Personnel access permission dynamic management method, product, equipment and medium
By dynamically managing personnel access rights in electronic work ticket systems, the problem of rigid permission management in traditional systems is solved, and higher security and work efficiency are achieved.
Patent Information
- Application Number
- CN202411694109.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-25
- Publication Date
- 2025-03-14
AI Technical Summary
The traditional electronic work order system seems to be relatively rigid in personnel access rights management, and it is difficult to adapt to the needs of dynamic changes in the enterprise's business and personnel role adjustment in real time, resulting in limited flexible access to system resources and may cause information security risks or inefficiency.
It provides a dynamic management method for personnel access rights. By verifying the legitimacy of login request information, identifying user identity and assigning initial access rights, monitoring user access behavior data, and identifying potential risky access based on the comparison of access behavior data and initial access rights, timely adjusting user access rights, ensuring that data can be timely isolated and protected when threatened.
It realizes refined and dynamic management of user access rights in electronic work ticket systems, improves system security, reduces the risk of data leakage or abuse, and improves user experience and work efficiency.
Smart Images
Figure CN119622771A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of work order management, and in particular to a method, product, device and medium for dynamically managing personnel access rights. Background Art
[0002] With the acceleration of enterprise informatization, electronic work order systems, as an important tool for internal enterprise management, are widely used in multiple links such as fault reporting, task allocation, and process tracking. However, while improving work efficiency, traditional electronic work order systems are relatively rigid in the management of personnel access rights. They usually adopt a preset fixed permission allocation mode, which is difficult to adapt to the dynamic changes of enterprise business and the needs of personnel role adjustment in real time. This static permission management method not only limits the flexible access to system resources, but may also cause information security risks or low work efficiency due to overly broad or narrow permissions. Summary of the invention
[0003] In order to solve the problem of lack of flexibility in permission management in the prior art, the present application provides a method, product, device and medium for dynamic management of personnel access rights.
[0004] In the first aspect, the present application provides a method for dynamically managing personnel access rights, using the following technical solutions: A method for dynamically managing personnel access rights, comprising: Obtaining the login request information received by the electronic work order system, and determining whether the login request information is a legitimate login request; When the login request information is a legitimate login request, determining the corresponding initial access rights according to the access ID in the login request information; Obtaining access behavior data of the electronic work order system after the access ID successfully logs in, and determining whether the access behavior data is a risky access based on the access behavior data and the initial access rights; When the access behavior data is risky access, the initial access permission is adjusted to obtain an adjusted dynamic access permission, and the electronic work order system is controlled to open data corresponding to the dynamic access permission to the access ID.
[0005] By adopting the above technical solution, the legitimacy of the login request information is verified, illegal users or unauthorized access attempts are effectively blocked, the system is protected from potential security threats, the user identity is determined through access ID identification and initial access rights are assigned, the security and privacy protection of data are improved, the user's access behavior data is monitored, and potential risky access is identified based on the comparison between the access behavior data and the initial access rights. When risky access is detected, the user's access rights are adjusted in a timely manner to ensure that the data can be isolated and protected in time when threatened, reducing the risk of data leakage or abuse, and realizing refined and dynamic management of user access rights in the electronic work order system, thereby improving the security of the system, as well as user experience and work efficiency.
[0006] In a preferred example, the present application may be further configured as follows: determining whether the access behavior data is a risky access based on the access behavior data and the initial access permission includes: Compare the access behavior data with the initial access rights to obtain access success data and failed click data for which the access ID does not have access rights; Determine the first access number corresponding to the successful access data and the risk index corresponding to the failed click data; determining an access failure rate of the access ID according to the first access number and the risk index; It is determined whether the access failure rate exceeds a preset failure rate threshold, and if so, the access behavior data is determined as risky access.
[0007] By adopting the above technical solution, the access behavior data is compared with the initial access rights, and clicks with and without access rights are accurately identified. The first number of accesses for successful access data and the risk index of failed click data are determined. The access behavior is quantitatively evaluated from two dimensions: access frequency and potential harm of failed access. The number of access attempts and the severity of each failed attempt are considered at the same time, making the judgment result more scientific and reasonable. If the access failure rate exceeds the preset failure rate threshold, the system will promptly identify the access behavior data as risky access and take corresponding security measures to intervene before the risk occurs and reduce potential security losses.
[0008] In a preferred example, the present application may be further configured to: determine the risk index corresponding to the failed click data, including: Determine the second access number corresponding to the failed click data; Obtaining the importance of the electronic work order corresponding to each click in the failed click data, wherein the importance is determined according to the number of persons associated with the click content and the urgency; According to the importance of each electronic work order in the failed click data, the second access number is adjusted to obtain a risk index corresponding to the failed click data.
[0009] By adopting the above technical solution, the frequency of failed clicks is considered to obtain the second number of visits, and the importance is calculated in combination with the specific content of the electronic work order. This allows a more comprehensive assessment of the risk of the access behavior, and the second number of visits is adjusted according to the importance of the electronic work order. Different weights are assigned to different access behaviors, making the risk assessment more in line with actual conditions.
[0010] In a preferred example, the present application may be further configured as follows: the adjusting the initial access rights to obtain the adjusted dynamic access rights includes: For any electronic work order associated with the initial access permission, determining the processing status of the electronic work order and the number of associated personnel; The initial access rights are adjusted according to the processing status of each electronic work order and the number of associated personnel to obtain adjusted dynamic access rights, and the range of the adjusted dynamic access rights is smaller than the initial access rights before the adjustment.
[0011] By adopting the above technical solution, considering the processing status of the electronic work order and the number of associated personnel, the system can dynamically adjust the access rights to adapt to changing business needs. The adjusted dynamic access rights range is smaller than the initial access rights before the adjustment to reduce potential security risks.
[0012] In a preferred example, the present application may be further configured as follows: the determining whether the login request information is a legitimate login request includes: Obtaining the access ID and access source in the login request information; Compare the access ID with the preset ID whitelist to obtain an ID determination result; Acquire historical access source data corresponding to the electronic work order system, and determine whether the access source is legitimate based on the historical access source data and the access source; If the ID determination result is that the access ID is in the preset ID whitelist and the access source is legal, the login request information is determined to be a legal login request.
[0013] By adopting the above technical solution and verifying the access ID and access source at the same time, the system can implement a double security verification mechanism, which can more effectively resist illegal login attempts than a single verification method, such as impersonating a user or obtaining access rights through illegal means, thereby reducing the risk of the system being attacked.
[0014] In a preferred example, the present application may be further configured as follows: the step of judging whether the access source is legitimate based on the historical access source data and the access source includes: Identifying an initial abnormal access source in the historical access source data, wherein the initial abnormal access source is an access source with abnormal access; For any initial abnormal access source, obtain the total number of accesses and the number of abnormal accesses of the initial abnormal access source within a preset time period, and determine the abnormal access rate based on the total number of accesses and the number of abnormal accesses; Determine an abnormal access source set from the multiple initial abnormal access sources according to the abnormal access quantities and abnormal access rates respectively corresponding to the multiple initial abnormal access sources; The access source is compared with the abnormal access source set. If the access source is not in the abnormal access source set, the access source is determined to be legal.
[0015] By adopting the above technical solution, identifying the initial abnormal access sources in the historical access source data, and calculating the total number of accesses and the number of abnormal accesses from these sources within a preset time period, the system can more accurately evaluate the degree of abnormality of each access source. The abnormal access rate calculated based on the total number of accesses and the number of abnormal accesses provides the system with a quantitative indicator to evaluate the legitimacy of the access source, and more comprehensively reflects the risk level of the access source.
[0016] In a preferred example, the present application may be further configured as follows: determining the corresponding initial access rights according to the access ID in the login request information includes: Determine the type of person to whom the access ID in the login request belongs, where the type of person is one of a user, an administrator, and a processor; When the personnel type is a user, determining the organization to which the personnel type belongs, and determining the electronic work order data associated with the organization in the database of the electronic work order system as accessible data; When the personnel type is a processing personnel, determining the electronic work order data associated with the processing personnel in the database as accessible data; When the personnel type is a manager, determining the accessible data corresponding to the processing personnel associated with the manager in the database as the accessible data corresponding to the manager; The access rights of the accessible data are opened to obtain the initial access rights corresponding to the access ID.
[0017] By adopting the above technical solution, different types of personnel are distinguished and different initial access rights are assigned to different types of users, ensuring that each user can only access relevant electronic work order data within the scope of his or her responsibilities, thereby effectively preventing data leakage and abuse.
[0018] In a second aspect, the present application provides a computer program product, which adopts the following technical solution: A computer program product includes a computer program. When the computer program is executed by a processor, the method for dynamically managing personnel access rights as described in any one of the first aspects is implemented.
[0019] In a third aspect, the present application provides an electronic device, which adopts the following technical solution: one or more processors; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the method for dynamically managing personnel access rights as described in any one of the first aspects.
[0020] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium stores a computer program, which, when executed in a computer, causes the computer to execute the method for dynamically managing personnel access rights as described in any one of the first aspects.
[0021] In a fifth aspect, the present application provides a device for dynamically managing personnel access rights, which adopts the following technical solution: A device for dynamically managing personnel access rights, comprising: A legality determination module, used to obtain the login request information received by the electronic work order system, and determine whether the login request information is a legal login request; An authority determination module, used to determine the corresponding initial access authority according to the access ID in the login request information when the login request information is a legitimate login request; A risk judgment module, used to obtain the access behavior data of the electronic work order system after the access ID successfully logs in, and judge whether the access behavior data is a risky access based on the access behavior data and the initial access rights; The permission adjustment module is used to adjust the initial access permission when the access behavior data is risk access, obtain the adjusted dynamic access permission, and control the electronic work order system to open the data corresponding to the dynamic access permission to the access ID.
[0022] In summary, this application includes the following beneficial technical effects: This application verifies the legitimacy of login request information, effectively blocks illegal users or unauthorized access attempts, protects the system from potential security threats, identifies users through access ID identification and assigns initial access rights, improves data security and privacy protection, monitors user access behavior data, identifies potential risky access based on the comparison between access behavior data and initial access rights, and adjusts user access rights in a timely manner when risky access is detected to ensure that data can be isolated and protected in a timely manner when threatened, reducing the risk of data leakage or abuse, and achieving refined and dynamic management of user access rights in the electronic work order system, thereby improving system security, user experience, and work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] Figure 1 It is a flowchart of a method for dynamically managing personnel access rights provided in an embodiment of the present application; Figure 2 It is a structural diagram of a device for dynamically managing personnel access rights provided in an embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0024] The following is combined with Figure 1 -Attached Figure 3 This application is described in further detail.
[0025] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, those skilled in the art may make modifications to the present embodiment without any creative contribution as needed, but such modifications are protected by the patent law as long as they are within the scope of the claims of the present application.
[0026] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0027] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.
[0028] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.
[0029] The present application embodiment provides a method for dynamically managing personnel access rights, such as Figure 1 As shown, the method provided in the embodiment of the present application is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application. The method includes S101-S104, wherein: S101. Obtain login request information received by the electronic work order system, and determine whether the login request information is a legal login request.
[0030] The electronic device receives login request information submitted by the user through the front page of the electronic work order system. The login request information may include a user name and a password. The user name and password may be combined into a unique user ID for indicating the identity information of the accessing party. The user ID is compared with a preset ID whitelist pre-stored in the database of the electronic device to obtain an ID determination result. The ID determination result is used to indicate whether the user ID is in the preset ID whitelist.
[0031] Furthermore, the access source corresponding to the user ID can also be obtained. The access source can refer to the client information (IP address, device information, etc.) that initiates the login request, and determine whether the access source is legal. If the ID determination result is that the access ID is in the preset ID whitelist and the access source is legal, the login request information is confirmed as a legal login request.
[0032] If the ID determination result is that the access ID is not in the preset ID whitelist or the access source is illegal, the login request information will be determined as an illegal login request and the user ID will be denied access to the electronic work order system.
[0033] S102: When the login request information is a legitimate login request, determine the corresponding initial access permission according to the access ID in the login request information.
[0034] Specifically, a corresponding identity tag is set for each user ID in the preset ID whitelist according to the identity information of different personnel. The identity tag is used to characterize the personnel type, and the personnel type can be one of a user, a manager, and a processor.
[0035] The electronic device may pre-store accessible data types corresponding to each personnel type. When the personnel type corresponding to the user ID is determined, the access rights of the accessible data related to the user ID corresponding to the accessible data type are opened to obtain the initial access rights of the user ID.
[0036] S103, obtaining the access behavior data of the electronic work order system after the access ID successfully logs in, and judging whether the access behavior data is a risky access based on the access behavior data and the initial access rights.
[0037] Specifically, an update frequency can be pre-set to dynamically update user access rights. The electronic device obtains access behavior data of the electronic work order system after the access ID successfully logs in according to the update frequency. For example, assuming that the time of successful access ID login is 1:00, and the update frequency is every 30 minutes, the access behavior data of the electronic work order system after the access ID successfully logs in can be obtained for the first time at 1:30, that is, the access behavior data from 1:00 to 1:30.
[0038] The access behavior data of the user ID to the electronic work order system is monitored through log recording or behavior analysis technology. The access behavior data includes the pages visited, the links clicked, the operations attempted, etc. The access behavior data is compared with the initial access rights to identify the data of successful access and the data of failed access (that is, the data that the user tried to access but did not have the permission to access). Then, based on the successful access data and the failed access data, it is determined whether the access behavior data is a risky access.
[0039] S104. When the access behavior data is a risky access, the initial access rights are dynamically adjusted according to the comparison result to obtain the adjusted dynamic access rights, and the electronic work order system is controlled to open the data corresponding to the dynamic access rights to the access ID.
[0040] Specifically, determine each electronic work order associated with the initial access permission, and use the access permission for the data associated with each electronic work order as the initial sub-access permission corresponding to the electronic work order. For any electronic work order, determine the processing status and the number of associated personnel of the electronic work order, and adjust the initial sub-access permission based on the processing status and the number of associated personnel to obtain the adjusted dynamic sub-access permission with a smaller permission range corresponding to the electronic work order. The dynamic sub-access permission corresponding to each electronic work order constitutes the adjusted dynamic access permission.
[0041] This embodiment effectively blocks illegal users or unauthorized access attempts by verifying the legitimacy of login request information, protects the system from potential security threats, determines user identity through access ID identification and assigns initial access rights, improves data security and privacy protection, monitors user access behavior data, identifies potential risky access based on the comparison between access behavior data and initial access rights, and adjusts user access rights in a timely manner when risky access is detected to ensure that data can be isolated and protected in a timely manner when threatened, reduces the risk of data leakage or abuse, and implements refined and dynamic management of user access rights in the electronic work order system, thereby improving system security, user experience, and work efficiency.
[0042] A possible implementation of the embodiment of the present application is to determine whether the login request information is a legitimate login request, including: Get the access ID and access source in the login request information; Compare the access ID with the preset ID whitelist to obtain the ID determination result; Obtain the historical access source data corresponding to the electronic work order system, and determine whether the access source is legitimate based on the historical access source data and the access source; If the ID determination result is that the access ID is in the preset ID whitelist and the access source is legitimate, the login request information is determined to be a legitimate login request.
[0043] In this embodiment, the request body and request header in the login request information can be parsed by the API gateway to extract the access ID and access source. A data record of historical access sources can be maintained in advance in the electronic device, which can be a database table for storing the access source information of successful logins and failed login attempts before each access ID and the corresponding timestamp. The historical access source data can be a data record of historical access sources within a period of time before the current moment. This embodiment does not limit the specific length of a period of time. Optionally, a period of time can be one month.
[0044] By simultaneously verifying the access ID and the access source, the system in this embodiment can implement a double security verification mechanism, which can more effectively resist illegal login attempts, such as impersonating a user or obtaining access rights through illegal means, than a single verification method, thereby reducing the risk of the system being attacked.
[0045] A possible implementation of the embodiment of the present application is to determine whether the access source is legitimate according to the historical access source data and the access source, including: Identify the initial abnormal access source in the historical access source data, where the initial abnormal access source is the access source with abnormal access; For any initial abnormal access source, obtain the total number of accesses and the number of abnormal accesses of the initial abnormal access source within a preset time period, and determine the abnormal access rate based on the total number of accesses and the number of abnormal accesses; Determine an abnormal access source set from the multiple initial abnormal access sources according to the abnormal access quantities and abnormal access rates corresponding to each of the multiple initial abnormal access sources; The access source is compared with the abnormal access source set. If the access source is not in the abnormal access source set, the access source is determined to be legal.
[0046] In this embodiment, the criteria for constituting abnormal access can be predefined, such as too many failed logins, abnormal access time (such as frequent access late at night), sudden changes in geographic location, etc. This embodiment does not limit the criteria for determining abnormal access, and managers can set it according to actual needs. The historical access source data contains historical access records for each access ID, and each record contains information such as access time, access source, and access result (success / failure). Traverse the historical access records, and for records that meet the abnormal access criteria, mark them as abnormal access, and mark the access source with abnormal access as the initial abnormal access source. The initial abnormal access source represents the suspected abnormal access source.
[0047] Furthermore, abnormal access rate = abnormal access number + total access number. The abnormal access rate threshold and abnormal access number threshold can be pre-set. For any initial abnormal access source, the abnormal access number of the initial abnormal access source is compared with the abnormal access number threshold, and the abnormal access rate of the initial abnormal access source is compared with the abnormal access rate threshold. If the abnormal access number of the initial abnormal access source does not exceed the abnormal access number threshold and the abnormal access rate does not exceed the abnormal access rate threshold, the initial abnormal access source is determined to be a normal access source. If the abnormal access number of the initial abnormal access source exceeds the abnormal access number threshold and the abnormal access rate exceeds the abnormal access rate threshold, the initial abnormal access source is determined to be an abnormal access source. All abnormal access sources are screened out from the initial abnormal access sources to obtain a set of abnormal access sources.
[0048] By identifying the initial abnormal access sources in the historical access source data and calculating the total number of accesses and the number of abnormal accesses from these sources within a preset time period, the system can more accurately evaluate the abnormality of each access source. The abnormal access rate calculated based on the total number of accesses and the number of abnormal accesses provides the system with a quantitative indicator to evaluate the legitimacy of the access source, and more comprehensively reflects the risk level of the access source.
[0049] A possible implementation of the embodiment of the present application is to determine the corresponding initial access rights according to the access ID in the login request information, including: Determine the person type to which the access ID in the login request belongs, where the person type is one of a user, an administrator, and a processor; When the personnel type is a user, determining the organization to which the personnel type belongs, and determining the electronic work order data associated with the organization in the database of the electronic work order system as accessible data; When the personnel type is a processing personnel, the electronic work order data associated with the processing personnel in the database is determined as accessible data; When the personnel type is a manager, the accessible data corresponding to the processing personnel associated with the manager in the database is determined as the accessible data corresponding to the manager; Open the access rights to the accessible data and obtain the initial access rights corresponding to the access ID.
[0050] In this embodiment, the user is the basic user of the electronic work order system and is the party that submits the work order request. The user may submit a work order due to a technical problem, service request or other situation that requires support, and can usually only view and submit the processing progress and processing results of the electronic work order related to himself. The manager is responsible for supervising and managing the operation of the entire electronic work order system. The manager can usually view the processing progress and processing results of the electronic work order submitted by the user and the electronic work order processed by the processor. The processor is the person responsible for processing the electronic work order. The processor performs corresponding work according to the content of the electronic work order, such as solving problems, providing services, etc. The processor can only view and process the electronic work orders assigned to him, as well as the relevant information and history of these work orders.
[0051] When a user ID logs into the electronic work order system, the electronic device obtains the identity tag associated with the user ID and determines the personnel type corresponding to the identity tag.
[0052] When the personnel type is user, the electronic device queries the user information table to obtain the ID or name of the organization to which the user belongs, and then queries the database to filter out all electronic work orders associated with the organization (i.e., electronic work orders issued by personnel of the organization) as accessible data.
[0053] When the personnel type is a processing personnel, the electronic device searches the database for all electronic work orders associated with the processing personnel, that is, the electronic work order data processed, being processed, and not processed by the processing personnel as accessible data.
[0054] When the personnel type is a manager, management relationship information is pre-stored in the database, including a number of processing personnel managed by each manager, and the processing personnel associated with the manager are the number of processing personnel managed by the manager.
[0055] The accessible data may also include system data associated with the electronic work order system, such as help documents and knowledge bases, for all personnel to review, which is not specifically limited in this embodiment.
[0056] This embodiment distinguishes different types of personnel and assigns different initial access rights to different types of users, ensuring that each user can only access relevant electronic work order data within the scope of his or her responsibilities, thereby effectively preventing data leakage and abuse.
[0057] A possible implementation of the embodiment of the present application is to determine whether the access behavior data is a risky access based on the access behavior data and the initial access permission, including: Compare the access behavior data with the initial access permissions to obtain the successful access data and the failed click data where the access ID does not have access permissions; Determine the first access number corresponding to the successful access data and the risk index corresponding to the failed click data; Determine the access failure rate of the access ID according to the first access number and the risk index; Determine whether the access failure rate exceeds a preset failure rate threshold. If so, determine the access behavior data as risky access.
[0058] In this embodiment, an access behavior log table can be set in the electronic device to record the time of each access, access ID, accessed resources, operation type and other information. Each time an access occurs, the electronic device queries the initial access permission of the access ID and compares it with the operation in the access behavior log. If the operation is within the initial access permission, the access is marked as successful access data; if the operation is not within the initial access permission, the access is marked as failed click data.
[0059] Further, the access success data and failed click data are traversed, the number of successful operations is counted, and the first access number is obtained. For failed click data, the calculation of the risk index can be based on multiple factors, such as the number of failures, the sensitivity of failed operations, etc., and these factors are combined to obtain a risk index. The access failure rate of the access ID is calculated using the first access number and the risk index, and the access failure rate = risk index / (first access number + risk index) × 100%. The preset failure rate threshold can be manually set according to actual experience, and this embodiment does not make a specific limitation.
[0060] If the access failure rate does not exceed the preset failure rate threshold, the access behavior data is determined as non-risk access. At this time, the initial access rights are not adjusted.
[0061] This embodiment compares the access behavior data with the initial access rights, accurately identifies clicks that meet the rights and those that do not, determines the first number of accesses for successful access data and the risk index of failed click data, and quantitatively evaluates the access behavior from two dimensions: access frequency and potential harm of failed access. It also considers the number of access attempts and the severity of each failed attempt, making the judgment result more scientific and reasonable. If the access failure rate exceeds the preset failure rate threshold, the system will promptly determine the access behavior data as risky access, and take corresponding security measures to intervene before the risk occurs, thereby reducing potential security losses.
[0062] A possible implementation of the embodiment of the present application is to determine the risk index corresponding to the failed click data, including: Determine the second visit number corresponding to the failed click data; Obtain the importance of the electronic work order corresponding to each click in the failed click data. The importance is determined according to the number of people associated with the click content and the urgency. According to the importance of each electronic work order in the failed click data, the second access number is adjusted to obtain the risk index corresponding to the failed click data.
[0063] In this embodiment, the number of times a user ID attempts to access but does not have permission is counted as the second number of accesses. For each failed click data, the corresponding electronic work order information is queried to obtain the number of associated personnel of the electronic work order, that is, the number of all personnel with query or processing permissions. The urgency of the electronic work order is evaluated, which can be obtained by checking the status, deadline, whether it is marked as urgent, and other fields of the electronic work order.
[0064] The criterion for judging the degree of urgency can be set flexibly, and this embodiment does not specifically limit it. Optionally, the first score is set according to the status of the electronic work order, the second score is set according to the deadline of the electronic work order, and the third score is set according to whether the electronic work order is marked as urgent. Specifically, when the status of the electronic work order is processed and completed, the first score is determined to be 0, and when the status of the electronic work order is being processed or unprocessed, the first score is determined to be 1; when the time difference between the deadline of the electronic work order and the current moment is less than a certain time difference (such as 3 days), the second score is determined to be 1, and when the deadline is not less than the certain time difference, the second score is determined to be 0; when the electronic work order is marked as urgent, the third score is set to 1, and when the electronic work station is not marked as urgent, the third score is set to 0. Then, the sum of the first score, the second score and the third score is used as the degree of urgency.
[0065] Further, for any electronic work order associated with the failed click data, the number of personnel associated with the electronic work order and the degree of urgency are weighted and summed to obtain the importance of the electronic work order, and the specific weight is not specifically limited in this embodiment. The sum of the importance corresponding to each electronic work order in the failed click data is calculated, and the sum of the importance and the second number of visits is used as the risk index corresponding to the failed click data.
[0066] This embodiment not only considers the frequency of failed clicks to obtain the second number of visits, but also calculates the importance in combination with the specific content of the electronic work order. It can more comprehensively evaluate the risk of the access behavior, adjust the second number of visits according to the importance of the electronic work order, and assign different weights to different access behaviors, so that the risk assessment is more in line with the actual situation.
[0067] A possible implementation of the embodiment of the present application is to adjust the initial access rights to obtain the adjusted dynamic access rights, including: For any electronic work order associated with the initial access rights, determine the processing status of the electronic work order and the number of associated personnel; The initial access rights are adjusted according to the processing status of each electronic work order and the number of associated personnel to obtain adjusted dynamic access rights, and the range of the adjusted dynamic access rights is smaller than the initial access rights before the adjustment.
[0068] In this embodiment, each electronic work order associated with the initial access permission is traversed. For any electronic work order, the processing status of the electronic work order includes whether the processing is completed or not completed. The average value of the number of associated personnel for each electronic work order is calculated, and the obtained average value is used as the personnel number threshold. The number of associated personnel of the electronic work order is compared with the personnel number threshold to obtain a comparison result.
[0069] The electronic work orders associated with the initial access rights are grouped, wherein the first group includes electronic work orders whose processing status is completed and electronic work orders whose processing status is unprocessed but the number of associated personnel does not exceed the threshold number of personnel, and the second group includes electronic work orders whose processing status is unprocessed and the number of associated personnel exceeds the threshold number of personnel. Then, the permissions corresponding to the electronic work orders in the first group are closed, and the permissions of the electronic work orders in the second group are adjusted to view only. If the user ID wants greater access rights, it is necessary to resubmit the permission application to the electronic device and perform security verification. The method of security verification can be manually set according to the actual business situation, and this embodiment does not make specific limitations.
[0070] This embodiment takes into account the processing status of the electronic work order and the number of associated personnel. The system can dynamically adjust access rights to adapt to changing business needs. The adjusted dynamic access rights range is smaller than the initial access rights before the adjustment to reduce potential security risks.
[0071] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the contents shown in the aforementioned embodiment of the method for dynamically managing personnel access rights are implemented.
[0072] The above embodiment introduces a method for dynamically managing personnel access rights from the perspective of method flow, and the following embodiment introduces a device for dynamically managing personnel access rights from the perspective of a virtual module or a virtual unit. For details, please refer to the following embodiment.
[0073] The present application embodiment provides a device for dynamically managing personnel access rights, such as Figure 2 As shown, the device may include: The legality determination module 201 is used to obtain the login request information received by the electronic work order system and determine whether the login request information is a legal login request; The permission determination module 202 is used to determine the corresponding initial access permission according to the access ID in the login request information when the login request information is a legitimate login request; The risk judgment module 203 is used to obtain the access behavior data of the electronic work order system after the access ID successfully logs in, and judge whether the access behavior data is a risky access based on the access behavior data and the initial access rights; The permission adjustment module 204 is used to adjust the initial access permission when the access behavior data is risky access, obtain the adjusted dynamic access permission, and control the electronic work order system to open the data corresponding to the dynamic access permission to the access ID.
[0074] An electronic device is provided in an embodiment of the present application, such as Figure 3 As shown, Figure 3The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.
[0075] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.
[0076] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but it does not mean that there is only one bus or only one type of bus.
[0077] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.
[0078] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the content shown in the embodiment of the method for dynamically managing personnel access rights.
[0079] Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.
[0080] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer-readable storage medium is run on a computer, the computer can execute the contents shown in the aforementioned embodiment of the method for dynamically managing personnel access rights.
[0081] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.
[0082] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.
Claims
1. A method for dynamically managing personnel access rights, characterized in that: include: Obtaining the login request information received by the electronic work order system, and determining whether the login request information is a legitimate login request; When the login request information is a legitimate login request, determining the corresponding initial access rights according to the access ID in the login request information; Obtaining access behavior data of the electronic work order system after the access ID successfully logs in, and determining whether the access behavior data is a risky access based on the access behavior data and the initial access rights; When the access behavior data is risky access, the initial access permission is adjusted to obtain an adjusted dynamic access permission, and the electronic work order system is controlled to open data corresponding to the dynamic access permission to the access ID.
2. The method for dynamic management of personnel access rights according to claim 1, characterized in that: The determining, based on the access behavior data and the initial access permission, whether the access behavior data is a risky access includes: Compare the access behavior data with the initial access rights to obtain access success data and failed click data for which the access ID does not have access rights; Determine the first access number corresponding to the successful access data and the risk index corresponding to the failed click data; determining an access failure rate of the access ID according to the first access number and the risk index; It is determined whether the access failure rate exceeds a preset failure rate threshold, and if so, the access behavior data is determined as risky access.
3. The method for dynamic management of personnel access rights according to claim 2, characterized in that: Determining the risk index corresponding to the failed click data includes: Determine the second access number corresponding to the failed click data; Obtaining the importance of the electronic work order corresponding to each click in the failed click data, wherein the importance is determined according to the number of persons associated with the click content and the urgency; According to the importance of each electronic work order in the failed click data, the second access number is adjusted to obtain a risk index corresponding to the failed click data.
4. The method for dynamically managing personnel access rights according to claim 1, characterized in that: The adjusting the initial access rights to obtain adjusted dynamic access rights includes: For any electronic work order associated with the initial access permission, determining the processing status of the electronic work order and the number of associated personnel; The initial access rights are adjusted according to the processing status of each electronic work order and the number of associated personnel to obtain adjusted dynamic access rights, and the range of the adjusted dynamic access rights is smaller than the initial access rights before the adjustment.
5. The method for dynamically managing personnel access rights according to claim 1, characterized in that: The determining whether the login request information is a legitimate login request includes: Obtaining the access ID and access source in the login request information; Compare the access ID with the preset ID whitelist to obtain an ID determination result; Acquire historical access source data corresponding to the electronic work order system, and determine whether the access source is legitimate based on the historical access source data and the access source; If the ID determination result is that the access ID is in the preset ID whitelist and the access source is legal, the login request information is determined to be a legal login request.
6. The method for dynamic management of personnel access rights according to claim 5, characterized in that: The determining whether the access source is legal according to the historical access source data and the access source includes: Identifying an initial abnormal access source in the historical access source data, wherein the initial abnormal access source is an access source with abnormal access; For any initial abnormal access source, obtain the total number of accesses and the number of abnormal accesses of the initial abnormal access source within a preset time period, and determine the abnormal access rate based on the total number of accesses and the number of abnormal accesses; Determine an abnormal access source set from the multiple initial abnormal access sources according to the abnormal access quantities and abnormal access rates respectively corresponding to the multiple initial abnormal access sources; The access source is compared with the abnormal access source set. If the access source is not in the abnormal access source set, the access source is determined to be legal.
7. The method for dynamically managing personnel access rights according to claim 1, characterized in that: Determining the corresponding initial access rights according to the access ID in the login request information includes: Determine the type of person to whom the access ID in the login request belongs, where the type of person is one of a user, an administrator, and a processor; When the personnel type is a user, determining the organization to which the personnel type belongs, and determining the electronic work order data associated with the organization in the database of the electronic work order system as accessible data; When the personnel type is a processing personnel, determining the electronic work order data associated with the processing personnel in the database as accessible data; When the personnel type is a manager, determining the accessible data corresponding to the processing personnel associated with the manager in the database as the accessible data corresponding to the manager; The access rights of the accessible data are opened to obtain the initial access rights corresponding to the access ID.
8. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the steps of the method for dynamically managing personnel access rights according to any one of claims 1 to 7.
9. An electronic device, characterized in that: include: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the method for dynamically managing personnel access rights as described in any one of claims 1-7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed in a computer, the computer is caused to execute the method for dynamically managing personnel access rights according to any one of claims 1 to 7.