Adaptive authority management method and system based on strategy mode

Abstract

The invention provides a self-adaptive authority management method based on a strategy mode, which can be applied to the technical field of information security and authority management, and comprises the following steps: acquiring an authority verification demand of a user; based on the authority verification requirement of the user, a corresponding strategy class is selected from a strategy library through a preset strategy context manager, the strategy library comprises a plurality of independently packaged strategy classes, and each strategy class comprises a corresponding authority verification strategy; calling the selected strategy class through an execution engine and executing an authority verification algorithm corresponding to the authority verification strategy to obtain a verification result of the authority verification demand; and sending the verification result to the user. The invention further provides an adaptive authority management system based on the strategy mode. According to the method, the self-adaptive capability of authority management is improved, so that a proper strategy can be automatically selected according to different service scenes and user requirements, and the expandability of the system is enhanced.

Description

Technical Field

[0001] The present disclosure relates to the technical field of information security and authority management, and more specifically to a policy-based adaptive authority management method and system. Background Art

[0002] With the rapid development of information technology, various information systems and applications are becoming increasingly complex, and permission management has become an important part of ensuring system security and data security. Traditional permission management methods often use fixed roles to assign permissions, which is difficult to adapt to complex and changing business scenarios and user needs. Especially in large enterprises or organizations, frequent changes and dynamic adjustments to user permissions have become a major challenge. Therefore, there is an urgent need for a method that can adapt to different business scenarios and user needs and flexibly adjust permission verification strategies to improve the efficiency and security of permission management. Summary of the invention

[0003] In view of the above problems, the present disclosure provides an adaptive permission management method and system based on a policy model.

[0004] According to the first aspect of the present disclosure, there is provided an adaptive permission management method based on a policy pattern, the method comprising: obtaining a user's permission verification requirements; based on the user's permission verification requirements, selecting a corresponding policy class from a policy library through a preset policy context manager, wherein the policy library comprises a plurality of independently encapsulated policy classes, and each policy class comprises a corresponding permission verification policy; obtaining a verification result of the permission verification requirement by calling the selected policy class through an execution engine and executing a permission verification algorithm corresponding to the permission verification policy; and sending the verification result to the user.

[0005] According to the embodiments of the present disclosure, the policy interface of any policy class is the same, and the calling method of the permission verification policy in any policy class is the same.

[0006] According to an embodiment of the present disclosure, the permission verification strategy includes role-based access control, attribute-based access control and behavior-based access control.

[0007] According to an embodiment of the present disclosure, based on the user's permission verification requirements, a corresponding policy class is selected from a policy library through a preset policy context manager, including: based on user information, resource information and environmental information, a corresponding policy class is selected from the policy library according to a preset decision logic.

[0008] According to an embodiment of the present disclosure, the policy interface defines at least one permission verification algorithm, and the permission verification algorithm includes: taking user information, resource information and environment information as input parameters respectively to obtain a verification result.

[0009] According to an embodiment of the present disclosure, the selected policy class is called by the execution engine and the permission verification algorithm corresponding to the permission verification policy is executed, including: caching preset permission verification results, and recording each permission verification process and the corresponding permission verification result.

[0010] According to an embodiment of the present disclosure, the verification result includes clear information of allowing access, denying access and pending review.

[0011] The second aspect of the present disclosure provides an adaptive permission management system based on a policy pattern, the system comprising: a requirement acquisition module, used to obtain the user's permission verification requirements; a policy class selection module, used to select a corresponding policy class from a policy library based on the user's permission verification requirements through a preset policy context manager, wherein the policy library includes a plurality of independently encapsulated policy classes, each policy class includes a corresponding permission verification policy; an execution engine module, used to call the selected policy class through an execution engine and execute the permission verification algorithm corresponding to the permission verification policy to obtain a verification result of the permission verification requirement; and a verification result feedback module, used to send the verification result to the user.

[0012] According to an embodiment of the present disclosure, the system also includes a performance monitoring module for collecting performance indicators of the rights management system in real time and triggering an alarm mechanism when the system performance reaches or exceeds a preset threshold.

[0013] According to an embodiment of the present disclosure, the system also includes an intelligent optimization module for analyzing performance indicator data and user feedback using a machine learning algorithm and automatically adjusting the logic and parameters of the policy context manager. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0015] Figure 1 A flowchart of a policy-based adaptive rights management method according to an embodiment of the present disclosure is schematically shown;

[0016] Figure 2 The framework diagram of the adaptive rights management system based on the policy mode according to the embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0017] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0018] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0019] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0020] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0021] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some blocks or combinations thereof in the block diagrams and / or flow charts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that these instructions can create a device for implementing the functions / operations described in these block diagrams and / or flow charts when executed by the processor. The technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure can take the form of a computer-readable storage medium storing instructions, on which executable instructions are stored, which, when executed by the processor, causes the processor to perform the method of the present disclosure.

[0022] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0023] An embodiment of the present disclosure provides an adaptive permission management method based on a policy pattern, comprising: obtaining a user's permission verification requirements; based on the user's permission verification requirements, selecting a corresponding policy class from a policy library through a preset policy context manager, wherein the policy library includes a plurality of independently encapsulated policy classes, and each policy class includes a corresponding permission verification policy; calling the selected policy class through an execution engine and executing a permission verification algorithm corresponding to the permission verification policy to obtain a verification result of the permission verification requirement; and sending the verification result to the user.

[0024] Through the embodiments of the present disclosure, a flexible and scalable adaptive permission management method based on a policy pattern is provided, which can meet the permission management requirements in different business scenarios. The method encapsulates the permission management policy into independently replaceable components through the introduction of the policy pattern, thereby realizing the flexible configuration and dynamic adjustment of the permission management logic. This design not only improves the adaptive ability of permission management, enabling it to automatically select appropriate policies according to different business scenarios and user needs, but also enhances the scalability of the system, facilitating the addition of new policies and the optimization of existing policies in the future.

[0025] Figure 1 The flowchart of the adaptive permission management method based on the policy mode according to the embodiment of the present disclosure is schematically shown.

[0026] like Figure 1 As shown, in the embodiment of the present disclosure, the adaptive permission management method based on the policy pattern, the process may further include S110~S140.

[0027] In operation S110, the user's authority verification requirement is obtained.

[0028] Specifically, users have different permission verification requirements in different business scenarios. The scenarios of permission verification are not limited to access permission verification, but can also include a variety of other scenarios. For example, some common permission verification scenarios include: access control, confirming whether the user has the right to access specific resources or functions, such as files, database records, API interfaces, etc.; role permission management, assigning different permissions according to user roles (such as administrators, ordinary users, visitors), ensuring that different roles can perform different operations; operation permissions, verifying the user's permissions for specific operations, such as the right to add, edit or delete data; time restrictions, allowing or prohibiting certain operations within a specific time period, such as resources accessible during working hours; geographic location restrictions, controlling access rights based on the user's geographic location, ensuring that only users in a specific area can access certain resources. Therefore, permission verification is a security measure involving multiple levels to ensure the security and integrity of systems and data.

[0029] After obtaining the user's requirements, permission verification is performed, which is explained in detail below.

[0030] In operation S120 , based on the user's authority verification requirements, a corresponding policy class is selected from a policy library through a preset policy context manager.

[0031] In an embodiment of the present disclosure, based on the user's authority verification requirements, a corresponding policy class is selected from a policy library through a preset policy context manager.

[0032] Specifically, the policy library is pre-built first, and a series of standard permission verification policies are pre-defined, such as role-based access control (RBAC), attribute-based access control (ABAC), behavior-based access control (PBAC), etc. Each policy is encapsulated as an independent policy class. That is, the policy library includes multiple independently encapsulated policy classes, and each policy class includes a corresponding permission verification policy.

[0033] It should be noted that the policy interface of any policy class is the same, and the calling method of the permission and authorization verification policy in any policy class is the same. That is, all policy classes define a unified policy interface to ensure that all permission and authorization verification policies follow the same calling method, which is convenient for the preset policy context manager to call.

[0034] In an embodiment of the present disclosure, the policy interface defines one or more algorithms for permission verification, such as a validate algorithm, which receives a user identifier, an operation type, and a resource name as input and returns a permission verification result.

[0035] In the embodiments of the present disclosure, multiple specific permission verification policy classes are implemented according to business requirements, which implement the policy interface and provide specific permission verification logic. For example, there may be role-based permission policies, rule-based permission policies, etc.

[0036] Based on the above description, according to different business needs, create specific permission verification policy classes by implementing the policy interface. Each policy class contains specific verification logic and can handle different types of permission verification requirements. During the initialization or configuration phase of permission verification, register the specific policy class with the policy context manager. The registration process can be static (through configuration files or hard coding) or dynamic (through runtime loading).

[0037] It should be noted that the policy interface can be a standardized policy extension interface, allowing third-party developers or internal enterprise teams to develop new permission verification policies based on specific needs and easily integrate them into existing systems.

[0038] In an embodiment of the present disclosure, the policy context manager is obtained by presetting.

[0039] For example, the policy context manager can be implemented by using technologies such as decision trees, rule engines, or machine learning algorithms. The policy context manager selects appropriate permission verification policies based on the current environment or conditions and manages the life cycle of these policies. It contains references to one or more policy instances and can dynamically switch policies based on demand.

[0040] In the embodiment of the present disclosure, based on user information, resource information and environment information, a corresponding policy class is selected from a policy library according to a preset decision logic.

[0041] Specifically, based on parameters such as user attributes, resource attributes, and environment variables, the policy context manager dynamically selects an appropriate policy class according to a preset decision logic to call a corresponding permission verification policy.

[0042] In another exemplary embodiment, the policy context manager selects the most appropriate permission verification policy from the registered policies according to the current request environment or conditions (such as user role, request time, request source, etc.). The selection process can be rule-based (such as using if-else statements or context mapping in policy mode) or policy evaluation-based (such as using weights or priorities to decide).

[0043] It should be noted that in the process of selecting the corresponding policy class from the policy library through the policy context manager, a visual or scripted configuration management system can also be configured, so that the decision logic and parameters of the policy context manager can be flexibly configured and adjusted according to the user's business needs and security policies.

[0044] In operation S130, the execution engine calls the selected policy class and executes the permission verification algorithm corresponding to the permission verification policy to obtain a verification result of the permission verification requirement.

[0045] After selecting the strategy class, perform strategy execution and verification.

[0046] In an embodiment of the present disclosure, based on the external permission verification interface, when an external request is made for permission verification, the permission verification policy in the current policy class in the policy context manager is called for verification, and the verification result is returned. Once a suitable policy is selected, the permission verification service calls the policy for permission verification. The verification process includes receiving user identification, operation type, and resource name as input, executing the verification logic defined in the policy, and returning the verification result.

[0047] Exemplarily, in scenarios where users need to perform permission verification, such as API calls, data access, etc., the execution engine will call the policy class selected by the policy context manager to execute the permission verification algorithm corresponding to the permission verification policy, where the policy interface defines at least one permission verification algorithm.

[0048] In the embodiment of the present disclosure, user information, resource information and environment information need to be input as parameters into the permission verification algorithm to obtain the verification result, wherein the verification result includes access permission, access denial and clear information to be reviewed.

[0049] It should be noted that when the execution engine calls the policy class and executes the permission verification algorithm corresponding to the permission verification policy, it also includes caching the preset permission verification results, and recording each permission verification process and the corresponding permission verification results.

[0050] Exemplarily, the algorithm verification process includes caching commonly used permission verification results to reduce additional computing resources; and recording the process and results of each permission verification to facilitate subsequent problem analysis.

[0051] In addition, during the permission verification process, performance monitoring tools can be integrated to collect performance indicators of the permission management system in real time, such as response time, resource utilization, etc.

[0052] In operation S140, the verification result is sent to the user.

[0053] In the embodiments of the present disclosure, based on the policy execution results, a clear permission verification result is provided to the user or system. In addition, based on performance monitoring data and user feedback, a machine learning algorithm is used to automatically analyze and optimize the policy selection logic and parameters to improve system efficiency and user experience.

[0054] Through the embodiments of the present disclosure, adaptive permission management can be implemented to complete permission verification. The permission verification strategy can be dynamically adjusted according to business rules or environmental changes. For example, a new permission verification strategy can be automatically switched according to a change in user role, or different permission verification logic can be applied according to time rules (such as working days and holidays).

[0055] In the embodiments of the present disclosure, multiple permission verification strategies can also be used in combination to meet complex permission management requirements. For example, a user can be simultaneously subjected to role-based permission verification and rule-based permission verification, and the user is allowed to perform the requested operation only when both verifications are passed.

[0056] Through the embodiments of the present disclosure, during the process of performing permission verification, detailed information of each permission verification includes the requested user ID, operation type, resource name, permission verification strategy used, verification result, etc. This information can be used for subsequent log analysis and security auditing.

[0057] For example, when an e-commerce system needs to verify permissions based on user roles and rules, two permission verification strategies can be defined: 1) Role-based permission strategy: verify whether the user has the permission to purchase a certain type of goods, which depends on the user's role; 2) Rule-based permission strategy: verify whether the user has the right to purchase a specific type of goods, which depends on the type of goods and certain specific conditions of the user (such as age, region, etc.).

[0058] Based on the above adaptive permission management method based on the policy pattern, the policy context manager will select the appropriate permission verification strategy according to the user role, user behavior, product information, etc., and call the corresponding strategy for verification. If both strategies are verified, the user is allowed to purchase the product; otherwise, the request is rejected and the corresponding prompt information is given.

[0059] Through the embodiments of the present disclosure, the feasibility and effectiveness of the above-mentioned adaptive permission management method based on the policy pattern have been verified. This method has significant advantages in improving permission management efficiency, ensuring information security and promoting business continuity.

[0060] According to the above-mentioned adaptive permission management method based on the policy mode, the present disclosure also provides an adaptive permission management system based on the policy mode.

[0061] like Figure 2 As shown, Figure 2 The framework diagram of the adaptive rights management system based on the policy mode according to the embodiment of the present disclosure is schematically shown.

[0062] The adaptive permission management system 200 based on the policy pattern includes: a requirement acquisition module 210, which is used to obtain the user's permission verification requirements; a policy class selection module 220, which is used to select a corresponding policy class from a policy library based on the user's permission verification requirements through a preset policy context manager, wherein the policy library includes multiple independently encapsulated policy classes, and each policy class includes a corresponding permission verification policy; an execution engine module 230, which is used to call the selected policy class through the execution engine and execute the permission verification algorithm corresponding to the permission verification policy to obtain the verification result of the permission verification requirement; a verification result feedback module 240, which is used to send the verification result to the user.

[0063] In an embodiment of the present disclosure, the system further includes a performance monitoring module 250 for collecting performance indicators of the rights management system in real time and triggering an alarm mechanism when the system performance reaches or exceeds a preset threshold.

[0064] In an embodiment of the present disclosure, the system further includes an intelligent optimization module 260 for analyzing performance indicator data and user feedback using a machine learning algorithm and automatically adjusting the logic and parameters of the policy context manager.

[0065] Through the embodiments of the present disclosure, the system encapsulates the rights management strategy into independently replaceable components through the introduction of the policy mode, thus realizing the flexible configuration and dynamic adjustment of the rights management logic. This design not only improves the adaptive ability of rights management, enabling it to automatically select appropriate strategies according to different business scenarios and user needs, but also enhances the scalability of the system, facilitating the addition of new strategies and the optimization of existing strategies in the future.

[0066] The flow chart and block diagram in the accompanying drawings illustrate the system architecture, functions and operations that may be implemented according to the system and method of various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0067] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0068] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An adaptive rights management method based on a policy model, characterized in that: The method comprises: Obtain the user's permission verification requirements; Based on the user's permission verification requirements, a corresponding policy class is selected from a policy library through a preset policy context manager, wherein the policy library includes a plurality of independently encapsulated policy classes, and each policy class includes a corresponding permission verification policy; The execution engine calls the selected policy class and executes the permission verification algorithm corresponding to the permission verification policy to obtain the verification result of the permission verification requirement; The verification result is sent to the user.

2. The adaptive permission management method based on the policy mode according to claim 1 is characterized in that: The policy interfaces of any of the policy classes are the same, and the calling methods of the permission verification policies in any of the policy classes are the same.

3. The adaptive permission management method based on the policy mode according to claim 1 is characterized in that: The permission verification strategy includes role-based access control, attribute-based access control and behavior-based access control.

4. The adaptive permission management method based on the policy mode according to claim 1 is characterized in that: The method of selecting a corresponding policy class from a policy library through a preset policy context manager based on the user's authority verification requirements includes: Based on user information, resource information and environmental information, the corresponding policy class is selected from the policy library according to the preset decision logic.

5. The adaptive permission management method based on the policy mode according to claim 4 is characterized in that: The policy interface defines at least one permission verification algorithm, and the permission verification algorithm includes: The user information, resource information and environment information are respectively used as input parameters to obtain the verification result.

6. The adaptive rights management method based on the policy mode according to claim 1 is characterized in that: The step of calling the selected policy class through the execution engine and executing the permission verification algorithm corresponding to the permission verification policy includes: Cache the preset permission verification results, and record each permission verification process and the corresponding permission verification results.

7. The adaptive permission management method based on the policy mode according to claim 1 is characterized in that: The verification results include clear information such as access allowed, access denied, and pending review.

8. An adaptive rights management system based on a policy model, characterized in that: The system comprises: The requirement acquisition module is used to obtain the user's permission verification requirements; A policy class selection module, used to select a corresponding policy class from a policy library through a preset policy context manager based on the user's permission verification requirements, wherein the policy library includes a plurality of independently encapsulated policy classes, each of which includes a corresponding permission verification policy; An execution engine module, used to call the selected policy class through the execution engine and execute the permission verification algorithm corresponding to the permission verification policy to obtain the verification result of the permission verification requirement; The verification result feedback module is used to send the verification result to the user.

9. The adaptive rights management system based on the policy mode according to claim 8 is characterized in that: The system also includes a performance monitoring module for collecting performance indicators of the rights management system in real time and triggering an alarm mechanism when the system performance reaches or exceeds a preset threshold.

10. The adaptive rights management system based on the policy mode according to claim 9 is characterized in that: The system also includes an intelligent optimization module for analyzing the performance indicator data and user feedback using a machine learning algorithm and automatically adjusting the logic and parameters of the strategy context manager.

Images