Permission exception query method and device and computer equipment

Abstract

The invention relates to a permission exception query method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the steps of displaying query information corresponding to a permission query operation in response to the triggered permission query operation, and identifying each information item in the query information through an identification model to obtain business key information and intention information corresponding to the query information; and searching target permission data corresponding to the intention information from a service system, and displaying a permission exception query result corresponding to the query information based on the target permission data and the service key information. By adopting the method, the processing efficiency of the authority exception query can be effectively improved, and convenience is brought to the user.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer device, computer-readable storage medium and computer program product for querying abnormal permissions. Background Art

[0002] With the development of computer technology and Internet technology, the advent of the 5G era, and the emergence of the Internet, modern life has been greatly facilitated. More and more companies can use different enterprise-level application software to share information, communicate emotions, process business, etc., bringing convenience to users. In the current enterprise-level application software, the system permissions are assigned by the administrator (or super administrator) on the management page, and business personnel can use system functions according to the assigned permissions. For example, the enterprise-level application software used by users may be an enterprise resource planning (ERP) system. Due to the complexity of the ERP system, permission control is also very complex. The authorization function often has permission mismatches, resulting in the inability of users to display functions, data, or document fields due to various reasons such as unauthorized or prohibited permissions when using the system.

[0003] However, in the current query method of permission anomalies, when a user has a permission anomaly, a manual investigation is usually adopted, that is, the administrator (or super administrator) is required to investigate one by one from the scattered authorization pages. Since some business systems involve many different types of authorization functions, it is easy to cause the permission anomaly investigation to be very complicated and time-consuming, especially when the users using the business system change frequently. When each user has a permission anomaly, the administrator needs to frequently perform the above series of tedious operations, and performing the above series of tedious operations is time-consuming and takes a long time to process, which easily leads to low query efficiency of permission anomalies. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for querying abnormal permissions in response to the above-mentioned technical problems, which can effectively improve the processing efficiency of abnormal permission queries and bring convenience to users.

[0005] In the first aspect, the present application provides a method for querying permission exceptions, comprising: in response to a triggered permission query operation, displaying query information corresponding to the permission query operation; identifying each information item in the query information through an identification model to obtain business-critical information and intent information corresponding to the query information; searching for target permission data corresponding to the intent information from a business system; and displaying permission exception query results corresponding to the query information based on the target permission data and the business-critical information.

[0006] In the second aspect, the present application also provides a query device for permission exceptions, including: a display module, used to respond to a triggered permission query operation and display query information corresponding to the permission query operation; an identification module, used to identify each information item in the query information through an identification model, and obtain business-critical information and intent information corresponding to the query information; a search module, used to search for target permission data corresponding to the intent information from a business system; the display module is also used to display the permission exception query results corresponding to the query information based on the target permission data and the business-critical information.

[0007] In the third aspect, the present application also provides a computer device, including a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program: in response to a triggered permission query operation, displaying query information corresponding to the permission query operation; identifying each information item in the query information through an identification model to obtain business-critical information and intent information corresponding to the query information; searching for target permission data corresponding to the intent information from a business system; and displaying permission exception query results corresponding to the query information based on the target permission data and the business-critical information.

[0008] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, which implements the following steps when executed by a processor: in response to a triggered permission query operation, displaying query information corresponding to the permission query operation; identifying each information item in the query information through an identification model to obtain business-critical information and intent information corresponding to the query information; searching for target permission data corresponding to the intent information from a business system; and displaying permission exception query results corresponding to the query information based on the target permission data and the business-critical information.

[0009] In a fifth aspect, the present application also provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps: in response to a triggered permission query operation, display query information corresponding to the permission query operation; identify each information item in the query information through an identification model to obtain business-critical information and intent information corresponding to the query information; search for target permission data corresponding to the intent information from a business system; and based on the target permission data and the business-critical information, display the permission exception query results corresponding to the query information.

[0010] The above-mentioned permission anomaly query method, apparatus, computer equipment, computer-readable storage medium and computer program product, by responding to a triggered permission query operation, display query information corresponding to the permission query operation, and identify each information item in the query information through a recognition model to obtain business-critical information and intent information corresponding to the query information; search for target permission data corresponding to the intent information from the business system, and display the permission anomaly query result corresponding to the query information based on the target permission data and business-critical information. Since the recognition model is pre-trained and can be used to identify the business-critical information and intent information corresponding to the query information, in response to the permission query operation triggered by the operator, after obtaining the query information corresponding to the permission query operation, the recognition model can be automatically called, and the recognition model can be used to quickly and effectively identify each information item in the query information, so as to obtain accurate business-critical information and intent information corresponding to the query information, and then obtain real-time target permission data from the business system based on the intent information, and determine the permission exception query result corresponding to the query information based on the business-critical information and the target permission data obtained in real time. Without manual intervention, the permission exception to be queried in the query information can be automatically checked, which effectively improves the processing efficiency of permission exception queries, and displays the details of the query results visually, bringing convenience to users. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0012] Figure 1 This is an application environment diagram of a method for querying abnormal permissions in an embodiment;

[0013] Figure 2 A flowchart of a method for querying abnormal permissions in one embodiment;

[0014] Figure 3 A schematic diagram of an interface for inputting query information in an embodiment;

[0015] Figure 4 This is a schematic diagram of an interface display after a permission query operation is triggered in a business application in one embodiment;

[0016] Figure 5 A schematic diagram of the overall process of a method for querying abnormal permissions provided in one embodiment;

[0017] Figure 6 A schematic diagram of an interface display of permission abnormality query results in one embodiment;

[0018] Figure 7 A schematic diagram of an interface display of a data authority exception query result in one embodiment;

[0019] Figure 8 This is a schematic diagram of an interface display of permission abnormality query results in another embodiment;

[0020] Fig. 9 A schematic diagram of manually troubleshooting permission anomalies in a traditional manner in an embodiment;

[0021] Fig.10 A technical implementation diagram of a method for AI to locate ERP authority anomalies in an embodiment;

[0022] Fig.11 It is a structural block diagram of a query device for abnormal authority in one embodiment;

[0023] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0025] It should be noted that in the following description, the terms "first, second and third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first, second and third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0026] The method for querying abnormal permissions provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 can be a background server of the business system. The terminal 102 responds to the triggered permission query operation, displays the query information corresponding to the permission query operation, and identifies each information item in the query information through the recognition model. After obtaining the business key information and intent information corresponding to the query information, the terminal 102 can search for the target permission data corresponding to the intent information from the business system, that is, the server 104, and based on the target permission data and business key information, display the permission exception query result corresponding to the query information.

[0027] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0028] In an exemplary embodiment, Figure 2 As shown, a method for querying abnormal permissions is provided. The method can be executed by a server or a terminal alone, or by a server and a terminal together. Figure 1 The terminal in the example is used to illustrate, including the following steps 202 to 208. Among them:

[0029] Step 202: In response to the triggered permission query operation, query information corresponding to the permission query operation is displayed.

[0030] Among them, the permission query operation refers to the operation triggered by the operator (user) for querying the permissions of one or more account information. For example, the permission query operation in this application may refer to: the query operation of different types of permissions for a certain account information in the ERP business system (or business application) triggered by the operator (such as an administrator) in the permission exception troubleshooting page. The triggering operation of the operator (user) can trigger a trigger event in the terminal, namely a screen input event (Input event). Trigger events may include click events (click events), touch events (touch events), touch events (tap events), sliding events (swipe events), etc., that is, users can perform different trigger operations on the terminal device. For example, the permission query operation in this application may include trigger operations such as click operations, sliding operations, long press operations, and shake operations.

[0031] It can be understood that the permission query operation in the present application includes query operations for different types of permissions. For example, the permission query operation in the present application may include: query operations for functional permissions of account information, query operations for data permissions of account information, and query operations for field permissions of account information.

[0032] Query information refers to the information to be queried input by the operator (user). For example, the query information in this application can be a query statement. Figure 3 As shown in the figure, it is a schematic diagram of the interface for inputting query information, that is, the operator (such as an administrator) can Figure 3 In the permission exception troubleshooting page shown, the query statement for data permissions for a certain account information (i.e., for user "Xiao A") in the ERP business system is "Xiao A's permission to view sales orders placed by Global Group."

[0033] Optionally / exemplarily, the terminal responds to the permission query operation triggered by the operator (user) in the business application (or business system), and displays the query information corresponding to the permission query operation on the page. That is, the user can log in to a business application through the trigger operation. Further, the user can enter the page with the "permission abnormality query or permission query" function through the trigger operation in the page displayed by the business application. Further, the user can trigger the permission query operation in the page with the "permission abnormality query or permission query" function, and the terminal responds to the permission query operation and displays the query information corresponding to the permission query operation, so that the user can check again whether the query information entered is correct.

[0034] For example, Figure 4As shown in the figure, it is a schematic diagram of the interface display after the permission query operation is triggered in the business application. User A (operator) can start the business application A in the terminal by triggering the operation and log in to the business application A by entering the account and password. Figure 3 In the business application page shown, user A can first enter the query statement he wants to query, such as "Xiao A's viewing authority for sales orders placed in Global Group", and then click Figure 3 The icon for initiating a permission query request shown in the lower right corner of the figure is displayed. The terminal responds to the permission query operation triggered by user A. Figure 4 The page (loading page) shown in FIG. 1 shows the query statement corresponding to the permission query operation and the query status (such as querying). For example, Figure 4 The loading page shown in FIG. 1 shows the query statement "Xiao A's permission to view sales orders placed by Global Group" and the query status is "Loading", that is, the terminal responds to the "Permission Query" operation triggered by user A (operator) in the business application page and jumps to the following page: Figure 4 The loading page shown in Figure 4 The loading page shown displays the query information "Xiao A's viewing rights for sales orders placed at Global Group" and the real-time query status "Loading".

[0035] Step 204: Identify each information item in the query information using the recognition model to obtain business-critical information and intent information corresponding to the query information.

[0036] Among them, the recognition model refers to: a trained model obtained by pre-training based on sample data in the business system, for example, sample data is extracted from the business system in advance, and the sample data is imported into the initial model for training until the training stop condition is met, and a trained recognition model can be obtained. It can be understood that the recognition model in this application is used to identify various business key information in the query information, as well as the query intent information corresponding to the query information.

[0037] Information items refer to different types of information contained in the query information. For example, each information item in the query information in this application includes at least account information, document information and / or permission items.

[0038] Account information refers to the account information corresponding to the query information. In some cases, the account information in this application may include an object identifier (user name) and an organization identifier (organization name). For example, the account information in this application may include user information (i.e. object information) and organization information. Organization information refers to the organizational structure information to which the user (object) belongs. For example, if the account information includes "Xiao A" and "Global Group", "Xiao A" is the user information and "Global Group" is the organization information.

[0039] Document information refers to the document information contained in the query information. In some cases, the document information in this application may be a document name (document identifier). The document information in this application may include different types of document information. For example, the document information contained in the query information "Xiao A's viewing authority for sales orders placed in Global Group" is: sales order, that is, the document information can be used to identify the type of document. For another example, the document information contained in the query information "Jin xx's data submission authority for the purchase order number BY-766 placed in the Sales Department" is: purchase order.

[0040] A permission item refers to an entry used to represent different types of permissions that a user can operate. For example, the permission items in this application include but are not limited to: viewing permission (item), review permission (item), data submission permission (item), etc.

[0041] Business-critical information refers to key information extracted from query information. For example, the business-critical information in this application includes at least: account information (including user ID and organization ID), document information (document ID) and permission items (permission item ID, i.e., operation permission ID).

[0042] Intent information refers to identifying the intent of the query information. For example, the intent information in this application is mainly used to identify which permission type the permission queried by the query information belongs to. For example, in this application, query statement 1 is identified through the recognition model, and it is identified that the permission queried by the query statement 1 belongs to the functional permission type, that is, the intent information is the functional permission type. It can be understood that the permission types in this application include at least functional permission types, data permission types, and field permission types.

[0043] Specifically, the terminal responds to the permission query operation triggered by the operator (user) in the business application (or business system), and after displaying the query information corresponding to the permission query operation on the page, the terminal can call the recognition model, and identify the query information through the recognition model to obtain the intent information corresponding to the query information, and the intent information is used to reflect the permission type to which the queried permission belongs; further, the terminal can further identify each information item in the query information (such as account information, document information, and permission items) through the recognition model to obtain the business-critical information corresponding to the query information.

[0044] For example, Figure 5As shown, it is a schematic diagram of the overall process of the query method for permission anomalies provided by the present application, which includes processing procedures such as intent recognition, business data recognition, model scheduling, and permission anomaly conclusion output. Assuming that the query information 1 input by the operator (user) is "Xiao A's permission to view sales orders placed by Global Group", the terminal can call the recognition model and identify the query information 1 through the recognition model, and obtain the intent information corresponding to the query information 1 as "Intent Figure 1 (Functional permission type)", the intent information is used to reflect that the permission type of the queried permission is a functional permission type; further, the terminal can further identify the account information "Xiao A is under Global Group", the document information "sales order" and the permission item "view permission" in the query information 1 through the recognition model, so as to obtain the business key information corresponding to the query information 1 including: user information: Xiao A, organization information: Global Group, document information: sales order, permission item: view permission.

[0045] Step 206: Search the business system for target authority data corresponding to the intention information.

[0046] The business system in the present application may be an Enterprise Resource Planning (ERP) system, which may be deployed on a specific server.

[0047] The target permission data refers to a certain type of permission data corresponding to the intent information, that is, the permission data corresponding to the permission type queried as reflected by the intent information. It can be understood that the target permission data in this application includes but is not limited to: functional permission data, data permission data, and field permission data. For example, when the permission type to which the query information queried as reflected by the intent information belongs is data permission, the target permission data is the data permission data obtained from the business system.

[0048] Specifically, the terminal uses the recognition model to identify the account information, document information and permission items in the query information respectively. After obtaining the business key information and intent information corresponding to the query information, the terminal can interact with the business system and search for target permission data corresponding to the identified intent information from the business system. For example, the terminal can obtain real-time field permission data (i.e., target permission data) from the ERP system through a plug-in and format it into a data format that conforms to the recognition model.

[0049] For example, Figure 5As shown in the figure, it is a schematic diagram of the overall process of the query method for abnormal permissions provided by the present application. Assuming that the query information 1 input by the operator (user) is "Xiao A's permission to view sales orders placed by Global Group", the terminal identifies the query information 1 through the recognition model, and obtains the business key information corresponding to the query information 1, including: user information: Xiao A, organization information: Global Group, document information: sales order, permission item: view permission, and intention information is "intention Figure 1 (Function permission type)”, the terminal can further search for the intent information, namely “intent Figure 1 (Functional permission type)" corresponding to the target permission data, that is, the terminal can search the specific functional permission data corresponding to "Xiao A in Global Group" in real time from the business system.

[0050] Step 208: Based on the target authority data and business key information, the authority exception query result corresponding to the query information is displayed.

[0051] Among them, the permission abnormality query result refers to the permission-related information queried based on the query information, such as Figure 6 As shown, it is a schematic diagram of the interface display of the permission abnormality query result. The permission abnormality query result corresponding to the query information displayed in this application may include: the permission source of different permission items, whether the queried permission item has permission, and other result information.

[0052] Specifically, after the terminal searches the business system for the target permission data corresponding to the identified intent information, the terminal can determine the permission exception query result corresponding to the query information based on the target permission data and business key information, and display the permission exception query result corresponding to the determined query information. For example, assuming that the query information 1 input by the operator (user) is "Xiao A's permission to view sales orders placed at Global Group", the terminal identifies the query information 1 through the recognition model, and obtains the business key information corresponding to the query information 1, including: user information: Xiao A, organization information: Global Group, document information: sales order, permission item: view permission, and intent information is " Figure 1 (Function permission type)”, the terminal can further search for the intent information, namely “intent Figure 1 (Functional permission type)", that is, the terminal can search the specific functional permission data corresponding to "Xiao A is under Global Group" from the business system in real time. When the terminal finds the specific functional permission data corresponding to "Xiao A is under Global Group" from the business system in real time, the terminal can determine the permission abnormality query result corresponding to the query information 1 based on the found target permission data and business key information, and display the determined permission abnormality query result corresponding to the query information, that is, Figure 6The "Xiao A's permission to view sales orders placed by Global Group" is shown as "authorized", and the permission comes from the "full-function role", so that the operator can further determine the specific reason for the abnormality of "Xiao A's permission to view sales orders placed by Global Group".

[0053] In this embodiment, by responding to the triggered permission query operation, the query information corresponding to the permission query operation is displayed, and each information item in the query information is identified by the recognition model, so as to obtain the business key information and intention information corresponding to the query information; the target permission data corresponding to the intention information is searched from the business system, and the permission abnormality query result corresponding to the query information is displayed based on the target permission data and the business key information. Since the recognition model is pre-trained and can be used to identify the business key information and intention information corresponding to the query information, the recognition model can be automatically called after the query information corresponding to the permission query operation is obtained in response to the permission query operation triggered by the operator, and the account information, document information and permission items in the query information are quickly and effectively identified by the recognition model, so as to obtain the accurate business key information and intention information corresponding to the query information, and then obtain the real-time target permission data from the business system based on the intention information, and determine the permission abnormality query result corresponding to the query information based on the business key information and the real-time target permission data, without manual intervention, the automatic completion of the permission abnormality to be queried in the query information can be realized, which effectively improves the processing efficiency of the permission abnormality query, and visualizes the details of the query result, which brings convenience to the user.

[0054] In an exemplary embodiment, the query information includes a query statement, and the query statement includes account information, document information and / or permission items; the steps of identifying each information item in the query information by using a recognition model to obtain business key information and intent information corresponding to the query information include:

[0055] The query statement is identified through the recognition model to obtain the intent information corresponding to the query statement; the intent information is used to reflect the permission type to which the permission queried by the query statement belongs;

[0056] The account information, document information and / or permission items in the query statement are respectively identified through the recognition model to obtain the business key information corresponding to the query statement.

[0057] Specifically, let's take the abnormal function permission as an example. Assuming that the query statement 1 entered by the operator (user) is "Xiao A's permission to view sales orders placed by Global Group", the terminal can call the recognition model and identify the query statement 1 through the recognition model, and obtain the intent information corresponding to the query statement 1 as "Intent Figure 1(Functional permission type)", the intent information is used to reflect that the permission type to which the queried permission belongs is a functional permission type. For example, the intent information in this application may at least include: intent information for querying functional permissions, intent information for querying data permissions, and intent information for querying field permissions; further, the terminal may further identify the account information in query statement 1, i.e. "Xiao A is under Global Group", the document information, i.e. "sales order", and the permission item, i.e. "view permission", through the recognition model, to obtain the business key information corresponding to the query information 1, including: user information: Xiao A, organization information: Global Group, document information: sales order, permission item: view permission. It can be understood that the account information in this application At least user information (i.e. object information) and organization information may be included. For example, the account information in this application may include an object identifier (user name) and an organization identifier (organization name). Document information may include a document name, an alias (i.e. document alias), etc., and permission items may include permission names (document permission names), field names, document field names, application identifiers, etc. As a result, by utilizing a specifically trained recognition model, the model can be helped to more accurately identify business content and output conclusions. Without manual intervention, the query information can be automatically checked for permission anomalies, effectively improving the processing efficiency of permission anomaly queries, and visually displaying the details of the query results, bringing convenience to users.

[0058] In one exemplary embodiment, the business key information includes at least an object identifier, an organization identifier, a document identifier, and an operation authority identifier; and the steps of respectively identifying the account information, the document information, and the authority item in the query statement through the recognition model to obtain the business key information corresponding to the query statement include:

[0059] The account information in the query statement is identified by the recognition model to obtain the object identifier and organization identifier corresponding to the query statement;

[0060] Identify the document information in the query statement through the recognition model to obtain the document identification corresponding to the query statement; and / or

[0061] The permission items in the query statement are identified through the recognition model to obtain the operation permission identifier corresponding to the query statement.

[0062] Specifically, let's take the abnormal function permission as an example. Assuming that the query statement 1 entered by the operator (user) is "Xiao A's permission to view sales orders placed by Global Group", the terminal can call the recognition model and identify the query statement 1 through the recognition model, and obtain the intent information corresponding to the query statement 1 as "Intent Figure 1(Functional permission type)", the terminal can further identify the account information in query statement 1, i.e. "Xiao A is under Global Group", the document information, i.e. "sales order", and the permission item, i.e. "view permission", through the recognition model. Figure 6 As shown in , the terminal identifies the account information "Xiao A is under the Global Group" in the query statement 1 through the recognition model, and obtains the object identifier corresponding to the query statement 1 as: Xiao A, and the organization identifier as: 100000; at the same time, the terminal identifies the document information "sales order" in the query statement through the recognition model, and obtains the document identifier (document code) corresponding to the query statement 1 as: sm_100; and the terminal identifies the permission item "view permission" in the query statement 1 through the recognition model, and obtains the operation permission identifier corresponding to the query statement 1 as: view. That is, the object identifier in the embodiment of the present application may at least include personal name information, user identifier, user name, etc., the organization identifier may at least include the organization name, the department identifier under the organizational structure, etc., the document identifier may at least include the document number, document name, alias (i.e., document alias), document coding information, etc., and the operation permission identifier may include different types of operation permission identifiers, such as document permission names, etc. As a result, by utilizing a specifically trained recognition model, the model can be helped to more accurately identify business content and output conclusions. Without human intervention, it can automatically complete the troubleshooting of permission anomalies in the query information, effectively improving the processing efficiency of permission anomaly queries and visually displaying the details of the query results, bringing convenience to users.

[0063] In an exemplary embodiment, the permission query operation is triggered by the first operator; the step of identifying the account information in the query statement by using the recognition model to obtain the object identifier and organization identifier corresponding to the query statement includes:

[0064] When the account information in the query statement is empty, the first account information of the first operator is used as the account information in the query statement, and the first account information is identified by the recognition model to obtain the object identifier and organization identifier corresponding to the query statement;

[0065] When the account information in the query statement is not empty, the account information is identified through the recognition model to obtain the object identifier and organization identifier corresponding to the query statement.

[0066] Specifically, let's take the abnormal function permission as an example. Assuming that the query statement 1 entered by the operator (user) is "Xiao A's permission to view sales orders placed by Global Group", the terminal can call the recognition model and identify the query statement 1 through the recognition model, and obtain the intent information corresponding to the query statement 1 as "Intent Figure 1(Functional permission type)", since query statement 1 "Xiao A's permission to view sales orders placed by Global Group" contains account information, that is, the account information in query statement 1 is not empty, the terminal can further identify the account information "Xiao A is under Global Group" in query statement 1 through the recognition model, and obtain the object identifier corresponding to query statement 1: Xiao A and the organization identifier: 100000.

[0067] In some cases, assuming that the query statement 2 entered by the operator (user) Xiao B is "viewing authority of sales orders", the terminal can call the recognition model and identify the query statement 2 through the recognition model, and obtain the intent information corresponding to the query statement 2 as "intent Figure 1 (Functional permission type)", since the query statement 2 "Viewing permission of sales orders" does not contain account information, that is, the account information in query statement 2 is empty, the terminal can obtain the account information of the operator who triggers the permission query operation, that is, the first account information is: Xiao B is under the Global Group, and the first account information of the current operator Xiao B is used as the account information in query statement 2, that is, query statement 2 is essentially "the viewing permission of the operator's sales order", that is, the terminal can further identify the account information "Xiao B is under the Global Group" of query statement 2 through the recognition model, and obtain the object identifier corresponding to query statement 2: Xiao B and the organization identifier: 100000. As a result, by using a specifically trained recognition model, the model can be helped to more accurately identify business content and output conclusions without manual intervention. Even if the input query information is a fuzzy query, it can also automatically complete the troubleshooting of permission anomalies to be queried in the query information, effectively improving the processing efficiency of permission anomaly queries, and visually displaying the details of the query results, bringing convenience to users.

[0068] In an exemplary embodiment, the permission query operation includes an information input operation and an information selection operation; the method further includes:

[0069] In response to a permission scanning operation triggered by a business application, displaying a permission scanning page;

[0070] The step of displaying query information corresponding to the permission query operation in response to the triggered permission query operation includes:

[0071] In response to an information input operation triggered by an information input box on a permission scanning page, query information collected through the information input box is displayed; or,

[0072] In response to an information selection operation triggered in the query information recommendation area of ​​the permission scanning page, a recommended query statement specified by the information selection operation is displayed as input query information.

[0073] Among them, the permission scanning page refers to a page with the "permission abnormality query or permission query" function, that is, a page used to trigger the permission abnormality query processing flow. For example, the permission scanning page in this application can be as follows Figure 3 The page shown in .

[0074] Specifically, the terminal responds to the permission scanning operation triggered by the operator (user) in the business application and displays the following Figure 3 The permission scanning page with the function of "permission abnormality query or permission query" shown in the figure; further, the user can Figure 3 The permission query operation is triggered in the permission scanning page with the "permission abnormality query or permission query" function shown in FIG. Figure 3 The information input operation is triggered by the information input box in the bottom area of ​​the permission scanning page shown in FIG. 1 , and the query information collected through the information input box is displayed as "Xiao A's permission to view sales orders placed by Global Group"; or, the terminal responds to the user in the following manner: Figure 3 The query information recommendation area of ​​the permission scanning page shown (the preset area of ​​the page is Figure 3 The information selection operation is triggered by the middle area of ​​the page, and the recommended query statement specified by the information selection operation is displayed as the input query information. For example, the user can Figure 3 The query information recommendation area of ​​the permission scanning page shown (the preset area of ​​the page is Figure 3 In the middle area of ​​the page, the terminal selects the sample query statement "query authority of Jin xx's sales order under the customer department", then the terminal responds to the above information selection operation triggered by the user, and displays the recommended query statement "query authority of Jin xx's sales order under the customer department" specified in the information selection operation as the input query information, so that the user can edit it twice or reuse it directly. As a result, by providing users with different ways of determining query information, the interactivity with users is enhanced. Even for some users who have query ideas but cannot edit effective query information well, relevant guidance or recommendations can be made for the vague query demands of these users, and relevant query statement recommendations can be provided, thereby effectively improving the experience of abnormal query of permissions for these users, thereby bringing convenience to users.

[0075] In an exemplary embodiment, the target permission data includes function permission data, data permission data and field permission data; the step of searching the target permission data corresponding to the intention information from the business system includes:

[0076] When the permission type to which the permission queried by the query information reflected by the intent information belongs is a functional permission, the target permission data corresponding to the intent information is searched from the business system as the functional permission data;

[0077] When the permission type to which the permission queried by the query information reflected in the intention information belongs is data permission, the target permission data corresponding to the intention information is searched from the business system as data permission data;

[0078] When the permission type to which the permission queried by the query information reflected by the intent information belongs is field permission, the target permission data corresponding to the intent information is searched from the business system as field permission data.

[0079] Specifically, Figure 5 As shown in the figure, it is a schematic diagram of the overall process of the query method for abnormal permissions provided by the present application. Assuming that the query information 1 input by the operator (user) is "Xiao A's permission to view sales orders placed by Global Group", the terminal identifies the query information 1 through the recognition model, and obtains the business key information corresponding to the query information 1, including: user information: Xiao A, organization information: Global Group, document information: sales order, permission item: view permission, and intention information is "intention Figure 1 (Function permission type)”, the terminal can further search for the intent information, namely “intent Figure 1 (Functional permission type)" corresponding to the target permission data, that is, the terminal can search the specific functional permission data corresponding to "Xiao A in Global Group" in real time from the business system.

[0080] For example, Figure 7 As shown in the figure, it is a schematic diagram of the interface display of data permission abnormality query results. Figure 7 As shown in the figure, assuming that the query information 2 entered by the operator (user) is "Xiao A's data review authority for the sales order number BY-766 placed at Global Group", the terminal identifies the query information 2 through the recognition model, and obtains the business key information corresponding to the query information 2 including: user information: Xiao A, organization information: Global Group, document information: sales order, authority item: data review authority, and intent information is "Intent Figure 2 (Data permission type)”, the terminal can further search for the intent information, namely “intent Figure 2 (data permission type)", that is, the terminal can search the specific data permission data corresponding to "Xiao A is under Global Group" from the business system in real time.

[0081] For example, Figure 8 As shown in FIG. 1 , another schematic diagram of the interface display of the abnormal permission query result is shown. Assume that the query information 3 input by the operator (user) is as follows: Figure 8As shown in the figure "Xiao A's permission to view the creator field on the sales order placed by Global Group", the terminal identifies the query information 3 through the recognition model, and obtains the business key information corresponding to the query information 3, including: user information: Xiao A, organization information: Global Group, document information: sales order, permission item: view permission, document field: creator, and intent information "intent Figure 3 (Field permission type)”, the terminal can further search for the intent information, namely “intent Figure 3 (field permission type)", that is, the terminal can search the specific field permission data corresponding to "Xiao A is under Global Group" in the business system in real time. As a result, by combining model recognition with the business system, the intelligent scanning of automatic permission anomalies is realized. Without manual intervention, the permission anomalies to be queried in the query information can be automatically checked, which effectively improves the processing efficiency of permission anomaly queries and brings convenience to users.

[0082] In an exemplary embodiment, the step of displaying the permission abnormality query result corresponding to the query information based on the target permission data and the business key information includes:

[0083] When the target authority data corresponding to the intention information is found in the business system, the authority exception query result corresponding to the query information is determined based on the target authority data and the object identifier, organization identifier, document identifier and operation authority identifier in the business key information, and the authority exception query result is displayed; wherein the authority information in the authority exception query result is authorized;

[0084] When the target permission data corresponding to the intent information is not found in the business system, the permission exception query result corresponding to the query information is determined based on the object identifier, organization identifier, document identifier and operation permission identifier in the business key information, and the permission exception query result is displayed; among which, the permission information in the permission exception query result is no permission.

[0085] Among them, the types of permission exceptions in this application include at least functional permission exceptions, data permission exceptions and field permission exceptions.

[0086] Specifically, assuming that the query information 1 input by the operator (user) is "Xiao A's permission to view sales orders placed by Global Group", the terminal identifies the query information 1 through the recognition model, and obtains the business key information corresponding to the query information 1, including: user information: Xiao A, organization information: Global Group, document information: sales order, permission item: view permission, and intent information is "intent Figure 1 (Function permission type)”, the terminal can further search for the intent information, namely “intent Figure 1(Functional authority type)", that is, the terminal can search the specific functional authority data corresponding to "Xiao A is under Global Group" from the business system in real time. When the terminal finds the specific functional authority data corresponding to "Xiao A is under Global Group" from the business system in real time, the terminal can determine the authority exception query result corresponding to the query information 1 based on the object identifier, organization identifier, document identifier and operation authority identifier in the functional authority data and the key business information, and display the authority exception query result; among which, the authority information in the authority exception query result is authorized, that is, Figure 6 The "Xiao A's permission to view sales orders placed by Global Group" is shown as "authorized", and the permission comes from the "full-function role", so that the operator can further determine the specific reason for the abnormality of "Xiao A's permission to view sales orders placed by Global Group".

[0087] like Figure 8 As shown in the figure, it is a schematic diagram of the interface display of another permission abnormality query result. Assuming that the query information 1 entered by the operator (user) is "Xiao A's permission to view the creator field on the sales order placed by Global Group", the terminal identifies the query information 1 through the recognition model, and obtains the business key information corresponding to the query information 1, including: user information: Xiao A, organization information: Global Group, document information: sales order, permission item: view permission, document field: creator, and intention information "intention Figure 3 (Field permission type)”, the terminal can further search for the intent information, namely “intent Figure 3 (field permission type)", that is, the terminal can find the specific field permission data corresponding to "Xiao A is under Global Group" from the business system in real time. When the terminal does not find the specific field permission data corresponding to "Xiao A is under Global Group" from the business system in real time, the terminal can determine the permission abnormality query result corresponding to the query information 1 based on the object identifier, organization identifier, document identifier and operation permission identifier in the business key information, and display the permission abnormality query result; among which, the permission information in the permission abnormality query result is no permission. That is, Figure 8 The "Xiao A's permission to view the creator field on the sales order placed by Global Group" is displayed as "No permission" and the permission source is not displayed, so that the operator can further determine the specific reason for the abnormality of "Xiao A's permission to view the creator field on the sales order placed by Global Group". Figure 7 As shown in the figure, it is a schematic diagram of the interface display of the data permission abnormality query result, that is, Figure 7As shown in the figure, "Xiao A's data review authority for placing sales orders with number xx in Global Group" is displayed as "no authority" and the authority source is not displayed, so that the operator can further determine the specific reason for the abnormality of "Xiao A's data review authority for placing sales orders with number xx in Global Group". Therefore, by combining model recognition with the business system, the intelligent scanning of automatic authority anomalies is realized, and the authority anomalies to be queried in the query information can be automatically checked without manual intervention, which effectively improves the processing efficiency of authority anomaly queries and brings convenience to users.

[0088] The present application also provides an application scenario, and the application scenario applies the above-mentioned permission abnormality query method. Specifically, the application of the permission abnormality query method in the application scenario is as follows:

[0089] In the process of user interaction with the business information platform (ERP system), the above-mentioned query method for abnormal permissions can be used. When the user (operator) wants to view abnormal permissions, the user can open the business information platform (ERP system) on the terminal through a trigger operation and trigger a permission query operation in the business information platform (ERP system). The terminal responds to the permission query operation triggered by the user (operator) and displays the following information: Figure 4 ; further, the terminal identifies the account information, document information and permission items in the query information through the recognition model, obtains the business key information and intent information corresponding to the query information, and searches the target permission data corresponding to the intent information from the business system; based on the target permission data and business key information, the terminal displays Figure 6 The query information shown in the table shows the query result of the permission anomaly corresponding to the query information. As a result, the query information can be automatically checked for permission anomalies, which effectively improves the processing efficiency of permission anomaly queries and visualizes the details of the query results, effectively improving the user experience and bringing convenience to the user.

[0090] The method provided in the embodiment of the present application can be applied to various query scenarios of abnormal permissions. The following takes the scenario of user interaction with the ERP system as an example to illustrate the query method of abnormal permissions provided in the embodiment of the present application.

[0091] Among them, AI: Artificial Intelligence.

[0092] ERP: Enterprise Resource Planning system.

[0093] Agent: An artificial intelligence agent (AI Agent) is an intelligent entity that can perceive, make decisions, and perform actions.

[0094] MD: Markdown is a lightweight markup language that allows people to write documents in a plain text format that is easy to read and write, and then convert it into a valid XHTML (or HTML) document.

[0095] In the traditional way, system permissions are allocated by the administrator on the management page, and business personnel use system functions on the business interface according to the allocated permissions. However, due to the complexity of the ERP system, permission control is also very complicated. The authorization function often has permission mismatches, resulting in the inability of users to display functions, data or document fields due to various reasons such as unauthorized, disabled, and solution filtering when using the system. In other words, in the traditional way, when a user has permission anomalies, the common way to deal with it is for the administrator to check the authorization pages scattered around, such as Fig. 9 The figure shows a schematic diagram of manually troubleshooting permission anomalies in the traditional way.

[0096] Problems in traditional methods:

[0097] (1) Due to the large number of authorized functions, troubleshooting permission anomalies is very complicated and time-consuming;

[0098] (2) The system administrator needs to be familiar with the entire permission system to ensure the correctness of the investigation.

[0099] The technical solution provided in this application can solve the above problems through the design of an innovative and complete process:

[0100] like Fig.10 The figure shows a technical implementation diagram of a method for using AI to locate ERP permission anomalies. That is, this application provides a method for using AI to locate ERP permission anomalies, which uses an AI big model combined with an ERP system to automatically complete the troubleshooting of permission anomalies. The technical implementation process includes:

[0101] (1) Knowledge base model training: The document name, alias (i.e. document alias), permission name (operation permission), and field name in the EPR system are imported into the knowledge base for training the AI ​​model. The final results are:

[0102] 1. Document name knowledge base;

[0103] 2. Alias ​​encoding knowledge base;

[0104] 3. Document authority name knowledge base;

[0105] 4. Document field name knowledge base;

[0106] 5. Organization name knowledge base;

[0107] (2) AI prompt word roles and tasks: Using the knowledge base to identify user intent and key business information:

[0108] Intent recognition: Identify the type of permission the user inputs;

[0109] Organization matching: Matching the organization information in the input information according to the organization knowledge base data;

[0110] Name recognition: using the large model’s own capabilities to recognize name information;

[0111] Application (alias) matching: Matching application information in input information based on the alias encoding knowledge base;

[0112] Document name matching: Match the document information in the input information according to the document name knowledge base;

[0113] Permission item matching: matching the permission information in the input information according to the permission item knowledge base;

[0114] Document field matching: Match the document field information in the input information according to the document field knowledge base;

[0115] Document code recognition: Use the large model's own capabilities to recognize document code information;

[0116] Conclusion analysis: Based on the permission data returned by the functional permission agent, data permission agent, and field permission agent, AI integrates and outputs the conclusion;

[0117] (3) AI Agent Development: Agent is an intelligent entity that has the ability to handle specific scenarios, including AI recognition, use of recognition information for real-time data supplementation, necessary ERP data query and AI final integrated output.

[0118] The agents involved in this application are:

[0119] 1. Document field agent: Based on the document information identified by AI, obtain the real-time data of the document field through the plug-in, use the document field as the identification source, and submit it to AI to identify the correct field information in the user input information;

[0120] 2. Functional authority agent: Based on the tenant (organization) information, user information, document (application) information, and authority information identified by AI, it obtains real-time functional authority data from the ERP system through a plug-in and formats it into the MD data format that AI can understand;

[0121] 3. Data authority agent: Based on the tenant information, user information, document information, authority information, and document coding information identified by AI, it obtains real-time data authority data from the ERP system through a plug-in and formats it into the MD data format that AI can understand;

[0122] 4. Field Permission Agent: Based on the tenant information, user information, document information, permission information, and field information identified by AI, it obtains real-time field permission data from the ERP system through a plug-in and formats it into the MD data format that AI can understand;

[0123] (4) Intelligent Scheduling: Through the definition of task flow, the teleprompter and Agent are defined as the complete processing flow of AI permission exception scanning: the user input information recognized by AI is used as the input parameter of the functional permission agent, data permission agent, and field permission agent, and the real-time permission data is obtained from the ERP system through the plug-in, and finally integrated into a complete conclusion through the conclusion node. Figure 5 As shown in the figure, the overall task flow is divided into intent recognition, business data recognition, agent scheduling, and permission exception conclusion.

[0124] The necessary technical points involved in the technical solution of this application include:

[0125] (1) Through the combination of AI and ERP business systems, intelligent scanning of abnormal permissions is achieved.

[0126] (2) The original ERP business system functions are split into atomic services and agents are extracted. For example, user authorization needs to be performed on different function pages, such as user function permissions, full-function users, user groups, user group authorization, etc. When troubleshooting permission anomalies, if the data of different function modules are integrated for query, it will be complicated and difficult to control due to the inconsistent data structure of each function. However, common atomic services are defined for each function, such as verification query. The atomic service is not the complete function of the original document, but only the processing or query of part of the data. It can provide services to the outside world by developing atomic service interfaces. This is also the core idea of ​​reconstructing a system with AI. Then, the atomic services are integrated through AI capabilities, rather than providing new system capabilities to the outside world through data integration. This not only ensures the independence of the original functions, but also innovatively solves the customer needs of complex fusion scenarios.

[0127] (3) Specific knowledge base training helps AI identify business content and output conclusions more accurately.

[0128] (4) Through AI, the atomic agent services of multiple original complex functional modules are integrated into new service content.

[0129] The auxiliary technical points involved in the technical solution of this application include:

[0130] (1) The granularity of the agent will become more refined and accurate as the entire system becomes more AI-enabled.

[0131] (2) Currently, the AI ​​platform agent does not support the scheduling of task flows. The AI ​​platform needs to integrate the agent and the task flow before it can support the use of the agent.

[0132] The beneficial effects of the technical solution of this application include:

[0133] The use of AI technology combined with the ERP system innovatively solves the problem of difficulty in troubleshooting abnormal permissions, and also solves the problem of the original troubleshooting method being difficult to get started with and time-consuming. At the same time, through AI scheduling, the atomic Agent service of the original complex functional modules is integrated into new service content, achieving innovative use, which can effectively improve the processing efficiency of abnormal permission queries and bring better user experience.

[0134] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0135] Based on the same inventive concept, the embodiment of the present application also provides a permission abnormality query device for implementing the permission abnormality query method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more permission abnormality query devices provided below can refer to the limitations of the permission abnormality query method above, and will not be repeated here.

[0136] In an exemplary embodiment, Fig.11 As shown, a query device for abnormal permissions is provided, including: a display module 1102, an identification module 1104 and a search module 1106, wherein:

[0137] The display module 1102 is used to display query information corresponding to the permission query operation in response to the triggered permission query operation.

[0138] The identification module 1104 is used to identify each information item in the query information through a recognition model to obtain business-critical information and intent information corresponding to the query information.

[0139] The search module 1106 is used to search the target permission data corresponding to the intention information from the business system.

[0140] The display module 1102 is also used to display the permission anomaly query result corresponding to the query information based on the target permission data and business key information.

[0141] In one embodiment, the query information includes a query statement, which contains account information, document information and / or permission items; the identification module is also used to identify the query statement through a recognition model to obtain intention information corresponding to the query statement; the intention information is used to reflect the permission type to which the permission queried by the query statement belongs; the account information, document information and / or permission items in the query statement are identified respectively through the recognition model to obtain business-critical information corresponding to the query statement.

[0142] In one embodiment, the business-critical information includes at least an object identifier, an organization identifier, a document identifier and an operation authority identifier; the identification module is also used to identify the account information in the query statement through the identification model to obtain the object identifier and the organization identifier corresponding to the query statement; identify the document information in the query statement through the identification model to obtain the document identifier corresponding to the query statement; and / or identify the permission item in the query statement through the identification model to obtain the operation authority identifier corresponding to the query statement.

[0143] In one embodiment, the permission query operation is triggered by a first operator; the identification module is also used to, when the account information in the query statement is empty, use the first account information of the first operator as the account information in the query statement, and identify the first account information through the identification model to obtain the object identifier and the organization identifier corresponding to the query statement; when the account information in the query statement is not empty, identify the account information through the identification model to obtain the object identifier and the organization identifier corresponding to the query statement.

[0144] In one embodiment, the permission query operation includes an information input operation and an information selection operation; in response to a permission scanning operation triggered by a business application, a permission scanning page is displayed; the display module is also used to respond to the information input operation triggered by the information input box on the permission scanning page, and display the query information collected through the information input box; or, in response to the information selection operation triggered in the query information recommendation area on the permission scanning page, the recommended query statement specified by the information selection operation is displayed as the input query information.

[0145] In one embodiment, the target permission data includes functional permission data, data permission data and field permission data; the search module is also used to search the target permission data corresponding to the intention information from the business system as the functional permission data when the permission type of the permission queried by the query information reflected by the intention information is functional permission; when the permission type of the permission queried by the query information reflected by the intention information is data permission, search the target permission data corresponding to the intention information from the business system as the data permission data; when the permission type of the permission queried by the query information reflected by the intention information is field permission, search the target permission data corresponding to the intention information from the business system as the field permission data.

[0146] In one embodiment, the display module is also used to determine the permission exception query result corresponding to the query information based on the target permission data and the object identifier, organization identifier, document identifier and operation authority identifier in the business key information when the target permission data corresponding to the intention information is found from the business system, and display the permission exception query result; wherein, the permission information in the permission exception query result is authorized; when the target permission data corresponding to the intention information is not found from the business system, the permission exception query result corresponding to the query information is determined based on the object identifier, organization identifier, document identifier and operation authority identifier in the business key information, and display the permission exception query result; wherein, the permission information in the permission exception query result is unauthorized.

[0147] Each module in the above-mentioned permission abnormality query device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0148] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal or a server. In this embodiment, the computer device is described as a terminal. The internal structure diagram thereof may be as follows: Fig.12 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for querying abnormal permissions is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0149] Those skilled in the art will understand that Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0150] In an exemplary embodiment, in one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0151] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0152] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0153] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0154] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0155] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0156] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for querying abnormal permissions, characterized in that: The method comprises: In response to the triggered permission query operation, displaying query information corresponding to the permission query operation; Identify each information item in the query information through the recognition model to obtain business key information and intent information corresponding to the query information; Searching for target permission data corresponding to the intention information from the business system; Based on the target permission data and the business key information, the permission anomaly query result corresponding to the query information is displayed.

2. The method according to claim 1, characterized in that The query information includes a query statement, and the query statement includes account information, document information and / or permission items; The identifying model is used to identify each information item in the query information to obtain business key information and intent information corresponding to the query information, including: The query statement is identified by a recognition model to obtain intent information corresponding to the query statement; the intent information is used to reflect the permission type to which the permission queried by the query statement belongs; The account information, document information and / or permission items in the query statement are respectively identified through the identification model to obtain the business key information corresponding to the query statement.

3. The method according to claim 2, characterized in that The business key information includes at least an object identifier, an organization identifier, a document identifier, and an operation authority identifier; The account information, document information and permission items in the query statement are respectively identified by the identification model to obtain key business information corresponding to the query statement, including: Identify the account information in the query statement by using the recognition model to obtain the object identifier and the organization identifier corresponding to the query statement; Identify the document information in the query statement by using the recognition model to obtain the document identifier corresponding to the query statement; and / or The permission item in the query statement is identified by the identification model to obtain the operation permission identifier corresponding to the query statement.

4. The method according to claim 3, characterized in that The permission query operation is triggered by the first operator; the identifying the account information in the query statement by the identification model to obtain the object identifier and the organization identifier corresponding to the query statement includes: When the account information in the query statement is empty, taking the first account information of the first operator as the account information in the query statement, and identifying the first account information through the recognition model to obtain the object identifier and the organization identifier corresponding to the query statement; When the account information in the query statement is not empty, the account information is identified by the identification model to obtain the object identifier and the organization identifier corresponding to the query statement.

5. The method according to claim 1, characterized in that The permission query operation includes an information input operation and an information selection operation; the method also includes: In response to a permission scanning operation triggered by a business application, displaying a permission scanning page; The step of displaying query information corresponding to the permission query operation in response to the triggered permission query operation includes: In response to the information input operation triggered by the information input box on the permission scanning page, displaying the query information collected through the information input box; or, In response to the information selection operation triggered in the query information recommendation area of ​​the permission scanning page, the recommended query statement specified by the information selection operation is displayed as the input query information.

6. The method according to claim 1, characterized in that The step of displaying the permission abnormality query result corresponding to the query information based on the target permission data and the business key information includes: When the target permission data corresponding to the intention information is found in the business system, based on the target permission data and the object identifier, organization identifier, document identifier and operation permission identifier in the business key information, the permission abnormality query result corresponding to the query information is determined, and the permission abnormality query result is displayed; wherein the permission information in the permission abnormality query result is that there is permission; When the target permission data corresponding to the intention information is not found in the business system, the permission exception query result corresponding to the query information is determined based on the object identifier, organization identifier, document identifier and operation permission identifier in the business key information, and the permission exception query result is displayed; wherein the permission information in the permission exception query result is no permission.

7. A query device for abnormal permissions, characterized in that: The device comprises: A display module, configured to display query information corresponding to the permission query operation in response to the triggered permission query operation; An identification module, used to identify the account information, document information and permission items in the query information respectively through an identification model, and obtain business key information and intent information corresponding to the query information; A search module, used to search the target authority data corresponding to the intention information from the business system; The display module is also used to display the permission anomaly query result corresponding to the query information based on the target permission data and the business key information.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images