking the project operation of the blocking level, it can be done through event.stopPropagation() and event.preventDefault(). Among them, event.stopPropagation() and event.preventDefault() are methods in JavaScript. event.stopPropagation() is used to prevent event bubbling, that is, to prevent the current event from further propagating in the DOM tree; event.preventDefault() is used to prevent the default behavior, that is, to prevent the original event from performing the default operation, such as the behavior originally performed by clicking the button. Specifically, the target component will set the listener for the collected and configured buttons through button.addEventListener. button.addEventListener is also a method in JavaScript. Its advantage is that it allows multiple event listeners to be added without overwriting existing event handlers. In actual applications, when the user clicks a button during a project operation, the listening event configured by the target component will be triggered first. If event.stopPropagation() and event.preventDefault() are executed, the default event originally defined for the button clicked in the project operation will be blocked.

[0108] Optionally, after the administrator of the project system receives the operation permission request information included in the blocking information, the authorization module can be used to authorize the request information. After receiving the corresponding authorization information, the target component can release the target user to continue to perform the project operation. Among them, the authorization request for operation permissions can be implemented through the idea of ​​symmetric encryption. The essence of the authorization module is a codec, that is, the authorized content (such as operation permissions), authorization validity period and other information are encrypted on the administrator side, and the encrypted information is decrypted on the target component side. After obtaining the corresponding authorization information, the project operation can be released. The administrator is responsible for keeping the encryption algorithm confidential, thereby ensuring the authenticity and validity of the authorization information.

[0109] Exemplarily, when the target user x performs a project operation of "data writing operation", and the target identity X does not have the operation authority of the "data writing operation", the "data writing operation" is judged to be a risky operation; further, according to the preset risk level identification rule, the "data writing operation" for which the corresponding operation authority is not possessed is determined to be a blocking risk level, and the "data writing operation" is blocked, and a blocking message "Blocking 'data writing operation', blocking reason is 'insufficient operation authority of target user', do you request authorization for the operation authority of 'data writing operation'?" is displayed to the target user x; after the target user x determines to request the operation authority of the "data writing operation" and sends a request message, the administrator of the project system authorizes the corresponding operation authority for the request message, and the target component, upon receiving the authorization information, allows the target user x to perform the "data writing operation".

[0110] In the embodiments of this specification, by introducing warning and blocking risk level classifications, when the target component identifies a project operation as a risky operation, it takes different treatment measures according to its risk level. This not only enables corresponding risk treatment for different risk levels, thereby improving the flexibility and compatibility of the project system, but also improves the security of the project system, preventing high-risk operations from affecting system security, data integrity and project processes, thereby ensuring the safe execution of key operations and enhancing user experience and operational transparency.

[0111] In an optional embodiment of the present specification, when the project operation is a risk operation, after the risk processing of the project operation is performed, the following is further included: Collect context information of the project operation and the operation status of the target component; and generate the operation result of the project operation based on the context information and the operation status.

[0112] The context information of a project operation refers to the environment and background data related to the project operation, which provides detailed information about the project operation. This information helps to fully understand the background of the project operation and provide support for subsequent analysis and decision-making. For example, context information can include: identity information, operation timestamp, operation running environment, operation object, etc.

[0113] The operation status of the target component is the status information of the target component during the project operation. The operation status reflects whether the target component is working normally and the resource usage of the target component. The operation status may include: the running status of the target component, the resource utilization rate of the target component, etc.

[0114] The operating status of the target component can be detected by the status detection module. Specifically, the status detection module can detect the operating status of the target component through a heartbeat mechanism, abnormal monitoring (for example, the target component is closed, uninstalled, etc.), etc., to avoid bypassing the target component and performing project operations on various project platforms directly on the front end of the project system.

[0115] Specifically, the context information of project operations can be collected through the following methods: 1. When the target user performs project operations, each click of the button will be regarded as an operation event and captured by the target component; 2. Whenever an operation event is generated, the relevant information of the operation event (such as timestamp, operation type, keywords, operating environment information, and risk information) will be packaged into a message and cached through the message queue inside the target component; 3. Record the status of the operation event, such as whether the project operation is completed if it is not a risk operation, and how the risk is handled if it is a risk operation, and collect the operation events of the button clicks of the project operation into the data storage area of ​​the target component; 4. When the target user completes all project operations, the target component can connect the user's project operations in series according to the timestamp, that is, the order in which the user clicks the button, to form a complete user operation path. That is, the collection of contextual information of the project operation is completed.

[0116] After the context information of the project operation is collected, the operation result of the project operation can be generated in combination with the operation status of the target component.

[0117] The operation results may include an indication of whether the project operation is successful, detailed information on the project operation, an impact assessment of the project operation, recommended measures for the project operation, and log information of the project system during the project operation.

[0118] For example, when the target user x performs a project operation of "data writing operation", if the target identity X does not have the operation authority of "data writing operation", the "data writing operation" is judged as a risk operation; further, according to the preset risk level identification rule, for the "data writing operation" that does not have the corresponding operation authority, it is determined to be a blocking risk level, and the "data writing operation" is blocked, and the blocking information "blocking 'data writing operation', blocking reason is 'insufficient operation authority of target user', do you request the operation authority authorization of 'data writing operation'?" is displayed to the target user x; if the target user x cancels the operation authority requesting "data writing operation", the project operation is deemed to be completed. Then the corresponding context information of the project operation is: "target identity X, operation timestamp **** year ** month ** morning 11:21, operation environment information is project platform A, operation type is data writing operation, operation result is operation failure...", and the operation status of the target component is: "operation status is normal, resource utilization is high..."

[0119] In the embodiments of this specification, detailed context information of project operations and the operating status of target components are collected through target components, and operation results are generated. This not only improves the transparency and traceability of the system, ensures that the background and execution of each operation are fully recorded, but also provides a data basis for subsequent analysis, auditing and improvement.

[0120] In an optional embodiment of the present specification, after generating the operation result of the project operation based on the context information and the operation status, the method further includes: Receive operation authority adjustment information, wherein the operation authority adjustment information is determined by an administrator at the front end of the project system based on operation results; and adjust the operation authority according to the operation authority adjustment information.

[0121] Operation permission adjustment information refers to the operation permission change instructions determined by the administrator of the project system front end based on the operation results (such as operation success or failure, impact assessment, etc.). Operation permission adjustment information may include increasing, decreasing or modifying the operation permissions of certain project operations corresponding to certain identity identifiers, and increasing, decreasing or modifying the risk level of certain project operations.

[0122] The operation permission adjustment information is determined by the administrator of the project system front end based on the operation result. Optionally, after the target component obtains the operation result, the operation result can be presented to the administrator through the visualization module of the target component. Specifically, the following contents can be displayed according to the operation result: 1. According to the target dimension of the project operation, provide information of different dimensions in the context of the project operation, such as the activity, operation frequency, interception ratio, etc. of the project operation, and the target component can clean and organize the context information according to the specified dimension.

[0123] 2. Convert the contextual information of project operations into easy-to-understand visualization forms, such as bar charts, pie charts, line charts, etc.

[0124] 3. Integrate the operation results into a visual report, attach corresponding explanations, and confirm whether the report is copied to the manager via email, fax, etc.

[0125] The administrator reviews the content of the displayed operation results through the visualization module of the target component, and evaluates the risk level of the risky operation based on the potential security risks or compliance issues included in the operation results, and takes corresponding management actions, such as inputting operation permission adjustment information to the target component and adjusting the operation permissions in the target component.

[0126] In the embodiments of this specification, by dynamically adjusting the operating permissions according to the operating permission adjustment information, the flexibility and response speed of permission management are enhanced, while the security and compliance of the system are improved, the adjustment efficiency of the operating permissions is improved, it is ensured that the setting of the operating permissions matches the project operations, the security and reliability of the project operations are improved, and the traceability and transparency of the project system are maintained.

[0127] The following combination Figure 4 To Attachment Figure 6 , taking the application of the risk handling method provided in this specification on the technical support plug-in on the browser page of the multi-project platform as an example, the risk handling method is further explained. Figure 4 A schematic diagram of the structure of a technical support plug-in provided according to an embodiment of this specification is shown. Figure 5 A schematic diagram of the process of initializing a technical support plug-in in a risk handling method provided according to an embodiment of this specification is shown. Figure 6 A process flow chart of a risk handling method provided by an embodiment of the present specification is shown.

[0128] like Figure 4 As shown: the technical support plug-in includes the presentation layer, function layer, data layer, and various project platforms managed by the plug-in. The presentation layer includes the visualization module, user interface, and open interface model; the function layer includes the abnormal behavior monitoring module, decision support module, identity identification module, authorization module, DOM identification module, and operating environment identification module; the data layer includes the permission configuration module, environment information module, and operation context module.

[0129] like Figure 5As shown, during the initialization process of the technical support plug-in, initialization begins first. The technical support plug-in identifies the operating environment and guides the user to collect user information of each project platform, and the user submits the user information; then the technical support plug-in generates a user identity based on the user information submitted by the user; then the technical support plug-in sends the generated identity to the management system, and the management system encrypts the identity, obtains a digital signature and returns it; subsequently, when the technical support plug-in interacts externally with the project platform, the project platform will request identity authentication from the technical support plug-in, and the technical support plug-in will add a digital signature to the information interacting with the project platform, and the project platform will verify the digital signature and return the interaction result.

[0130] like Figure 6 As shown: the risk handling method is applied to a technical support plug-in in a browser. The technical support plug-in responds to an initialization request, identifies the operating environment of the browser page when the browser page logs in to each project platform, and determines the correspondence between the user information in each project platform and the project platform identifier of each project platform; based on the user information in each project platform, the project platform identifier of each project platform and the correspondence, generates an identity identifier for each user in each project platform; the method specifically includes the following steps.

[0131] Step 602: Receive a project operation of a target user, wherein the project operation carries operation attributes and target user information of the target user.

[0132] Step 604: Determine the target identity of the target user based on the target user information; and identify whether the target user has identity exemption authority based on the target identity.

[0133] Step 606: In the case where the target user does not have identity exemption authority, based on the operation attributes, identify whether the project operation has operation exemption authority.

[0134] Step 608: In the case where the project operation does not have the exemption authority, the predicted operation attribute of the predicted project operation of the target user at the target time is determined according to the operation attribute.

[0135] Step 610: When the target identity identifier and the operation attribute and the predicted operation attribute all have authority matching, determine whether the target user has the operation authority for the project operation; if not, determine that the project operation is a risky operation.

[0136] Step 612: When the project operation is a risky operation, determine the risk level of the project operation, where the risk level includes a warning level and a blocking level.

[0137] Step 614: When the risk level is a warning level, warning information of the project operation is displayed; when the risk level is a blocking level, the project operation is blocked and blocking information of the project operation is displayed.

[0138] Step 616: Collect the context information of the project operation and the operation status of the technical support plug-in; and generate the operation result of the project operation based on the context information and the operation status.

[0139] In an optional embodiment of the present specification, a target component is also provided. Figure 7 FIG. 1 shows a schematic diagram of a target component structure provided by an embodiment of the present specification. Figure 7 As shown, the target component is installed in the front end of the project system. The target component records the user's identity, which is generated by the project system front end calling the target component to collect user information in each project platform; the target component includes: The interface module 702 is configured to receive a project operation of a target user, wherein the project operation carries an operation attribute of the target project and target user information of the target user; An identity module 704 is configured to determine a target identity of a target user based on the target user information; The abnormal behavior monitoring module 706 is configured to identify whether the project operation is a risky operation based on the operation attribute and the target identity; The processing module 708 is configured to perform risk processing on the project operation when the project operation is a risky operation.

[0140] Optionally, the target component also includes: in response to the initialization request, when the project system front end logs in to each project platform, identifying the operating environment of the project system front end, obtaining the user information in each project platform and the project platform identifier of each project platform; determining the correspondence between the user information in each project platform and the project platform identifier of each project platform; based on the user information in each project platform, the project platform identifier of each project platform and the correspondence, generating the identity identifier of each user in each project platform Optionally, the target component is further configured to: encrypt the identity to generate a digital signature; and verify whether the digital signature of the target identity is consistent with the digital signature of the identity corresponding to the target user information in the target component.

[0141] Optionally, the abnormal behavior monitoring module 706 is further configured to: based on the operation attribute and the target identity, identify whether the target user has the operation authority for the project operation; if not, determine that the project operation is a risky operation.

[0142] Optionally, the abnormal behavior monitoring module 706 is further configured to: determine the predicted operation attributes of the target user's predicted project operation at the target time based on the operation attributes; and determine that the target user has the operation authority for the project operation when the target identity identifier and the operation attributes and the predicted operation attributes all match the authority.

[0143] Optionally, the target component also includes a permission configuration module, which is configured to: identify whether the project operation has exemption authority; the abnormal behavior monitoring module 706 is further configured to: when the project operation does not have exemption authority, based on the operation attributes and the target identity, identify whether the target user has the operation authority for the project operation.

[0144] Optionally, the exemption authority includes identity exemption authority; the authority configuration module is further configured to: based on the target identity identifier, identify whether the target user has identity exemption authority Optionally, the exemption authority also includes operation exemption authority; the authority configuration module is further configured to: in the case where the target user does not have identity exemption authority, based on the operation attributes, identify whether the project operation has operation exemption authority.

[0145] Optionally, the processing module 708 is further configured to: when the project operation is a risky operation, determine the risk level of the project operation; and perform corresponding risk processing on the project operation according to the risk level.

[0146] Optionally, the risk level includes a warning level and a blocking level; the processing module 708 is further configured to: when the risk level is a warning level, display warning information of the project operation; when the risk level is a blocking level, block the project operation and display the blocking information of the project operation.

[0147] Optionally, the target component also includes an audit module configured to: collect context information of the project operation and the operation status of the target component; and generate an operation result of the project operation based on the context information and the operation status.

[0148] The above is a schematic scheme of a target component of this embodiment. It should be noted that the technical scheme of the target component and the technical scheme of the risk treatment method described above are of the same concept, and the details of the technical scheme of the target component that are not described in detail can be found in the description of the technical scheme of the risk treatment method described above.

[0149] In an optional embodiment of this specification, a project system front end is also provided, see Figure 8 , Figure 8 FIG. 1 shows a schematic diagram of a project front-end system provided by an embodiment of the present specification. Figure 8 As shown, the project system front end is installed with the above-mentioned target components.

[0150] In an optional embodiment of the present specification, the project system front end further includes a target sub-component having the same function as the target component; the target sub-component is configured to monitor the operating state of the target component; and the target component is configured to monitor the operating state of the target sub-component. Fig. 9 , Fig. 9 FIG. 1 shows a schematic diagram of a structure of a target component and a target sub-component in a project front-end system provided by an embodiment of the present specification, such as Fig. 9 As shown: Since the target component can no longer detect its own operating status after being closed, the project system front end can also include target sub-components.

[0151] The target subcomponent has the same function as the target component, and the target subcomponent is configured to monitor the operating status of the target component. At the same time, the target component can also monitor the operating status of the target subcomponent. Through such a "dual-active" monitoring mechanism, even if any of the target component or the target subcomponent has an abnormality (such as disconnection, pause, or inconsistent output results), the other component can continue to perform the normal function of risk processing while also recording the component with abnormal behavior and issuing a warning.

[0152] In the embodiments of this specification, a "dual-active" monitoring mechanism is formed by setting a target sub-component with the same function as the target component in the front end of the project system to ensure that even if one component has an abnormality, the other component can continue to perform risk processing and record abnormal behavior to issue warnings. This not only improves the reliability and stability of the system and ensures the continuity of key operations, but also enhances fault recovery capabilities and security, effectively preventing the risks brought by single point failures.

[0153] In an optional embodiment of the present specification, a cloud system is also provided. Fig.10 FIG. 1 shows a schematic diagram of a cloud system structure provided by an embodiment of the present specification. Fig.10 As shown: the cloud system includes a project front end and multiple cloud service ends, the project front end is installed with a target component, the target component records the user's identity, and the identity is generated by the project front end calling the target component to collect user information in each cloud service end; The target component is used to receive a project operation of a target user, wherein the project operation carries operation attributes and target user information of the target user; determine a target identity of the target user based on the target user information; identify whether the project operation is a risky operation based on the operation attributes and the target identity; and perform risk processing on the project operation if the project operation is a risky operation.

[0154] Cloud system refers to a complete set of network infrastructure, platform or software services built on cloud computing technology. Cloud system can provide on-demand computing resources and services through the Internet, allowing users to flexibly access, manage and use these resources as needed.

[0155] A cloud server refers to a server or server cluster that is responsible for providing specific services in a cloud system. A cloud server is located in the cloud and provides various computing resources and services to clients through the network. A cloud server usually includes computing resources (such as CPU, memory), storage resources (such as hard disk, database) and network resources (such as bandwidth, API interface).

[0156] In the embodiments of this specification, effective recording and management of user behaviors on each cloud service end are ensured, risky operations of users can be accurately handled, and timely measures can be taken when risky project operations are detected, thereby ensuring the security and reliability of the cloud system.

[0157] Fig.11 The block diagram of a computing device 1100 according to one embodiment of the present specification is shown. The components of the computing device 1100 include but are not limited to a memory 1110 and a processor 1120. The processor 1120 is connected to the memory 1110 via a bus 1130, and a database 1150 is used to store data.

[0158] The computing device 1100 also includes an access device 1140 that enables the computing device 1100 to communicate via one or more networks 1160. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 1140 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0159] In one embodiment of the present specification, the above components of the computing device 1100 and Fig.11 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Fig.11 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0160] The computing device 1100 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 1100 may also be a mobile or stationary server.

[0161] The processor 1120 is used to execute the following computer program / instructions, which implement the steps of the above-mentioned risk handling method when executed by the processor.

[0162] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the risk handling method described above are of the same concept, and the details not described in detail in the technical scheme of the computing device can be found in the description of the technical scheme of the risk handling method described above.

[0163] An embodiment of the present specification also provides a computer-readable storage medium storing a computer program / instruction, which implements the steps of the above-mentioned risk handling method when executed by a processor.

[0164] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the risk handling method described above are of the same concept, and the details not described in detail in the technical scheme of the storage medium can be found in the description of the technical scheme of the risk handling method described above.

[0165] An embodiment of the present specification also provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned risk handling method when executed by a processor.

[0166] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the risk handling method described above are of the same concept, and the details of the technical scheme of the computer program that are not described in detail can be found in the description of the technical scheme of the risk handling method described above.

[0167] The above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0168] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0169] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all described as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the embodiments of this specification.

[0170] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0171] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A risk handling method, applied to a target component of a project system front end, wherein the target component records a user's identity, and the identity is generated by the project system front end calling the target component to collect user information in each project platform; the method comprises: Receiving a project operation of a target user, wherein the project operation carries an operation attribute and target user information of the target user; Determine a target identity of the target user based on the target user information; According to the operation attribute and the target identity, identifying whether the project operation is a risky operation; In the case that the project operation is a risky operation, risk management is performed on the project operation.

2. The method according to claim 1, further comprising: In response to the initialization request, when the project system front end logs in to each project platform, identifying the operating environment of the project system front end, and obtaining user information in each project platform and project platform identification of each project platform; Determine the correspondence between the user information in each project platform and the project platform identifier of each project platform; Based on the user information in each project platform, the project platform identifier of each project platform and the corresponding relationship, an identity identifier of each user in each project platform is generated.

3. The method according to claim 2, after generating the identity of each user in each project platform based on the user information in each project platform, the project platform identifier of each project platform and the corresponding relationship, further comprises: Encrypting the identity to generate a digital signature; After determining the target identity of the target user based on the target user information, the method further includes: Verify whether the digital signature of the target identity is consistent with the digital signature of the identity corresponding to the target user information in the target component.

4. The method according to claim 1, wherein the step of identifying whether the project operation is a risky operation based on the operation attribute and the target identity comprises: Based on the operation attribute and the target identity, identifying whether the target user has the operation authority for the project operation; If not, it is determined that the project operation is a risky operation.

5. The method according to claim 4, wherein the step of identifying whether the target user has the operation authority for the project operation based on the operation attribute and the target identity identifier comprises: Determining, according to the operation attribute, a predicted operation attribute of a predicted item operation of the target user at a target time; In the case that the target identity identifier and the operation attribute and the predicted operation attribute all have authority matching, it is determined that the target user has the operation authority for the project operation.

6. The method according to claim 4, before identifying whether the target user has the operation authority for the project operation based on the operation attribute and the target identity, further comprises: Identify whether the project operation has an exemption authority; The identifying, based on the operation attribute and the target identity, whether the target user has the operation authority for the project operation includes: In the case that the project operation does not have the exemption authority, whether the target user has the operation authority for the project operation is identified based on the operation attribute and the target identity.

7. The method according to claim 6, wherein the exemption authority comprises identity exemption authority; The identifying whether the project operation has exemption authority includes: Based on the target identity identifier, it is identified whether the target user has the identity exemption authority.

8. The method according to claim 7, wherein the exemption authority further includes an operation exemption authority; the method further includes: In the case that the target user does not have the identity exemption authority, whether the project operation has the operation exemption authority is identified based on the operation attribute.

9. The method according to any one of claims 1 to 8, wherein when the project operation is a risky operation, performing risk processing on the project operation comprises: If the project operation is a risky operation, determining the risk level of the project operation; According to the risk level, corresponding risk treatment is performed on the project operation.

10. The method according to claim 9, wherein the risk level comprises a warning level and a blocking level; According to the risk level, corresponding risk treatment is performed on the project operation, including: When the risk level is a warning level, displaying warning information of the project operation; When the risk level is a blocking level, the project operation is blocked and blocking information of the project operation is displayed.

11. The method according to any one of claims 1 to 8, wherein when the project operation is a risk operation, after performing risk processing on the project operation, the method further comprises: Collecting context information of the project operation and the operation status of the target component; Based on the context information and the operation status, an operation result of the project operation is generated.

12. A target component installed in a project system front end, the target component records a user's identity, the identity is generated by the project system front end calling the target component to collect user information in each project platform; the target component includes: An interface module is configured to receive a project operation of a target user, wherein the project operation carries an operation attribute of a target project and target user information of the target user; An identity module, configured to determine a target identity of the target user based on the target user information; An abnormal behavior monitoring module is configured to identify whether the project operation is a risky operation based on the operation attribute and the target identity; The processing module is configured to perform risk processing on the project operation when the project operation is a risky operation.

13. A project system front end, having the target component according to claim 12 installed therein.

14. The project system front end according to claim 13 further includes a target sub-component having the same function as the target component; the target sub-component is configured to monitor the operating status of the target component; the target component is configured to monitor the operating status of the target sub-component.

15. A cloud system, comprising a project front end and a plurality of cloud service terminals, wherein the project front end is installed with a target component, the target component records a user's identity, and the identity is generated by the project front end calling the target component to collect user information in each cloud service terminal; The target component is used to receive the project operation of the target user, wherein: The project operation carries the operation attribute and the target user information of the target user; Determine a target identity of the target user based on the target user information; According to the operation attribute and the target identity, identifying whether the project operation is a risky operation; In the case that the project operation is a risky operation, risk management is performed on the project operation.

16. A computing device comprising: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer programs / instructions are executed by the processor, the steps of the risk management method described in any one of claims 1 to 11 are implemented.

17. A computer-readable storage medium storing a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the steps of the risk management method according to any one of claims 1 to 11.

18. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the risk management method according to any one of claims 1 to 11.

Images