Intelligent user authority conflict detection method and system

Abstract

An intelligent user authority conflict detection method and system, relating to the field of electronic digital data processing, in which a business flow diagram is constructed based on historical records; the business flow sequence of the authority role is extracted from the business flow diagram, and the business correlation between the authority roles is calculated according to the business flow sequence; the authority roles are grouped and clustered according to the business correlation to obtain several authority role clusters; the business boundary value of each authority role cluster is calculated; the target authority role cluster to which the target authority role belongs is determined from several authority role clusters; the business correlation strength between the authority role currently owned by the target user and the target authority role is calculated; when the business correlation strength exceeds the business boundary value, a first authority allocation control instruction is generated; when the business correlation strength does not exceed the business boundary value, a second authority allocation control instruction is generated. This application is used to solve the authority conflict problem in the newly added business scenario, thereby improving the security of the system.

Description

Technical Field

[0001] The present application belongs to the field of electronic digital data processing, and in particular, relates to an intelligent user authority conflict detection method and system. Background Art

[0002] With the rapid development of information systems, user rights management has become a key link in ensuring system security and data protection. In complex business scenarios, users often need to be assigned multiple different roles, and these permissions may conflict with each other. For example, the same user is assigned the roles of both reviewer and reviewee in the system, or has conflicting permissions such as data access rights and data confidentiality restrictions. This not only reduces the security of the system, but may also cause confusion in business processes.

[0003] In the related art, this can be achieved by establishing a permission role matrix. First, a matrix correspondence is established for all permission roles in the system, and mutually exclusive permission combinations are predefined. When assigning new permissions to a user, the system will check according to the mutually exclusive relationship preset in the matrix. If it is found that the permission to be assigned is mutually exclusive with the user's existing permission, the system will issue a warning and prevent the execution of the permission assignment operation.

[0004] However, in actual business scenarios, the conflict relationship between permissions is often dynamic and may change with the adjustment of business rules. The static permission matrix is ​​difficult to reflect such changes in a timely manner, making it difficult for the system to resolve permission conflicts in new business scenarios, thereby reducing the security of the system. Summary of the invention

[0005] The present application provides an intelligent user permission conflict detection method and system for resolving permission conflict problems in new business scenarios, thereby improving the security of the system.

[0006] In a first aspect, the present application provides an intelligent user permission conflict detection method, which obtains the permission operation history of the target user, the history including the permission role identifier, the operation timestamp and the associated business process identifier;

[0007] Build a business flow graph based on historical records. Each node in the business flow graph represents an authority role. The connection relationship between nodes is determined according to the sequence of operation timestamps of the authority roles in the historical records and the associated business process identifiers.

[0008] Extract the business flow sequence of the authority role from the business flow diagram, and calculate the business correlation between the authority roles based on the business flow sequence. The business correlation is calculated based on the frequency and time interval of the co-appearance of the authority roles in the same business process.

[0009] Group and cluster the permission roles according to the business relevance to obtain several permission role clusters;

[0010] Calculate the business boundary value of each permission role cluster. The business boundary value represents the threshold at which the permission roles in the corresponding permission role cluster can be held by the same user at the same time.

[0011] Determine a target permission role cluster to which a target permission role belongs from among a plurality of permission role clusters;

[0012] Calculate the business correlation strength between the target user's current permission role and the target permission role;

[0013] When the business association strength exceeds the business boundary value, a first permission allocation control instruction is generated, and the first permission allocation control instruction is used to prohibit the target permission role from being allocated to the target user;

[0014] When the business association strength does not exceed the business boundary value, a second authority allocation control instruction is generated, and the second authority allocation control instruction is used to allow the target authority role to be allocated to the target user.

[0015] By adopting the above technical solution, the target user's permission operation history record is obtained and a business flow diagram is constructed, which can accurately reflect the actual business association relationship between permission roles. Based on the business flow diagram, the business flow sequence of the permission role is extracted and the business association degree is calculated, which can quantitatively evaluate the degree of association between the permission roles. According to the business association degree, the permission role cluster is obtained by grouping and clustering, and the business boundary value of each cluster is calculated, and a mechanism for limiting the number of permission roles that can be held at the same time is established. When assigning the target permission role to the target user, by determining the cluster to which the target permission role belongs and calculating the business association strength, the corresponding permission allocation control instruction is generated after comparing it with the business boundary value, and dynamic permission conflict detection based on historical data is realized. This method reduces the limitations of the rule configuration method, improves the accuracy and flexibility of permission allocation, and at the same time improves the rationality of permission allocation through the constraint of the business boundary value, prevents excessive concentration of permissions, solves the permission conflict problem in the newly added business scenario, and thus improves the security of the system.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the business association between the authority roles according to the business flow sequence specifically includes:

[0017] Based on the business flow sequence, count the number of co-occurrences of each pair of authority roles in the same business process to obtain the authority role co-occurrence matrix;

[0018] Calculate the average operation time interval of each pair of permission roles, and convert the average operation time interval into a time correlation coefficient based on a preset time decay function;

[0019] The permission role co-occurrence matrix and the time correlation coefficient are weighted and combined to obtain the business relevance.

[0020] By adopting the above technical solution, the number of co-occurrences of permission roles in the business process is counted to construct an permission role co-occurrence matrix, and the time correlation coefficient is calculated in combination with the average operation time interval. The two are weighted and combined to obtain the business correlation, thus achieving accurate quantification of the permission role correlation relationship. The time decay function is introduced to reflect the impact of the time interval on the correlation, so that the calculation results are more in line with the actual business scenario. The permission role co-occurrence matrix reflects the collaborative relationship of the permission roles in the business process, and the time correlation coefficient reflects the closeness of the operation sequence. The combination of the two makes the calculation of business correlation more comprehensive and accurate. This calculation method reduces the one-sidedness caused by considering only a single factor and provides a more reliable business correlation evaluation result.

[0021] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the business boundary value of each permission role cluster specifically includes:

[0022] Calculate the average value of the business correlation between each permission role in the permission role cluster to obtain the average correlation within the cluster;

[0023] Count the historical distribution of permission roles within the permission role cluster and obtain the maximum number of commonly held permission roles within the cluster;

[0024] According to the average correlation degree and the maximum number of common holdings within the cluster, the business boundary value of each permission role cluster is calculated using the preset boundary value calculation function.

[0025] By adopting the above technical solution, the average correlation within the permission role cluster is calculated and the maximum number of common holdings is counted. The business boundary value is determined by using the preset boundary value calculation function, and a reasonable permission constraint mechanism is established. The degree of correlation of the permission roles within the cluster is combined with the historical allocation situation, so that the business boundary value not only reflects the business correlation characteristics between the permission roles, but also takes into account the reasonable boundaries in actual use. The average correlation within the cluster reflects the internal closeness of the permission role cluster, and the maximum number of common holdings reflects the feasibility verification in the actual business. The business boundary value determined by the two will neither be too strict to affect the normal business development, nor too loose to cause the permission management to be out of control. This boundary value calculation method makes the permission constraint more reasonable and practical, and balances the needs of business efficiency and security management.

[0026] In conjunction with some embodiments of the first aspect, in some embodiments, determining a target permission role cluster to which a target permission role belongs from among a plurality of permission role clusters specifically includes:

[0027] Calculate the business correlation between the target permission role and the center point of each permission role cluster;

[0028] Select the permission role cluster with the greatest business relevance to the target permission role as the candidate target permission role cluster;

[0029] The candidate target permission role cluster whose business relevance to the center point of the candidate target permission role cluster is greater than a preset cluster belonging threshold is used as the target permission role cluster.

[0030] By adopting the above technical solution, the business correlation between the target permission role and the center point of each permission role cluster is calculated, and the permission role cluster with the largest correlation and exceeding the preset cluster attribution threshold is selected as the target permission role cluster, thereby achieving accurate permission role classification. This solution simplifies the classification process through the design of the cluster center point, and introduces the cluster attribution threshold as a constraint condition to ensure that the target permission role has a sufficiently strong business correlation with the cluster to which it belongs. It improves the accuracy of classification, has strong fault tolerance, makes the grouping of permission roles more reasonable, and provides a reliable prerequisite for subsequent permission conflict detection.

[0031] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the business association strength between the authority role currently possessed by the target user and the target authority role specifically includes:

[0032] Get the set of permission roles currently owned by the target user;

[0033] Calculate the business relevance between each permission role in the permission role set and the target permission role respectively;

[0034] Normalizing the business relevance to obtain a standardized business relevance;

[0035] Calculate business relevance strength based on normalized business relevance.

[0036] By adopting the above technical solution, the target user's current set of permission roles is obtained, and the business relevance between each permission role in the set and the target permission role is calculated respectively, and then the business relevance is normalized to obtain the standardized business relevance. Finally, the business relevance strength is calculated based on the standardized business relevance, so that the system can accurately evaluate the degree of relevance between the target user's existing permissions and the permissions to be assigned. Standardization eliminates the dimensional differences in business relevance between different permission roles and ensures the comparability of the calculation results. By comprehensively considering the relevance between all existing permission roles of the target user and the target permission role, the impact of the new permissions on the user's permission system can be fully reflected. It can effectively identify potential risks in the permission allocation process and avoid allocating permissions with too high correlation to the same user, thereby reducing business risks caused by overlapping permissions.

[0037] In combination with some embodiments of the first aspect, in some embodiments, after generating a second permission allocation control instruction when the service association strength does not exceed the service boundary value, the method further includes:

[0038] Obtain the personnel structure relationship diagram of the target user. Each node in the personnel structure relationship diagram represents a user, and the connection relationship between each node represents the superior-subordinate relationship between users.

[0039] Construct a permission transfer chain based on the personnel structure relationship diagram. The permission transfer chain includes a sequence of users who have a superior-subordinate relationship with the target user.

[0040] Extract the permission role combination of each user in the permission transfer chain and calculate the similarity between each permission role combination;

[0041] When it is detected that the target user's permission role combination is more similar to the permission role combination of any user in the permission transfer chain than the preset threshold, a permission overlap warning is triggered.

[0042] By adopting the above technical solution, a permission transfer chain is constructed based on the personnel structure relationship diagram, and the similarity between the user permission role combinations in the permission transfer chain is calculated. The system can monitor the permission overlap between the target user and his superiors and subordinates. The introduction of the permission transfer chain allows the system to not only focus on the rationality of the permissions of a single user, but also consider the rationality of the permission allocation in the organizational environment in which the user is located. By calculating the similarity of the permission role combination and comparing it with the preset threshold, the system can promptly discover the permission overlap between the user and his superiors and subordinates. It helps to reduce the risk of confusion of responsibilities and internal control failure caused by superiors and subordinates having too similar permissions, and improves the organization's permission management level and internal control effectiveness.

[0043] In combination with some embodiments of the first aspect, in some embodiments, after triggering the authority overlap warning, the method further includes:

[0044] Calculate the organizational level distance between pairs of users with overlapping permissions in the permission transfer chain;

[0045] The risk level of authority overlap is determined based on the organizational hierarchy distance. The smaller the organizational hierarchy distance, the higher the risk level of authority overlap.

[0046] Generate permission adjustment suggestions based on the permission overlap risk level. The permission adjustment suggestions include the permission roles that are recommended to be removed and their priorities.

[0047] Send permission adjustment suggestions to the permission management end.

[0048] By adopting the above technical solution, the smaller the organizational level distance is, the closer the permission overlap occurs to the management level, and the higher the risk level is. This risk quantification method meets the risk control needs in actual business. According to the permission overlap risk level, an adjustment suggestion including the recommended removal of permission roles and their priority is generated, and the suggestion is sent to the permission management end, providing a clear processing solution for permission management personnel. This permission risk classification and processing mechanism based on organizational level distance can help organizations solve the problem of permission overlap in a more targeted manner, optimize the permission allocation structure, and improve the level of refinement of permission management.

[0049] In a second aspect, an embodiment of the present application provides an intelligent user permission conflict detection system, which includes: a memory and one or more processors; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call the computer instructions to enable the system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0050] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a system, causes the system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0051] In a fourth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a system, the system executes the method described in any possible implementation manner in the first aspect.

[0052] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0053] 1. The present application provides an intelligent user permission conflict detection method, which obtains the permission operation history of the target user and constructs a business flow diagram, which can accurately reflect the actual business association relationship between permission roles. Based on the business flow diagram, the business flow sequence of the permission role is extracted and the business association degree is calculated, which can quantitatively evaluate the degree of association between the permission roles. According to the business association degree, the permission role cluster is obtained by grouping and clustering, and the business boundary value of each cluster is calculated, and a mechanism for limiting the number of permission roles that can be held at the same time is established. When assigning the target permission role to the target user, by determining the cluster to which the target permission role belongs and calculating the business association strength, the corresponding permission allocation control instruction is generated after comparison with the business boundary value, and dynamic permission conflict detection based on historical data is realized. This method reduces the limitations of the rule configuration method, improves the accuracy and flexibility of permission allocation, and at the same time improves the rationality of permission allocation through the constraint of the business boundary value, prevents excessive concentration of permissions, solves the permission conflict problem in the newly added business scenario, and thus improves the security of the system.

[0054] 2. This application provides an intelligent user authority conflict detection method, which constructs an authority transfer chain based on the personnel structure relationship diagram, and calculates the similarity between each user authority role combination in the authority transfer chain. The system can monitor the authority overlap between the target user and his superiors and subordinates. The introduction of the authority transfer chain enables the system to not only focus on the rationality of the authority of a single user, but also consider the rationality of the authority allocation in the organizational environment in which the user is located. By calculating the similarity of the authority role combination and comparing it with the preset threshold, the system can promptly discover the authority overlap between the user and his superiors and subordinates. It helps to reduce the risk of confusion of responsibilities and internal control failure caused by superiors and subordinates having too similar authorities, and improves the organization's authority management level and internal control effectiveness.

[0055] 3. This application provides an intelligent user permission conflict detection method. The smaller the organizational hierarchy distance, the closer the permission overlap occurs at the management level, and the higher the risk level. This risk quantification method meets the risk control needs in actual business. According to the permission overlap risk level, an adjustment suggestion is generated, including a suggestion to remove the permission role and its priority, and the suggestion is sent to the permission management end, providing a clear processing solution for the permission management personnel. This permission risk grading and processing mechanism based on organizational hierarchy distance can help organizations solve the problem of permission overlap in a more targeted manner, optimize the permission allocation structure, and improve the level of refinement of permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a flow chart of an intelligent user rights conflict detection method in an embodiment of the present application.

[0057] Figure 2It is another flow chart of an intelligent user authority conflict detection method in an embodiment of the present application.

[0058] Figure 3 It is a schematic diagram of the physical device structure of an intelligent user authority conflict detection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more listed items.

[0060] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0061] The following uses an embodiment and combines Figure 1 , an intelligent user rights conflict detection method in an embodiment of the present application is described:

[0062] See also Figure 1 , which is a flow chart of an intelligent user authority conflict detection method in an embodiment of the present application.

[0063] S101, obtaining the target user's permission operation history records, and constructing a business flow diagram based on the history records;

[0064] The system obtains the target user's permission operation history, which includes the permission role ID, operation timestamp and associated business process ID, and builds a business flow graph based on the history. Each node in the business flow graph represents a permission role, and the connection relationship between nodes is determined according to the sequence of operation timestamps of the permission role in the history and the associated business process ID.

[0065] The system builds a business flow graph by obtaining the target user's permission operation history. The permission operation history may include but is not limited to information such as permission role identification, operation timestamp, and associated business process identification, which can reflect the target user's permission operation behavior in the system. The system can obtain permission operation history from various data sources, such as log files, databases, etc.

[0066] After obtaining the permission operation history records, the system constructs a business flow graph based on the history records. The business flow graph is a directed graph in which each node represents an permission role, and the connection relationship between nodes is determined according to the order of the operation timestamps of the permission roles in the history records and the associated business process identifiers. For example, if the history records show that permission role A operated business process P1 at time t1, and permission role B operated the same business process P1 at time t2, and t2 is later than t1, then in the business flow graph, there will be a directed edge from node A to node B.

[0067] S102, extracting the business flow sequence of the authority role from the business flow diagram, and calculating the business correlation between the authority roles according to the business flow sequence;

[0068] The system extracts the business flow sequence of the authority role from the business flow diagram, and calculates the business correlation between the authority roles based on the business flow sequence. The business correlation is calculated based on the frequency and time interval of co-occurrence of the authority roles in the same business process. Specifically: based on the business flow sequence, the co-occurrence times of each pair of authority roles in the same business process are counted to obtain the authority role co-occurrence matrix;

[0069] Calculate the average operation time interval of each pair of permission roles, and convert the average operation time interval into a time correlation coefficient based on a preset time decay function;

[0070] The permission role co-occurrence matrix and the time correlation coefficient are weighted and combined to obtain the business relevance.

[0071] In this step, the system extracts the business flow sequence of the permission roles from the business flow diagram constructed in the previous step, and calculates the business correlation between the permission roles. The business flow sequence reflects the order of operations of the permission roles in different business processes, and can be used to characterize the business correlation between the permission roles.

[0072] Based on the business flow sequence, the system obtains the permission role co-occurrence matrix by counting the number of co-occurrences of each pair of permission roles in the same business process. The higher the number of co-occurrences, the greater the correlation between the two permission roles in business operations. At the same time, the system also calculates the average operation time interval for each pair of permission roles, and converts the average operation time interval into a time correlation coefficient based on a preset time decay function. The smaller the time interval, the larger the correlation coefficient, indicating that the two permission roles are more temporally correlated.

[0073] Finally, the system performs a weighted combination of the permission role co-occurrence matrix and the time correlation coefficient to obtain the business correlation matrix. The business correlation matrix comprehensively considers the degree of correlation between permission roles in business operations and their temporal correlation, and can more accurately depict the correlation between permission roles.

[0074] When calculating business relevance, the system may encounter problems with a wide variety of business processes and complex relationships, resulting in large amounts of calculations and low efficiency. To solve this problem, the system can introduce representation learning technology based on graph embedding. Specifically, the system can map the business flow graph into a low-dimensional vector space, so that permission roles that are close to each other in the vector space also have a high degree of relevance in the original business flow graph. Through graph embedding technology, the system can greatly reduce the computational complexity of business relevance and improve computational efficiency.

[0075] S103, grouping and clustering the authority roles according to the business relevance to obtain a number of authority role clusters;

[0076] After obtaining the business relevance between permission roles, the system groups and clusters the permission roles according to the business relevance to obtain several permission role clusters. The permission roles within each permission role cluster have a high relevance in business operations, while the relevance between different permission role clusters is low. Through clustering and grouping, the system can divide business-related permission roles into the same cluster, which is convenient for subsequent permission conflict detection.

[0077] The system can use a variety of clustering algorithms to group permission roles, such as density-based DBSCAN algorithm, hierarchical clustering algorithm, etc. Different clustering algorithms may differ in dividing permission role clusters. The system can select a suitable clustering algorithm based on specific business scenarios and data characteristics. For example, when the relationship between permission roles presents an obvious hierarchical structure, the system can give priority to the hierarchical clustering algorithm.

[0078] When clustering permission roles, the system may encounter problems with suboptimal clustering results, such as too many or too few permission role clusters obtained through clustering, or some permission roles cannot be clearly classified. To address these issues, the system can take the following optimization measures: introduce domain knowledge to manually adjust the clustering results; control the granularity of clustering by setting appropriate clustering parameters (such as the radius parameter of DBSCAN); for permission roles that are difficult to classify, the system can mark them as special categories and handle them separately.

[0079] S104, calculating the business boundary value of each permission role cluster;

[0080] The system calculates the business boundary value of each permission role cluster. The business boundary value indicates the threshold at which the permission roles in the corresponding permission role cluster can be held by the same user at the same time. Specifically: the average business correlation between the permission roles in the permission role cluster is calculated to obtain the average correlation within the cluster.

[0081] Count the historical distribution of permission roles within the permission role cluster and obtain the maximum number of commonly held permission roles within the cluster;

[0082] According to the average correlation degree and the maximum number of common holdings within the cluster, the business boundary value of each permission role cluster is calculated using the preset boundary value calculation function.

[0083] In this step, the system calculates the business boundary value of each permission role cluster. The business boundary value represents the threshold at which the permission roles in the corresponding permission role cluster can be held by the same user at the same time. When the number of permission roles held by a user or the business correlation between permission roles exceeds the business boundary value, it may lead to potential permission conflict risks.

[0084] In order to calculate the business boundary value, the system first calculates the average value of the business correlation between each permission role in the permission role cluster to obtain the average correlation within the cluster. The average correlation within the cluster reflects the degree of closeness within the permission role cluster. Then, the system counts the historical allocation of permission roles within the permission role cluster to obtain the maximum number of jointly held permission roles within the cluster, that is, the maximum number of permission roles in the permission role cluster that the same user holds at the same time. Finally, the system uses the preset boundary value calculation function to calculate the business boundary value of each permission role cluster based on the average correlation within the cluster and the maximum number of jointly held permissions.

[0085] The preset boundary value calculation function can be designed according to the system's security policy and risk tolerance. For example, when the system is very sensitive to the risk of permission conflict, a stricter boundary value calculation function can be designed so that the calculated business boundary value is lower. On the contrary, if the system has a higher tolerance for the risk of permission conflict, a relatively loose boundary value calculation function can be designed.

[0086] S105, determining a target authority role cluster to which the target authority role belongs from among a plurality of authority role clusters;

[0087] The system determines the target permission role cluster to which the target permission role belongs from among several permission role clusters, including:

[0088] Calculate the business correlation between the target permission role and the center point of each permission role cluster;

[0089] Select the permission role cluster with the greatest business relevance to the target permission role as the candidate target permission role cluster;

[0090] The candidate target permission role cluster whose business relevance to the center point of the candidate target permission role cluster is greater than a preset cluster belonging threshold is used as the target permission role cluster.

[0091] After calculating the business boundary value of each permission role cluster, the system needs to determine the target permission role cluster to which the target permission role belongs from among several permission role clusters. This step can help the system determine which permission roles are highly relevant to the target permission role in terms of business, thus providing a basis for subsequent permission conflict detection.

[0092] Specifically, the system first calculates the business correlation between the target permission role and the center point of each permission role cluster. The center point of the permission role cluster can be represented by the mean vector of the business correlation of all permission roles in the cluster. Then, the system selects the permission role cluster with the greatest business correlation with the target permission role as the candidate target permission role cluster. Finally, the system selects the candidate target permission role cluster whose business correlation with the center point of the candidate target permission role cluster is greater than the preset cluster attribution threshold as the target permission role cluster. The cluster attribution threshold can be set according to the actual situation of the system to balance the accuracy and coverage of clustering.

[0093] S106, calculating the business correlation strength between the target user's current authority role and the target authority role;

[0094] The system calculates the business correlation strength between the target user's current permission role and the target permission role, specifically including: obtaining the target user's current permission role set;

[0095] Calculate the business relevance between each permission role in the permission role set and the target permission role respectively;

[0096] Normalizing the business relevance to obtain a standardized business relevance;

[0097] Calculate business relevance strength based on normalized business relevance.

[0098] After determining the target permission role cluster to which the target permission role belongs, the system needs to calculate the business correlation strength between the permission role currently owned by the target user and the target permission role. The business correlation strength reflects the degree of correlation between the target user's current permission and the target permission role in business operations, and can be used to assess potential permission conflict risks.

[0099] Specifically, the system first obtains the set of permission roles that the target user currently has. Then, the system calculates the business relevance between each permission role in the permission role set and the target permission role. For ease of comparison, the system normalizes the business relevance to obtain a standardized business relevance with a value range between 0 and 1. Finally, the system calculates the business relevance strength based on the standardized business relevance. For example, the system can directly sum the standardized business relevance to obtain the business relevance strength, or it can perform a weighted summation on the standardized business relevance, where the weight can be set according to the importance and sensitivity of different permission roles.

[0100] S107: When the service association strength exceeds the service boundary value, a first authority allocation control instruction is generated;

[0101] When the business association strength exceeds the business boundary value, a first permission allocation control instruction is generated, and the first permission allocation control instruction is used to prohibit the target permission role from being allocated to the target user.

[0102] This step is a key step in detecting permission conflicts. The system generates corresponding permission allocation control instructions based on the comparison results of the business association strength and the business boundary value. When the business association strength exceeds the business boundary value, it means that there may be a potential permission conflict risk between the permission role currently owned by the target user and the target permission role, and the system needs to take measures to prevent this risk.

[0103] Specifically, when the system detects that the business association strength exceeds the business boundary value, it will generate a first permission allocation control instruction. The first permission allocation control instruction is used to prohibit the target permission role from being assigned to the target user, that is, the target user is not allowed to continue to apply for and obtain the target permission role that conflicts with his current permission. This control measure can effectively reduce the risk of permission conflicts and ensure the security of the system.

[0104] When generating the first permission allocation control instruction, the system can adopt different processing strategies according to the actual situation. For example, the system can directly reject the permission application of the target user and send a permission conflict reminder message to the target user; or the system can first submit the permission application of the target user to the relevant administrator or security auditor for manual review, and they will decide whether to approve the permission application based on the specific circumstances of the application.

[0105] At the same time, the system can also take different disciplinary measures against target users based on the severity and frequency of permission conflicts. For example, for users who have applied for conflicting permissions multiple times, the system can prohibit them from submitting new permission applications for a period of time; for users who maliciously apply for conflicting permissions or attempt to obtain permissions through illegal means, the system can also take more severe punishment measures, such as locking the user account, recording the user's bad credit record, etc. These measures can enhance users' security awareness and promote standardized management of system permissions.

[0106] S108: When the service association strength does not exceed the service boundary value, generate a second authority allocation control instruction.

[0107] When the business association strength does not exceed the business boundary value, a second authority allocation control instruction is generated, and the second authority allocation control instruction is used to allow the target authority role to be allocated to the target user.

[0108] Corresponding to S107, when the system detects that the business association strength does not exceed the business boundary value, it means that the target permission role applied for by the target user has a low business association with the permission role he currently possesses, and the risk of permission conflict is controllable. The system can allow the target permission role to be assigned to the target user.

[0109] Specifically, when the business association strength does not exceed the business boundary value, the system will generate a second permission allocation control instruction. The second permission allocation control instruction is used to allow the target permission role to be assigned to the target user, that is, to approve the permission application of the target user. In the actual permission allocation process, the system can automatically complete the allocation and activation of relevant permissions for the target user according to the preset process to improve the efficiency of permission management.

[0110] Although the business association strength does not exceed the business boundary value, the system allows the target permission role to be assigned to the target user, but this does not mean that the system can completely relax the supervision of the target user's permissions. In order to timely discover and deal with potential permission conflict risks, the system can trigger some subsequent monitoring and early warning mechanisms while generating the second permission allocation control instruction.

[0111] For example, the system can continuously monitor the target user's permission usage and regularly evaluate whether the target user's business association strength has increased, and whether it is close to or exceeds the business boundary value. Once an abnormal situation is found, the system can promptly send an early warning message to the administrator to prompt him to take corresponding control measures. In addition, the system can also use machine learning algorithms to analyze user behavior patterns and operation logs to predict and prevent possible permission conflict risks in real time. These intelligent monitoring and early warning methods can further improve the security and effectiveness of system permission management.

[0112] In the above embodiment, the target user's permission operation history record is obtained and a business flow diagram is constructed, which can accurately reflect the actual business association relationship between the permission roles. Based on the business flow diagram, the business flow sequence of the permission role is extracted and the business association degree is calculated, so that the degree of association between the permission roles can be quantitatively evaluated. According to the business association degree, the permission role cluster is obtained by grouping and clustering, and the business boundary value of each cluster is calculated, and a mechanism for limiting the number of permission roles that can be held at the same time is established. When assigning the target permission role to the target user, by determining the cluster to which the target permission role belongs and calculating the business association strength, the corresponding permission allocation control instruction is generated after comparing with the business boundary value, and dynamic permission conflict detection based on historical data is realized. This method reduces the limitations of the rule configuration method, improves the accuracy and flexibility of permission allocation, and at the same time improves the rationality of permission allocation through the constraint of the business boundary value, prevents excessive concentration of permissions, solves the permission conflict problem in the newly added business scenario, and thus improves the security of the system.

[0113] In the first embodiment described above, permission conflict detection based on business relevance is achieved mainly by analyzing the user's permission operation history, constructing a business flow diagram, and calculating the business relevance between permission roles. However, in actual applications, permission conflict detection based only on business relevance may be insufficient, and the rationality of permission allocation in the organizational structure also needs to be considered. Figure 2 , another intelligent user rights conflict detection method in an embodiment of the present application is described:

[0114] See also Figure 2 , is another flow chart of an intelligent user authority conflict detection method in an embodiment of the present application.

[0115] S201, obtaining a personnel structure relationship diagram of the target user, and building a permission transfer chain based on the personnel structure relationship diagram;

[0116] The system obtains the personnel structure relationship diagram of the target user. Each node in the personnel structure relationship diagram represents a user. The connection relationship between each node represents the superior-subordinate relationship between users. The system builds a permission transfer chain based on the personnel structure relationship diagram. The permission transfer chain includes a sequence of users that have a superior-subordinate relationship with the target user.

[0117] This step is the basic step for detecting permission conflicts based on the organizational structure. The system obtains the personnel structure relationship diagram of the target user and analyzes the superior-subordinate relationship between users in the organization, thereby constructing a permission transfer chain. The personnel structure relationship diagram can reflect the reporting relationship and management chain between users in the organization, and is an important basis for analyzing the rationality of permissions.

[0118] When obtaining the personnel structure relationship diagram, the system can read the user's organizational structure information from data sources such as the organization's human resources management system and LDAP directory service. The personnel structure relationship diagram is usually represented in the form of a directed acyclic graph, where each node represents a user, and the directed edge between each node represents the superior-subordinate relationship between users, with the direction of the edge pointing from the subordinate user to the superior user. Based on the personnel structure relationship diagram, the system can build a permission transfer chain starting from the target user. The permission transfer chain includes a sequence of users that have a direct or indirect superior-subordinate relationship with the target user.

[0119] S202, extracting the authority role combination of each user in the authority transfer chain, and calculating the similarity between each authority role combination;

[0120] After building the permission transfer chain of the target user, the system needs to extract the permission role combination of each user in the permission transfer chain and calculate the similarity between the permission role combinations of different users. The permission role combination reflects the set of a series of permission roles that the user has in the system and is the basic unit for permission overlap analysis.

[0121] Specifically, the system can obtain the permission role allocation information of each user in the permission transfer chain from the permission management system or access control policy to form a permission role combination for each user. Then, the system uses a similarity calculation method to compare the degree of overlap between different user permission role combinations. Common similarity calculation methods include Jaccard similarity, cosine similarity, etc. These methods quantify the similarity between permission role combinations by calculating the ratio of the intersection and union of two permission role combinations, or mapping the permission role combination to the vector space to calculate the angle between vectors.

[0122] S203: When it is detected that the similarity between the target user's authority role combination and the authority role combination of any user in the authority transfer chain exceeds a preset threshold, triggering an authority overlap warning;

[0123] This step is a key step in detecting permission conflicts. The system determines whether there is a potential risk of permission overlap by comparing the similarity of the permission role combination of the target user and other users in the permission transfer chain. When the similarity exceeds the preset threshold, it means that the permission role allocation of the target user and its superiors and subordinates is too similar, and there may be permission redundancy or permission abuse, which needs to attract the attention of the administrator.

[0124] Specifically, the system calculates the similarity between the target user's permission role combination and the permission role combination of each user in the permission transfer chain, and compares the similarity result with the preset similarity threshold. Once it is found that the similarity between a user's permission role combination and the target user's exceeds the threshold, the system will trigger a permission overlap warning. The warning information should include detailed information such as the names of users with overlapping permissions, the organizational relationships between users, and the list of overlapping permission roles, so that administrators can conduct further risk assessment and disposal.

[0125] S204, calculating the organizational level distance between user pairs with overlapping permissions in the permission transfer chain;

[0126] After triggering the permission overlap warning, the system needs to further evaluate the risk level of permission overlap. An important evaluation dimension is the organizational distance between users with overlapping permissions, that is, the hierarchical gap between users in the organizational structure. Intuitively, the risk of permission overlap between users with smaller hierarchical distances is higher, because their responsibilities and permission boundaries in the organization are more likely to cause confusion and conflict.

[0127] In order to calculate the organizational hierarchical distance between users with overlapping permissions, the system can use the personnel structure relationship graph constructed in step S201. Specifically, for each pair of users with overlapping permissions warning, the system finds the nodes corresponding to the two users in the personnel structure relationship graph, and then calculates the shortest path length between the two nodes through a graph traversal algorithm (such as depth-first search or breadth-first search), and uses it as the organizational hierarchical distance between the users.

[0128] When calculating the organizational level distance, the system may encounter a situation where a user holds positions in multiple departments or teams at the same time, resulting in multiple superior-subordinate paths between users. In response to this situation, the system can adopt the following processing strategies: select the shortest path among multiple paths as the organizational level distance; or calculate the weighted average organizational level distance based on the position weight of the user in different departments or teams. In addition, for dotted reporting relationships or flat teams temporarily formed by project teams, the system should also give special treatment when calculating the organizational level distance to avoid affecting the accuracy of risk assessment.

[0129] S205. Determine the risk level of authority overlap based on the organizational level distance;

[0130] The system determines the risk level of authority overlap based on the organizational hierarchy distance. The smaller the organizational hierarchy distance, the higher the risk level of authority overlap.

[0131] After obtaining the organizational hierarchical distance between users with overlapping permissions, the system can determine the risk level of permission overlap based on the hierarchical distance. The risk level is used to quantify the potential impact of permission overlap on organizational security and compliance, helping administrators prioritize high-risk permission overlap situations.

[0132] Specifically, the system can predefine a risk level assessment matrix, where the horizontal axis of the matrix represents the organizational hierarchy distance, the vertical axis represents the similarity of the authority role combination, and each cell of the matrix corresponds to a risk level. For example, for situations where the organizational hierarchy distance is small (such as a direct superior-subordinate relationship) and the authority role combination similarity is high, the corresponding cell risk_level in the assessment matrix may be marked as "high risk"; while for situations where the hierarchy distance is large and the similarity is low, the corresponding risk_level may be marked as "low risk". The system only needs to find the corresponding cell in the assessment matrix based on the calculated hierarchy distance and similarity to obtain the risk level of overlapping permissions.

[0133] S206: Generate permission adjustment suggestions according to the permission overlap risk level, and send the permission adjustment suggestions to the permission management terminal.

[0134] The system generates permission adjustment suggestions based on the permission overlap risk level. The permission adjustment suggestions include the permission roles recommended for removal and their priorities, and sends the permission adjustment suggestions to the permission management end.

[0135] According to the risk level of overlapping permissions, the system can automatically generate corresponding permission adjustment suggestions and send them to the permission management end for the administrator to refer to and make decisions. Permission adjustment suggestions are designed to eliminate or mitigate the risk of overlapping permissions, reasonably divide the user's permission boundaries, and ensure the security and compliance of the organization.

[0136] Specifically, for overlapping permissions at different risk levels, the permission adjustment suggestions generated by the system may include the following aspects:

[0137] (1) List of recommended permission roles to be removed. For high-risk permission overlaps, the system may recommend removing some redundant or mutually exclusive permission roles of subordinate users in the permission transfer chain to minimize the degree of permission overlap.

[0138] (2) Recommended adjustment of user permission scope. While removing permission roles, the system can also recommend adjusting the user's permission scope, such as narrowing the data access scope of certain sensitive permission roles from all data to departmental data, to further reduce the risk of permission abuse.

[0139] (3) Recommend optimized organizational structure adjustments. For overlapping permissions caused by unreasonable organizational structure settings, the system can recommend optimizing the reporting relationships or department affiliations of relevant users to match their actual business responsibilities and permission boundaries.

[0140] (4) Recommended permission recovery and reauthorization process. For permission roles that have expired or are no longer needed, the system can recommend that administrators recover them in a timely manner and re-evaluate and reauthorize user permissions based on job changes.

[0141] When generating permission adjustment suggestions, the system can fully consider the priority and implementation cost of different suggestions. For high-risk permission overlaps, the corresponding suggestions should be marked as high priority, prompting the administrator to deal with them as soon as possible; while for suggestions that require organizational structure adjustments, since there are many departments and personnel involved and the implementation is difficult, they can be marked as lower priority. The system can also estimate the implementation costs of different suggestions (such as the human resources and time costs required) to help administrators weigh and select the best rectification plan.

[0142] In the above embodiment, a permission transfer chain is constructed based on the personnel structure relationship diagram, and the similarity between the user permission role combinations in the permission transfer chain is calculated. The system can monitor the permission overlap between the target user and his superiors and subordinates. The introduction of the permission transfer chain allows the system to not only focus on the rationality of the permissions of a single user, but also consider the rationality of the permission allocation in the organizational environment in which the user is located. By calculating the similarity of the permission role combination and comparing it with the preset threshold, the system can promptly discover the permission overlap between the user and his superiors and subordinates. It helps to reduce the risk of confusion of responsibilities and internal control failure caused by superiors and subordinates having too similar permissions, and improves the organization's permission management level and internal control effectiveness.

[0143] The following describes the system in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , which is a schematic diagram of the physical device structure of an intelligent user authority conflict detection system provided in an embodiment of the present application.

[0144] It should be noted that Figure 3 The structure of the system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0145] like Figure 3As shown, the system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method in the above embodiment. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other through bus 304. Input / output (I / O) interface 305 is also connected to bus 304.

[0146] The following components are connected to the I / O interface 305: an input section 306 including a camera, an infrared sensor, etc.; an output section 307 including a liquid crystal display (LCD) and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0147] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 309, and / or installed from a removable medium 311. When the computer program is executed by a central processing unit (CPU) 301, various functions defined in the present invention are performed.

[0148] It should be noted that the computer-readable medium shown in the embodiment of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable computer program. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.

[0149] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Among them, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0150] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the system described in the above embodiment; or may exist independently without being assembled into the system. The above storage medium carries one or more computer programs, and when the above one or more computer programs are executed by a processor of a system, the system implements the method provided in the above embodiment.

[0151] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0152] As used in the above embodiments, the term "when..." may be interpreted as "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted as "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0153] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media integration. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0154] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. An intelligent user rights conflict detection method, characterized in that: include: Obtain the target user's permission operation history record, which includes the permission role identifier, operation timestamp, and associated business process identifier; Constructing a business flow graph based on the historical records, wherein each node in the business flow graph represents an authority role, and the connection relationship between the nodes is determined according to the sequence of the operation timestamps of the authority roles in the historical records and the associated business process identifiers; Extracting the business flow sequence of the authority role from the business flow diagram, and calculating the business correlation between the authority roles according to the business flow sequence, wherein the business correlation is calculated based on the frequency and time interval of the co-appearance of the authority roles in the same business process; Grouping and clustering the authority roles according to the business relevance to obtain a number of authority role clusters; Calculating a business boundary value for each permission role cluster, where the business boundary value represents a threshold at which a permission role in the corresponding permission role cluster can be held simultaneously by the same user; Determine a target permission role cluster to which the target permission role belongs from the plurality of permission role clusters; Calculate the business correlation strength between the target user's current permission role and the target permission role; When the business association strength exceeds the business boundary value, a first permission allocation control instruction is generated, wherein the first permission allocation control instruction is used to prohibit the target permission role from being allocated to the target user; When the business association strength does not exceed the business boundary value, a second authority allocation control instruction is generated, where the second authority allocation control instruction is used to allow the target authority role to be allocated to the target user.

2. The method according to claim 1, characterized in that The calculating the business association between the authority roles according to the business flow sequence specifically includes: Based on the business flow sequence, the number of co-occurrences of each pair of the authority roles in the same business process is counted to obtain an authority role co-occurrence matrix; Calculating an average operation time interval of each pair of the permission roles, and converting the average operation time interval into a time correlation coefficient based on a preset time decay function; The authority role co-occurrence matrix and the time correlation coefficient are weightedly combined to obtain a business correlation degree.

3. The method according to claim 1, characterized in that The calculating of the business boundary value of each authority role cluster specifically includes: Calculate the average value of the business correlation between the authority roles in the authority role cluster to obtain the average correlation within the cluster; Counting the historical allocation of the authority roles in the authority role cluster to obtain the maximum number of common holdings of the authority roles in the cluster; According to the average degree of association within the cluster and the maximum number of jointly held shares, a preset boundary value calculation function is used to calculate the business boundary value of each permission role cluster.

4. The method according to claim 1, characterized in that: Determining the target permission role cluster to which the target permission role belongs from the plurality of permission role clusters specifically includes: Calculate the business correlation between the target authority role and the center point of each authority role cluster; Selecting the permission role cluster with the greatest business relevance to the target permission role as a candidate target permission role cluster; The candidate target authority role cluster whose business relevance to the center point of the candidate target authority role cluster is greater than a preset cluster belonging threshold is used as the target authority role cluster.

5. The method according to claim 1, characterized in that: The calculating the business association strength between the authority role currently possessed by the target user and the target authority role specifically includes: Obtain the permission role set currently owned by the target user; Calculating the business relevance between each of the authority roles in the authority role set and the target authority role respectively; Normalizing the business relevance to obtain a standardized business relevance; The business relevance strength is calculated based on the standardized business relevance.

6. The method according to claim 1, characterized in that After generating a second permission allocation control instruction when the service association strength does not exceed the service boundary value, the method further includes: Obtaining a personnel structure relationship graph where the target user is located, wherein each node in the personnel structure relationship graph represents a user, and the connection relationship between each of the nodes represents the superior-subordinate relationship between the users; Building a permission transfer chain based on the personnel structure relationship diagram, wherein the permission transfer chain includes a user sequence having a superior-subordinate relationship with the target user; Extracting the authority role combination of each user in the authority transfer chain, and calculating the similarity between each authority role combination; When it is detected that the similarity between the authority role combination of the target user and the authority role combination of any user in the authority transfer chain exceeds a preset threshold, a permission overlap warning is triggered.

7. The method according to claim 6, characterized in that After triggering the authority overlap warning, the method further includes: Calculating the organizational level distance between pairs of users with overlapping permissions in the permission transfer chain; Determine the authority overlap risk level based on the organizational level distance, the smaller the organizational level distance, the higher the authority overlap risk level; Generate a permission adjustment suggestion according to the permission overlap risk level, wherein the permission adjustment suggestion includes the permission role recommended to be removed and its priority; The permission adjustment suggestion is sent to the permission management terminal.

8. An intelligent user authority conflict detection system, characterized in that: The system comprises: A memory and one or more processors; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the system to execute the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a system, the system is caused to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a system, the system is caused to execute the method according to any one of claims 1 to 7.

Images