Authority management method and device, equipment, storage medium and program product

Abstract

The invention relates to an authority management method and device, equipment, a storage medium and a program product, and the method comprises the steps: carrying out the identity verification of a target user under the condition that an access request of the target user is received, and carrying out the verification of the access authority of the target user through a preset contract under the condition that the identity verification of the target user is passed, and then, under the condition that the verification result shows that the access permission of the target user passes the verification, returning the target data resource requested by the access request to the target user. Wherein the preset contract comprises a user contract, a role contract and an authority contract. According to the method, when the target user accesses the system resource, multi-level verification including identity verification, user verification, role verification and authority verification is performed on the target user, so that the user can access the requested data resource only under the condition that all verification is passed, and the data security is further improved.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a permission management method, device, equipment, storage medium and program product. Background Art

[0002] With the rapid development of the Internet, the network has become an important way for people to obtain and share information. With the rapid growth of data and resources, security technology must be constantly updated to cope with increasingly complex network threats. In order to meet these challenges, network management systems have emerged. Role-Based Access Control (RBAC) is widely used in network management systems. The core idea of ​​RBAC is to link access rights with roles, and to assign appropriate roles to users so that they can obtain corresponding access rights.

[0003] Currently, the permission management method is usually implemented based on a centralized permission management architecture. However, this permission management method has the problem of poor security. Summary of the invention

[0004] Based on this, it is necessary to provide a permission management method, device, equipment, storage medium and program product that can improve data security in response to the above technical problems.

[0005] In a first aspect, the present application provides a rights management method, the method comprising:

[0006] Upon receiving an access request from a target user, authenticating the target user;

[0007] When the identity authentication of the target user is passed, the access rights of the target user are verified through the preset contract to obtain the verification result; the preset contract includes the user contract, the role contract and the permission contract;

[0008] When the verification result indicates that the target user's access authority is verified to be successful, the target data resource requested by the access request is returned to the target user.

[0009] In one embodiment, the access rights of the target user are verified through a preset contract to obtain a verification result, including:

[0010] Determine the target blockchain address of the target user in the blockchain through the user contract;

[0011] Determine the target role of the target user through the role contract and the target blockchain address;

[0012] The target user's access rights are verified through the permission contract and the target role to obtain the verification result.

[0013] In one embodiment, the access rights of the target user are verified through the permission contract and the target role, and the verification result is obtained, including:

[0014] Query the target role in the permission contract to see whether it has the permission to access the target data resource;

[0015] If the target role has the permission to access the target data resource, then the verification result is confirmed to indicate that the target user's access permission verification has passed;

[0016] If the target role does not have the permission to access the target data resource, then the verification result is determined to indicate that the target user's access permission verification has failed.

[0017] In one embodiment, when the verification result indicates that the target user's access rights have been verified, the method further includes:

[0018] Determine the target user's access behavior information within a preset time period; the access behavior information includes the frequency of access requests and the number of requests for target permissions;

[0019] Perform anomaly detection on the target user's access behavior information within a preset time period to obtain target detection results;

[0020] If the target detection result indicates that the target user's access behavior is in a normal state, executing the step of returning the target data resource requested by the access request to the target user;

[0021] If the target detection result indicates that the target user's access behavior is in an abnormal state, an alarm prompt will be issued.

[0022] In one embodiment, abnormal detection is performed on the access behavior information of the target user within a preset time period to obtain a target detection result, including:

[0023] Determine a behavior vector based on the target user's access behavior information within a preset time period;

[0024] Determine a first detection result according to the isolation tree algorithm and the behavior vector;

[0025] determining a second detection result according to the sigma algorithm and the behavior vector;

[0026] The target detection result is determined according to the first detection result and the second detection result.

[0027] In one embodiment, the method further comprises:

[0028] The target user's access record is stored in the blockchain; the access record includes at least one of user information, access information, access resources and permission verification results.

[0029] In a second aspect, the present application further provides a rights management device, the device comprising:

[0030] The identity verification module is used to verify the identity of the target user upon receiving an access request from the target user;

[0031] The permission verification module is used to verify the access rights of the target user through the preset contract to obtain the verification result when the identity authentication of the target user passes; the preset contract includes the user contract, the role contract and the permission contract;

[0032] The return module is used to return the target data resource requested by the access request to the target user when the verification result indicates that the access authority of the target user has been verified.

[0033] In a third aspect, the present application further provides a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0034] Upon receiving an access request from a target user, authenticating the target user;

[0035] When the identity authentication of the target user is passed, the access rights of the target user are verified through the preset contract to obtain the verification result; the preset contract includes the user contract, the role contract and the permission contract;

[0036] When the verification result indicates that the target user's access authority is verified to be successful, the target data resource requested by the access request is returned to the target user.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0038] Upon receiving an access request from a target user, authenticating the target user;

[0039] When the identity authentication of the target user is passed, the access rights of the target user are verified through the preset contract to obtain the verification result; the preset contract includes the user contract, the role contract and the permission contract;

[0040] When the verification result indicates that the target user's access authority is verified to be successful, the target data resource requested by the access request is returned to the target user.

[0041] In a fifth aspect, the present application further provides a computer program product, the computer program product comprising a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0042] Upon receiving an access request from a target user, authenticating the target user;

[0043] When the identity authentication of the target user is passed, the access rights of the target user are verified through the preset contract to obtain the verification result; the preset contract includes the user contract, the role contract and the permission contract;

[0044] When the verification result indicates that the target user's access authority is verified to be successful, the target data resource requested by the access request is returned to the target user.

[0045] The above-mentioned permission management method, device, equipment, storage medium and program product, the method authenticates the target user upon receiving the target user's access request, and verifies the target user's access rights through a preset contract when the target user's identity verification passes, obtains a verification result, and then returns the target data resource requested by the access request to the target user when the verification result indicates that the target user's access rights verification passes. The preset contract includes a user contract, a role contract and a permission contract. In the above-mentioned method, when the target user accesses the system resources, the target user is authenticated by performing multi-level verification including identity verification, user verification, role verification and permission verification, ensuring that the user can access the requested data resource only when all verifications pass, thereby improving the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is an internal structure diagram of a computer device in one embodiment;

[0047] Figure 2 A flowchart of a rights management method in one embodiment;

[0048] Figure 3 A flowchart of a rights management method in another embodiment;

[0049] Figure 4 A flowchart of a rights management method in another embodiment;

[0050] Figure 5 A flowchart of a rights management method in another embodiment;

[0051] Figure 6 A flowchart of a rights management method in another embodiment;

[0052] Figure 7 A flowchart of a rights management method in another embodiment;

[0053] Figure 8A flowchart of a rights management method in another embodiment;

[0054] Fig. 9 FIG. 4 is a structural block diagram of a rights management device in an embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] With the rapid development of the Internet, the network has become an important way for people to obtain and share information. With the rapid growth of data and resources, security technology must be constantly updated to cope with increasingly complex network threats. In order to meet these challenges, network management systems have emerged. Role-Based Access Control (RBAC) is widely used in network management systems. The core idea of ​​RBAC is to link access rights with roles, and to assign appropriate roles to users so that they can obtain corresponding access rights. At present, permission management methods are usually implemented based on centralized permission management architectures. For example, centralized architectures may lead to single points of failure, and centralized storage of permission data may face the risk of tampering, which makes them have poor security problems when processing data.

[0057] The present application provides a permission management method, aiming to solve the above technical problems. The following embodiments will specifically illustrate the permission management method described in the present application.

[0058] The rights management method provided in the embodiment of the present application can be applied to Figure 1 In the computer device shown in the figure, the computer device can be a terminal or a server. In the embodiment of the present application, the computer device can be a rights management system, and its internal structure diagram can be as shown in FIG. Figure 1As shown, the computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a permission management method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0059] Those skilled in the art will understand that Figure 1 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0060] In one embodiment, Figure 2 As shown, a permission management method is provided, which is applied to Figure 1 The computer device in the example is used to illustrate, including the following steps:

[0061] S201: Upon receiving an access request from a target user, authenticate the target user.

[0062] The target user is a user of the application system. The access request is used to access the resources of the application system, and the access request includes user identity information, which includes at least one of a user name and password, a user fingerprint, and a user biometric identification.

[0063] In an embodiment of the present application, when a user needs to access an application system, an access request can be sent to a computer device. Specifically, the access request can be sent through a preset RBAC service API / SDK, and the computer device can receive the access request sent by the target user. When the computer device receives the access request from the target user, it can analyze the access request to determine the user identity information, and then authenticate the target user by verifying the user identity information. If the user identity information is correct, the identity authentication of the target user is passed. If the user identity information is wrong, the identity authentication of the target user fails. The application system can provide API services and SDKs to adapt to permission verification scenarios in various scenarios. The application system requests the corresponding RBAC service to verify user permissions. Because user information exists on the blockchain, the application system is naturally traceable and tamper-proof.

[0064] S202, when the identity authentication of the target user is passed, the access rights of the target user are verified through a preset contract to obtain a verification result.

[0065] Among them, the preset contract includes a user contract, a role contract and a permission contract. The preset contract is obtained through the RBAC model (role-based access control model). In the RBAC model, permissions are first assigned to roles, and then roles are assigned to users. The advantage of this is that when permissions need to be changed, only the permissions of the role need to be adjusted, without modifying the permission settings of each user one by one, thereby greatly improving management efficiency. The RBAC model has also developed multiple levels of variants, such as RBAC0, RBAC1, RBAC2 and RBAC3, according to different business needs and complexities. RBAC0 is the most basic model, providing a basic mapping relationship between roles and permissions. RBAC1, RBAC2 and RBAC3 are based on RBAC0, adding more features and flexibility, such as the hierarchy of roles, dynamic permission allocation of roles, etc. You can choose a suitable RBAC model according to your actual needs. The embodiment of the present application is based on the ERC6551 smart contract, which can easily support various RBAC models, thereby more effectively controlling and allocating permissions and ensuring the security and compliance of the system. The verification results include verification failure or verification pass.

[0066] The mapping relationship between users and blockchain addresses in the user contract application system. The blockchain address is divided into two parts. One part is the ordinary on-chain address, which corresponds to the user of the application system, and the other part is the TBA address, which corresponds to the permission module of ERC6551. The blockchain address is the unique identifier for the interaction between the smart contract and the outside world, and all operations need to be performed through the address. Therefore, each system user in the application corresponds to at least one on-chain address and its private key.

[0067] The role contract is the correspondence between the blockchain address and the role. The role contract in the RBAC model corresponds to an ERC6551 standard smart contract. The smart contract account (Token-Based Access, TBA) in the ERC6551 contract is an innovative access control mechanism based on tokens, which allows the management and control of access rights to specific resources through smart contracts. Compared with traditional access control systems, TBA provides higher flexibility and security. TBA mainly has the advantages of dynamic permission management, permission segmentation, security enhancement, audit and tracking, and automated management; the allocation and generation of addresses are automatically generated by the corresponding system services and smart contracts. In the TBA of this contract, the blockchain address and the role can be mapped by mint. The non-fungible token (NFT) in TBA is a digital asset in blockchain technology. TBA provides independent management and operation functions for NFT, which enhances the flexibility and practicality of NFT. ERC-6551 is a standard proposal for NFT (non-fungible token) applications. It is a specification defined at a higher level and has important significance in practical applications. First, ERC-6551 provides higher interoperability and standardization. Second, ERC-6551 improves the information richness and traceability of NFT by supporting more types of metadata. Finally, ERC-6551 emphasizes the security and reliability of NFT contracts. By standardizing the structure and function of contracts, it helps reduce contract vulnerabilities and risks.

[0068] The permission contract is the correspondence between roles and permissions. The permission contract corresponds to an ERC721 standard smart contract. The permissions can be established in TBA through mint to realize the mapping relationship between roles and permissions.

[0069] In the embodiment of the present application, the computer device can establish a preset contract in advance according to the corresponding relationship between the blockchain address-user-role-authority through the RBAC model. Specifically, a user contract can be established according to the corresponding relationship between the blockchain address and the user, a role contract can be established according to the relationship between the blockchain address and the role, and a permission contract can be established according to the relationship between the role and the authority, and then the established preset contract can be stored in the preset path. Among them, the role can be the user's title or other identity, for example, the role is a sales manager or a technical manager.

[0070] For example, it is necessary to generate corresponding public and private keys and corresponding on-chain addresses for each user, and pay attention to security protection. Each user's on-chain address can accept the corresponding ERC6551 user authorization. The TBA address is generated by ERC6551 itself, and there is no need to process it separately. It can be implemented through the corresponding permission contract encapsulation to query the corresponding TBA address. In this example, two roles (sales manager, technical manager) and the required permissions are defined, and the corresponding ERC6551 contract (i.e., role contract) is deployed for each role, and the corresponding permission NFT contract (ERC721, i.e., permission contract) is deployed. At the contract level, if user A is authorized, the corresponding permission NFT is first created through the role contract and the permission contract to the target role address. At this time, the TBA corresponding to the ERC6551 role NFT can be obtained, and the required ERC721 permission NFT is created in the corresponding TBA. After the creation is completed, the ERC6551 role NFT is forwarded to address A. Considering the query efficiency, the authorization information needs to be updated to the user management contract to complete the user authorization process. In actual projects, from the perspective of user experience and authorization speed, you can consider initializing the role first, so that the actual authorization process is only a one-step forwarding, and the same applies to other permission authorizations.

[0071] The corresponding relationship between the RBAC model in the embodiment of this application and the ERC6551 contract is as follows Figure 3 As shown, users mainly rely on the existing account system of Ethereum and use public and private keys to confirm their identities; the role part mainly relies on the TBA capability of ERC6551, which can manage and hold the permissions in the resource NFT, and whether the corresponding permissions are held is determined by whether the corresponding NFT token is held. Among them, the User Addr A of the weight represents the blockchain address of user A, Token represents permissions, ERC721Contract represents the ERC721 permission contract, Token #0 is stored in the user contract ERC6551 Registry in the form of token TBA A, and Token #1 is stored in the user contract ERC6551 Registry in the form of token TBA B. By verifying whether the user has the permission Token #XXX in the permission contract ERC721 Contract X / Y, it is determined whether the resources in the application system can be returned.

[0072] When the computer device determines that the identity authentication of the target user has passed based on the above steps, it can obtain the preset contract through the preset path, and then verify the access rights of the target user through the preset contract to obtain a verification result. Specifically, the initial verification can be performed through the user contract. If the initial verification passes, a secondary verification can be performed through the role contract. If the secondary verification passes, a final verification can be performed through the permission contract. If the final verification passes, the verification result is determined to indicate that the access rights verification of the target user has passed. If the initial verification fails, the secondary verification fails, or the final verification fails, the verification result is determined to indicate that the access rights verification of the target user has failed.

[0073] S203: When the verification result indicates that the target user's access authority has been verified, the target data resource requested by the access request is returned to the target user.

[0074] The target data resource is the application system resource requested by the target user.

[0075] In the embodiment of the present application, when the computer device determines based on the above steps that the verification result indicates that the target user's access right verification has passed, the target data resource can be obtained from the application system according to the access request and returned to the user terminal where the target user is located.

[0076] The permission management method provided in the embodiment of the present application performs identity authentication on the target user upon receiving the access request of the target user, and verifies the access rights of the target user through a preset contract when the identity authentication of the target user passes, obtains a verification result, and then returns the target data resource requested by the access request to the target user when the verification result indicates that the access rights of the target user pass the verification. The preset contract includes a user contract, a role contract, and a permission contract. In the above method, when the target user accesses the system resources, the target user is verified through multiple levels of identity authentication, user verification, role verification, and permission verification, ensuring that the user can access the requested data resources only when all verifications pass, thereby improving the security of the data.

[0077] In one embodiment, a specific implementation method for verifying the access rights of a target user through a preset contract is also provided, such as Figure 4 As shown, the "verifying the access rights of the target user through the preset contract to obtain the verification result" in the above step S202 includes:

[0078] S301, determining the target blockchain address of the target user in the blockchain through the user contract.

[0079] Among them, blockchain can adopt private chain or alliance chain.

[0080] In the embodiment of the present application, when the computer device determines that the identity authentication of the target user is passed based on the above steps, the user contract can be obtained through a preset path, and then the target blockchain address corresponding to the target user can be queried in the user contract. If the target blockchain address can be queried in the user contract, step S302 is executed. If the target blockchain address cannot be queried in the user contract, it is determined that the verification result indicates that the access permission verification of the target user has failed.

[0081] S302, determining the target role to which the target user belongs through the role contract and the target blockchain address.

[0082] In the embodiment of the present application, after the computer device obtains the target blockchain address based on the above steps, it can obtain the role contract from the preset path, and then query the target role corresponding to the target blockchain address in the role contract. If the target role can be queried in the role contract, the step S303 is executed. If the target role cannot be queried in the role contract, it is determined that the verification result indicates that the target user's access right verification has failed. Exemplarily, how to determine whether user A has a certain permission at the contract level can be to directly query and obtain the corresponding role information through the role contract, and then obtain the NFT of whether it has the corresponding permission in the permission contract of its role. If it exists, it has the permission.

[0083] S303, verifying the access rights of the target user through the permission contract and the target role to obtain a verification result.

[0084] In an embodiment of the present application, after the computer device obtains the target role based on the above steps, it can obtain the permission contract from a preset path, and then query the target permission corresponding to the target role in the permission contract, and verify the access rights of the target user based on whether the target permission corresponding to the target role can be queried to obtain a verification result.

[0085] Specifically, Figure 5 As shown, the above step S303 of "verifying the access rights of the target user through the permission contract and the target role to obtain a verification result" includes:

[0086] S3031, query in the permission contract whether the target role has the permission to access the target data resource.

[0087] In an embodiment of the present application, the computer device can query the target permission corresponding to the target role in the permission contract, that is, query whether the target role has the permission to access the target data resource.

[0088] S3032: If the target role has the permission to access the target data resource, it is determined that the verification result indicates that the target user's access permission verification has passed.

[0089] In the embodiment of the present application, if the target permission can be queried in the permission contract, it means that the target role has the permission to access the target data resource, and then it can be determined that the verification result indicates that the access permission verification of the target user has passed.

[0090] S3033: If the target role does not have the permission to access the target data resource, it is determined that the verification result indicates that the target user's access permission verification fails.

[0091] In the embodiment of the present application, if the target permission is not found in the permission contract, it means that the target role does not have the permission to access the target data resource, and then it can be determined that the verification result indicates that the target user's access permission verification has failed.

[0092] The method described in the embodiment of the present application, by implementing complex RBAC permission management scenarios using the blockchain's ERC6551, not only has the tamper-proof characteristics of decentralized technology, but also combines the capabilities of ERC6551 to transform the underlying contract configuration into NFT configuration, which is more flexible and easy to use, and transforms the process of permission granting, inheritance, and transfer into general NFT operations, with better scalability, configurability, and better traceability.

[0093] The innovation of the present invention is to implement the complex RBAC rights management scenario using the blockchain's ERC6551. It not only has the tamper-proof characteristics of decentralized technology, but also combines the capabilities of ERC6551 to transform the underlying contract configuration into NFT configuration, which is more flexible and easy to use. It transforms the process of granting, inheriting, and transferring rights into general NFT operations, and has better scalability, configurability, and better traceability. The anomaly detection module provides flexible dynamic detection capabilities based on the existing security mechanism, and provides finer granularity and more complete management and control capabilities and more complete security audit capabilities compared to traditional fixed thresholds. Compared with traditional rights management methods, this method relies on the blockchain ERC6551 at the bottom. Compared with traditional centralized solutions and conventional methods that rely on blockchain smart contracts, this solution is better standardized, more flexible and universal, and more traceable. In particular, the introduction of TBA makes the contract level more flexible, and configuring rights is as simple and convenient as operating NFT.

[0094] In one embodiment, Figure 6 As shown, when the verification result indicates that the target user's access rights have been verified, the method further includes:

[0095] S401, determining access behavior information of a target user within a preset time period.

[0096] The access behavior information includes the frequency of access requests and the number of target permission requests. The preset time period can be determined according to the anomaly detection requirements, which can be a few hours or a few days.

[0097] In an embodiment of the present application, when the computer device determines that the verification result indicates that the target user's access right verification has passed, it can monitor the target user's access information in real time through the API service and SDK interface, and then obtain the target user's access behavior information within a preset time period.

[0098] S402, performing anomaly detection on the access behavior information of the target user within a preset time period to obtain a target detection result.

[0099] The target detection result includes whether the target user's access behavior is in a normal state or whether the target user's access behavior is in an abnormal state.

[0100] In the embodiment of the present application, after the computer device obtains the access behavior information of the target user within the preset time period based on the above steps, the access behavior information can be input into a preset algorithm for anomaly detection to obtain a target detection result. Optionally, the access behavior information can also be input into a preset neural network model for anomaly detection to obtain a target detection result.

[0101] Specifically, Figure 7 As shown, the above step S402 of "performing abnormal detection on the access behavior information of the target user within the preset time period to obtain the target detection result" includes:

[0102] S4021, determining a behavior vector according to the access behavior information of the target user within a preset time period.

[0103] Among them, the behavior vector is composed of the frequency of access requests and the number of requests for target permissions, which can represent the sensitivity of permission access.

[0104] In the embodiment of the present application, after obtaining the access behavior information of the target user within the preset time period, the computer device can construct a behavior vector according to the access behavior information of the target user within the preset time period. .

[0105] S4022: Determine a first detection result according to the isolation tree algorithm and the behavior vector.

[0106] Among them, the isolation tree algorithm is the iForest algorithm, which is an efficient anomaly detection algorithm that evaluates the abnormality of data points by randomly constructing a binary tree. The first test result is the isolation tree algorithm score. The closer the isolation tree algorithm score is to 1, the more abnormal it is, and the closer it is to 0, the more normal it is.

[0107] In the embodiment of the present application, after the computer device constructs and obtains the behavior vector based on the above steps, the behavior vector can be input into the isolation tree algorithm for anomaly detection to obtain a first detection result. The specific process is represented by the following relationship:

[0108]

[0109] in, is the behavior vector, n is the sample size of the random sample subset (preset value), is Euler's constant, yes Average height among isolated tree species.

[0110] S4023, determining a second detection result according to the Sigma algorithm and the behavior vector.

[0111] The sigma algorithm is a 3 sigma algorithm. The second test result is a sigma algorithm score. If the sigma algorithm score is 1, it is abnormal, and if it is 0, it is normal.

[0112] In the embodiment of the present application, after the computer device constructs and obtains the behavior vector based on the above steps, the behavior vector can be input into the Sigma algorithm for anomaly detection to obtain a second detection result. The specific process is represented by the following relationship:

[0113]

[0114]

[0115] in, is the process parameter, is the mean of a normally distributed random variable, is the variance of this random variable.

[0116] S4024: Determine a target detection result according to the first detection result and the second detection result.

[0117] In an embodiment of the present application, after obtaining the first detection result and the second detection result, the computer device weightedly fuses the first detection result and the second detection result to obtain a weighted score, and then compares the weighted score with a preset threshold. If the weighted score is greater than the preset threshold, it is determined that the target detection result indicates that the target user's access behavior is in an abnormal state. If the weighted score is not greater than the preset threshold, it is determined that the target detection result indicates that the target user's access behavior is in a normal state. The preset threshold can be a value close to 0, for example, the preset threshold is 0.1. The process of weighted fusion of the first detection result and the second detection result to obtain the weighted score can be expressed by the following relationship:

[0118]

[0119] in, represents the weighted score, , , All represent weights, and the three can be the same or different.

[0120] It should be noted that in order to prevent false alarms and missed alarms, anomaly detection uses a fusion of two algorithms for detection. The sensitivity can be adjusted by adjusting the corresponding configuration during actual use.

[0121] S403: If the target detection result indicates that the target user's access behavior is in a normal state, a step of returning the target data resource requested by the access request to the target user is executed.

[0122] In an embodiment of the present application, if the target detection result indicates that the target user's access behavior is in a normal state, the step of returning the target data resources requested by the access request to the target user is executed, that is, returning to execute the step of "returning the target data resources requested by the access request to the target user" in S203.

[0123] S404: If the target detection result indicates that the target user's access behavior is in an abnormal state, an alarm is issued.

[0124] In an embodiment of the present application, if the target detection result indicates that the target user's access behavior is in an abnormal state, an alarm prompt is issued, for example, prompting the corresponding administrator to handle the exception, or popping up an abnormal alarm prompt message on the user interface on the computer device.

[0125] In the method described in the embodiment of the present application, the frequency of user requests and the number of certain permission requests themselves support threshold limits, and an optional anomaly detection module is provided to confirm whether the user request is abnormal, especially for access to sensitive permissions, security protection is very necessary. Moreover, the method described in the embodiment of the present application provides a flexible dynamic detection capability based on the existing security mechanism, and provides a more fine-grained and complete management and control capability and a more complete security audit capability than the traditional fixed threshold.

[0126] In one embodiment, the method further includes:

[0127] Store the target user's access records in the blockchain.

[0128] The access record includes at least one of user information, access information, access resources and permission verification results.

[0129] In an embodiment of the present application, when a target user accesses application system resources, a computer device can obtain each access record and then store the access record in a blockchain.

[0130] The method described in the embodiment of the present application can improve the security of data by relying on the underlying data on the blockchain, so that each operation on the blockchain is traceable and cannot be tampered with.

[0131] Based on all the above embodiments, a permission management method is also provided. Figure 8 As shown, the method includes:

[0132] Upon receiving an access request from a target user through the RBAC service API / SDK in the service API, the target user is authenticated.

[0133] When the identity authentication of the target user is passed, the target blockchain address of the target user in the blockchain (see the on-chain address in the figure) is determined through the user contract in the smart contract (see the user management contract in the figure).

[0134] The target role to which the target user belongs is determined through the role contract and the target blockchain address in the smart contract.

[0135] In the permission contract in the smart contract (corresponding to the permission management in the figure), check whether the target role has the permission to access the target data resources.

[0136] If the target role has the permission to access the target data resource, then determining the verification result indicates that the target user's access permission verification has passed.

[0137] If the target role does not have the permission to access the target data resource, then the verification result is determined to indicate that the target user's access permission verification has failed.

[0138] When the verification result indicates that the target user's access authority is verified to be successful, the target data resource requested by the access request is returned to the target user.

[0139] The target user's access behavior information within a preset time period, where the access behavior information includes the frequency of access requests and the number of requests for target permissions.

[0140] Determine a behavior vector based on the target user's access behavior information within a preset time period;

[0141] Determine a first detection result according to an isolation tree algorithm and a behavior vector through an anomaly detection method in a service API, determine a second detection result according to a sigma algorithm and a behavior vector, and determine a target detection result according to the first detection result and the second detection result;

[0142] If the target detection result indicates that the target user's access behavior is in a normal state, executing the step of returning the target data resource requested by the access request to the target user;

[0143] If the target detection result indicates that the target user's access behavior is in an abnormal state, an alarm prompt will be issued.

[0144] The target user's access record is stored in the blockchain through the audit module in the service API, where the access record includes at least one of user information, access information, access resources, and permission verification results.

[0145] The methods described in the above steps are all described in the above embodiments. Please refer to the above description for details and will not be repeated here.

[0146] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0147] Based on the same inventive concept, the embodiment of the present application also provides a rights management device for implementing the rights management method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more rights management device embodiments provided below can refer to the limitations on the rights management method above, and will not be repeated here.

[0148] In one embodiment, Fig. 9 As shown, a rights management device is provided, comprising:

[0149] The identity authentication module 11 is used to authenticate the target user upon receiving an access request from the target user.

[0150] The authority verification module 12 is used to verify the access rights of the target user through a preset contract to obtain a verification result when the identity authentication of the target user is passed; the preset contract includes a user contract, a role contract and a authority contract.

[0151] The return module 13 is used to return the target data resource requested by the access request to the target user when the verification result indicates that the access authority verification of the target user has passed.

[0152] In one embodiment, the authority verification module includes:

[0153] The first determining unit is used to determine a target blockchain address of a target user in the blockchain through a user contract.

[0154] The second determination unit is used to determine the target role to which the target user belongs through the role contract and the target blockchain address.

[0155] The verification unit is used to verify the access rights of the target user through the permission contract and the target role to obtain the verification result.

[0156] In one embodiment, the verification unit includes:

[0157] The query subunit is used to query in the permission contract whether the target role has the permission to access the target data resource.

[0158] The first determining subunit is used to determine that if the target role has the permission to access the target data resource, then the verification result indicates that the access permission verification of the target user has passed.

[0159] The second determining subunit is used to determine that the verification result indicates that the access right verification of the target user fails if the target role does not have the permission to access the target data resource.

[0160] In one embodiment, the above-mentioned rights management device further includes:

[0161] The determination module is used to determine the access behavior information of the target user within a preset time period; the access behavior information includes the frequency of access requests and the number of requests for target permissions.

[0162] The detection module is used to perform anomaly detection on the access behavior information of the target user within a preset time period to obtain the target detection result.

[0163] A sending module, configured to execute the step of returning the target data resource requested by the access request to the target user if the target detection result indicates that the access behavior of the target user is in a normal state;

[0164] The alarm module is used to issue an alarm if the target detection result indicates that the target user's access behavior is in an abnormal state.

[0165] In one embodiment, the detection module includes:

[0166] The third determining unit is used to determine the behavior vector according to the access behavior information of the target user within a preset time period.

[0167] The first detection unit is used to determine a first detection result according to the isolation tree algorithm and the behavior vector.

[0168] The second detection unit is used to determine a second detection result according to the Sigma algorithm and the behavior vector.

[0169] The fourth determining unit is used to determine the target detection result according to the first detection result and the second detection result.

[0170] In one embodiment, the detection module is further used to store the target user's access record in the blockchain, wherein the access record includes at least one of user information, access information, access resources, and permission verification results.

[0171] Each module in the above-mentioned rights management device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0172] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0173] Upon receiving an access request from a target user, authenticating the target user;

[0174] When the identity authentication of the target user is passed, the access rights of the target user are verified through the preset contract to obtain the verification result; the preset contract includes the user contract, the role contract and the permission contract;

[0175] When the verification result indicates that the target user's access authority is verified to be successful, the target data resource requested by the access request is returned to the target user.

[0176] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0177] Determine the target blockchain address of the target user in the blockchain through the user contract;

[0178] Determine the target role of the target user through the role contract and the target blockchain address;

[0179] The target user's access rights are verified through the permission contract and the target role to obtain the verification result.

[0180] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0181] Query the target role in the permission contract to see whether it has the permission to access the target data resource;

[0182] If the target role has the permission to access the target data resource, then the verification result is confirmed to indicate that the target user's access permission verification has passed;

[0183] If the target role does not have the permission to access the target data resource, then the verification result is determined to indicate that the target user's access permission verification has failed.

[0184] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0185] Determine the target user's access behavior information within a preset time period; the access behavior information includes the frequency of access requests and the number of requests for target permissions;

[0186] Perform anomaly detection on the target user's access behavior information within a preset time period to obtain target detection results;

[0187] If the target detection result indicates that the target user's access behavior is in a normal state, executing the step of returning the target data resource requested by the access request to the target user;

[0188] If the target detection result indicates that the target user's access behavior is in an abnormal state, an alarm prompt will be issued.

[0189] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0190] Determine a behavior vector based on the target user's access behavior information within a preset time period;

[0191] Determine a first detection result according to the isolation tree algorithm and the behavior vector;

[0192] determining a second detection result according to the sigma algorithm and the behavior vector;

[0193] The target detection result is determined according to the first detection result and the second detection result.

[0194] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0195] The target user's access record is stored in the blockchain; the access record includes at least one of user information, access information, access resources and permission verification results.

[0196] The above embodiment provides a computer device, whose implementation principle and technical effect are similar to those of the above method embodiment, and will not be repeated here.

[0197] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0198] Upon receiving an access request from a target user, authenticating the target user;

[0199] When the identity authentication of the target user is passed, the access rights of the target user are verified through the preset contract to obtain the verification result; the preset contract includes the user contract, the role contract and the permission contract;

[0200] When the verification result indicates that the target user's access authority is verified to be successful, the target data resource requested by the access request is returned to the target user.

[0201] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0202] Determine the target blockchain address of the target user in the blockchain through the user contract;

[0203] Determine the target role of the target user through the role contract and the target blockchain address;

[0204] The target user's access rights are verified through the permission contract and the target role to obtain the verification result.

[0205] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0206] Query the target role in the permission contract to see whether it has the permission to access the target data resource;

[0207] If the target role has the permission to access the target data resource, then the verification result is confirmed to indicate that the target user's access permission verification has passed;

[0208] If the target role does not have the permission to access the target data resource, then the verification result is determined to indicate that the target user's access permission verification has failed.

[0209] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0210] Determine the target user's access behavior information within a preset time period; the access behavior information includes the frequency of access requests and the number of requests for target permissions;

[0211] Perform anomaly detection on the target user's access behavior information within a preset time period to obtain target detection results;

[0212] If the target detection result indicates that the target user's access behavior is in a normal state, executing the step of returning the target data resource requested by the access request to the target user;

[0213] If the target detection result indicates that the target user's access behavior is in an abnormal state, an alarm prompt will be issued.

[0214] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0215] Determine a behavior vector based on the target user's access behavior information within a preset time period;

[0216] Determine a first detection result according to the isolation tree algorithm and the behavior vector;

[0217] determining a second detection result according to the sigma algorithm and the behavior vector;

[0218] The target detection result is determined according to the first detection result and the second detection result.

[0219] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0220] The target user's access record is stored in the blockchain; the access record includes at least one of user information, access information, access resources and permission verification results.

[0221] The above embodiment provides a computer-readable storage medium, whose implementation principle and technical effect are similar to those of the above method embodiment, and will not be repeated here.

[0222] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0223] Upon receiving an access request from a target user, authenticating the target user;

[0224] When the identity authentication of the target user is passed, the access rights of the target user are verified through the preset contract to obtain the verification result; the preset contract includes the user contract, the role contract and the permission contract;

[0225] When the verification result indicates that the target user's access authority is verified to be successful, the target data resource requested by the access request is returned to the target user.

[0226] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0227] Determine the target blockchain address of the target user in the blockchain through the user contract;

[0228] Determine the target role of the target user through the role contract and the target blockchain address;

[0229] The target user's access rights are verified through the permission contract and the target role to obtain the verification result.

[0230] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0231] Query the target role in the permission contract to see whether it has the permission to access the target data resource;

[0232] If the target role has the permission to access the target data resource, then the verification result is confirmed to indicate that the target user's access permission verification has passed;

[0233] If the target role does not have the permission to access the target data resource, then the verification result is determined to indicate that the target user's access permission verification has failed.

[0234] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0235] Determine the target user's access behavior information within a preset time period; the access behavior information includes the frequency of access requests and the number of requests for target permissions;

[0236] Perform anomaly detection on the target user's access behavior information within a preset time period to obtain target detection results;

[0237] If the target detection result indicates that the target user's access behavior is in a normal state, executing the step of returning the target data resource requested by the access request to the target user;

[0238] If the target detection result indicates that the target user's access behavior is in an abnormal state, an alarm prompt will be issued.

[0239] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0240] Determine a behavior vector based on the target user's access behavior information within a preset time period;

[0241] Determine a first detection result according to the isolation tree algorithm and the behavior vector;

[0242] determining a second detection result according to the sigma algorithm and the behavior vector;

[0243] The target detection result is determined according to the first detection result and the second detection result.

[0244] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0245] The target user's access record is stored in the blockchain; the access record includes at least one of user information, access information, access resources and permission verification results.

[0246] The above embodiment provides a computer program product, whose implementation principle and technical effect are similar to those of the above method embodiment, and will not be repeated here.

[0247] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0248] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0249] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A rights management method, characterized in that: The method comprises: Upon receiving an access request from a target user, authenticating the target user; When the identity authentication of the target user is passed, the access rights of the target user are verified through a preset contract to obtain a verification result; the preset contract includes a user contract, a role contract and a permission contract; When the verification result indicates that the access authority of the target user has been verified, the target data resource requested by the access request is returned to the target user.

2. The method according to claim 1, characterized in that The verification of the access rights of the target user through the preset contract to obtain the verification result includes: Determine the target blockchain address of the target user in the blockchain through the user contract; Determine the target role to which the target user belongs through the role contract and the target blockchain address; The access rights of the target user are verified through the permission contract and the target role to obtain the verification result.

3. The method according to claim 2, characterized in that The verifying the access rights of the target user through the permission contract and the target role to obtain the verification result includes: Querying the permission contract to determine whether the target role has permission to access the target data resource; If the target role has the permission to access the target data resource, determining that the verification result indicates that the access permission verification of the target user has passed; If the target role does not have the authority to access the target data resource, it is determined that the verification result indicates that the target user's access authority verification has failed.

4. The method according to any one of claims 1 to 3, characterized in that: When the verification result indicates that the target user's access authority has been verified, the method further includes: Determine the access behavior information of the target user within a preset time period; the access behavior information includes the frequency of the access request and the number of requests for target permissions; Performing anomaly detection on the target user's access behavior information within a preset time period to obtain a target detection result; If the target detection result indicates that the access behavior of the target user is in a normal state, executing the step of returning the target data resource requested by the access request to the target user; If the target detection result indicates that the target user's access behavior is in an abnormal state, an alarm prompt is issued.

5. The method according to claim 4, characterized in that The performing abnormal detection on the access behavior information of the target user within a preset time period to obtain a target detection result includes: Determining a behavior vector according to the access behavior information of the target user within a preset time period; Determine a first detection result according to the isolation tree algorithm and the behavior vector; Determine a second detection result according to the Sigma algorithm and the behavior vector; The target detection result is determined according to the first detection result and the second detection result.

6. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: The access record of the target user is stored in the blockchain; the access record includes at least one of user information, access information, access resources and permission verification results.

7. A rights management device, characterized in that: The device comprises: An identity verification module, configured to verify the identity of a target user upon receiving an access request from the target user; The permission verification module is used to verify the access rights of the target user through a preset contract to obtain a verification result when the identity authentication of the target user passes; the preset contract includes a user contract, a role contract and a permission contract; The returning module is used to return the target data resource requested by the access request to the target user if the verification result indicates that the access authority of the target user has passed the verification.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images