Multi-organization structure and user permission fusion method

Abstract

The invention relates to the technical field of computer permission management, and provides a multi-organization architecture and user permission fusion method, which comprises the following steps: generating a permission data set based on organization permissions and permission levels of a user in different organizations; determining permission attributes and permission objects according to the organization permission; according to the permission level, determining permission weights and permission thresholds of the user in different organizations; inputting the permission attribute, the permission weight and the permission threshold value into a first multi-scale neural network, and determining a first membership feature of the user permission under the multi-organization structure; inputting the permission object, the permission weight and the permission threshold value into a second multi-scale neural network, and determining a second membership feature of the user permission under the multi-scale architecture; inputting the first membership feature and the second membership first feature into a trained multi-permission fusion network, and generating a plurality of permission mapping functions; and according to the permission mapping function, generating a permission fusion identifier of the user, and binding the permission fusion identifier with a plurality of organizations where the user is located.

Description

Technical Field

[0001] The present invention relates to the field of industrial data processing, and in particular to a multi-organization architecture and user authority integration method. Background Art

[0002] In the modern information society, people may hold different positions or perform different tasks in different organizations due to work needs, so users may have different permissions in different organizations. However, the existing permission management methods have some problems, such as permission conflicts and insufficient permissions. Therefore, it is necessary to provide a multi-organization architecture and user permission fusion method that can solve these problems.

[0003] At present, patent CN202311068266.5 is a user rights fusion method, system and device based on a multi-organizational architecture. It proposes a method of receiving a user's request to log in to the system, and binding the user rights and role rights to the user at the same time when the static configuration takes effect; receiving a user's request to enter a business application, binding the organizational rights and position rights of the business application to the user; based on the priority of the rights, the various rights are fused and calculated to obtain the real effective rights of the user. In addition, the user rights issues of multi-organizational architectures can be efficiently handled, system costs can be saved, data management can be facilitated, and problems such as cluttered rights and rights conflicts can be avoided.

[0004] However, the above technical solution has many technical defects when it is implemented:

[0005] For example, when a user belongs to multiple organizational units and has multiple positions, permission fusion may lead to permission conflicts. For example, a user is granted a certain permission in one organizational unit, but is denied the same permission in another organizational unit.

[0006] In addition, administrators need to understand the complex permission structure, including different types of permissions and their priorities, which may increase the error rate of permission configuration. Summary of the invention

[0007] The present invention proposes a multi-organizational architecture and user authority fusion method to solve the problem in the prior art that when a user belongs to multiple organizational units and has multiple positions, authority fusion may cause authority conflicts. For example, a user is granted a certain authority in one organizational unit, but is prohibited from the same authority in another organizational unit. Administrators need to understand the complex authority structure, including different types of authorities and their priorities, which may increase the error rate of authority configuration.

[0008] The present invention proposes a multi-organization architecture and user authority integration method, including:

[0009] Obtain the user's organizational permissions and permission levels in different organizations and generate permission data sets;

[0010] According to the organizational authority, determine the user's authority attributes and authority objects in different organizations;

[0011] Determine the authority weight and authority threshold of users in different organizations based on the authority level;

[0012] Inputting permission attributes, permission weights, and permission thresholds into a first multi-scale neural network to determine a first affiliation feature of user permissions under a multi-organizational structure;

[0013] Inputting the permission object, permission weight and permission threshold into a second multi-scale neural network to determine a second membership feature of the user permission under the multi-scale architecture;

[0014] Inputting the first membership feature and the second membership first feature into the trained multi-authority fusion network to generate multiple authority mapping functions;

[0015] According to the permission mapping function, a permission fusion identifier of the user is generated, and the permission fusion identifier is bound to multiple organizations to which the user belongs.

[0016] Furthermore, the generating permission data set also includes:

[0017] Get the organization to which the user belongs, and build the permission model for the user in each organization;

[0018] According to the permission model, identify the permission scope and permission type of users in each organization in turn;

[0019] According to the permission type of users in each organization, determine the permission triggering events of different permissions of users in an organization;

[0020] Determine the permission identification of users in each organization based on the permission trigger event;

[0021] According to the permission type and permission identifier, the permission data of users in each organization is identified in turn, and the corresponding permission subset is generated;

[0022] The permission subsets are merged to form a permission data set.

[0023] Furthermore, the step of sequentially identifying the permission data of users in each organization includes:

[0024] Determine a first trigger result of a first permission trigger event of a user target permission in each organization, wherein the first trigger result is used to execute a user instruction after the first permission trigger event is triggered;

[0025] Based on the first trigger result, determine the permission scope of the user's target permission and the topological organization nodes that meet the corresponding permission;

[0026] According to the topological organization nodes, the node data of each topological organization node is obtained in turn, and the permission data is generated.

[0027] Furthermore, determining the permission attributes and permission objects of users in different organizations according to the organizational permissions includes:

[0028] According to the organization authority, obtain application response information involved when the user triggers the corresponding user authority; wherein the application response information is the function options generated by the application program triggered by the user authority when executing the user authority;

[0029] According to the application response information, determine the permission attributes of the corresponding user permissions; wherein the permission attributes include: permission identification, permission name, permission description, permission level, permission group, permission scope, permission status, permission grantability, permission dependency, permission dynamicity and permission inheritance;

[0030] According to the permission attributes, determine the permission object directly associated with the corresponding user permission.

[0031] Furthermore, determining the authority weights and authority thresholds of users in different organizations according to the authority levels includes:

[0032] Determine the user's authority role in different organizations based on the authority level;

[0033] According to the authority role, determine the resource sensitivity of different organizational businesses corresponding to the customer's organizational authority in different organizations;

[0034] Based on resource sensitivity, determine the minimum and maximum resource sensitivity of users in different organizations accessing different organizations' businesses, and determine the permission thresholds for business users in different organizations;

[0035] According to the permission threshold, determine the first configuration weight of different organizational businesses relative to the corresponding organizational structure; wherein the first configuration weight is the business weight, and the business weight is used to indicate the importance of user permissions;

[0036] According to the authority role, determine the second configuration weight of different organizational businesses relative to the organizational structure; wherein the second configuration weight is a machine weight, and the machine weight is used to indicate the degree of influence of different authority roles on user authority;

[0037] The permission weight is determined based on the deep weighting of business weight and machine weight, where the deep weighting is used to regularize the weight.

[0038] Furthermore, the step of inputting the permission attribute, permission weight and permission threshold into the first multi-scale neural network to determine the first affiliation feature of the user permission under the multi-organizational architecture includes:

[0039] Obtain the permission attributes, permission weights, and permission thresholds of users under different organizational structures to generate multi-scale permission data;

[0040] Mapping the multi-scale authority data to the multi-scale correlation model of multi-scale fusion to generate a multi-scale fusion feature set;

[0041] According to the multi-scale fusion features, the membership functions of different authority attributes, authority weights and authority thresholds in different organizational structures are established in turn;

[0042] According to the membership function, a first authority association matrix under the multi-organizational structure is established to determine the first membership feature.

[0043] Furthermore, the step of inputting the permission object, the permission weight and the permission threshold into a second multiscale neural network to determine a second membership feature of the user permission under the multiscale architecture includes:

[0044] According to the effects of permission objects, permission weights and permission thresholds in the process of triggering user organization permissions, a multi-level hierarchical permission triggering model is established;

[0045] Determine multi-scale input parameters based on the permission trigger model;

[0046] According to the multi-scale input parameters, determine the indicator weight of each authority indicator in the multi-level hierarchy;

[0047] Input the indicator weights into the second multi-scale neural network to determine the multi-scale feature weights;

[0048] The multi-scale feature weights are converted into the second membership features through the Sigmoid function.

[0049] Furthermore, the first membership feature and the second membership feature are input into a trained multi-authority fusion network to generate multiple authority mapping functions, including:

[0050] Determine the multi-organizational structure where the user is located and build a distributed multi-organizational network;

[0051] Obtaining a fusion parameter determined after inputting the first membership feature and the second membership feature into a trained multi-authority fusion network;

[0052] The fusion parameters are associated and mapped with different network branches of the multi-organizational structure network to generate a permission mapping function.

[0053] Furthermore, the associating and mapping of the fusion parameters with different network branches of the multi-tissue structure network includes.

[0054] Determine the associated computing tasks corresponding to any network branch in the multi-organization structure network;

[0055] According to the fusion parameters and the associated computation tasks, the unique functional associations of different network branches with respect to the fusion parameters are determined;

[0056] According to the unique function correlation, the correlation mapping relationship between different network branches and fusion parameters is determined, and the correlation mapping function is generated;

[0057] Generate and associate the mapping function with the user authority and the permission mapping function accordingly.

[0058] Furthermore, generating a user's permission fusion identifier according to the permission mapping function includes:

[0059] In response to the permission mapping function, generating a permission hash ring of the user;

[0060] Through the permission hash ring, the unique function solutions of user permissions in the multi-organization architecture are recorded in sequence, and the unique function solutions are used as the unique mapping of the permission hash ring;

[0061] Generate the user's permission fusion identifier through unique mapping.

[0062] The beneficial effects of the present invention are:

[0063] The present invention can achieve refined management of user permissions by analyzing the user's organizational permissions and permission levels. For the permissions of the same user in different organizational structures, the permission fusion can be achieved, and then the permission call of multiple organizational structures can be realized through a verification method. The present invention trains a multi-permission fusion network, and the generated permission mapping function can intelligently handle the permission fusion problem, adapt to the permission management under multiple organizational structures, and has strong adaptability and extensibility for organizational structure adjustment or permission change. The generation and binding of the user permission fusion identifier in the present invention makes the permission range of each user clearly visible, and improves the transparency of permission management.

[0064] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0065] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0067] In the attached picture:

[0068] Figure 1 A method flow chart of a multi-organization architecture and user authority integration method in an embodiment of the present invention;

[0069] Figure 2 is a diagram of a generation process of a permission data set in an embodiment of the present invention;

[0070] Figure 3 The figure is a flow chart of generating a permission fusion identifier in an embodiment of the present invention. DETAILED DESCRIPTION

[0071] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0072] like Figure 1 As shown, this embodiment provides a multi-organization architecture and user authority integration method proposed by the present invention, including:

[0073] Obtain the user's organizational permissions and permission levels in different organizations and generate permission data sets;

[0074] According to the organizational authority, determine the user's authority attributes and authority objects in different organizations;

[0075] Determine the authority weight and authority threshold of users in different organizations based on the authority level;

[0076] Inputting permission attributes, permission weights, and permission thresholds into a first multi-scale neural network to determine a first affiliation feature of user permissions under a multi-organizational structure;

[0077] Inputting the permission object, permission weight and permission threshold into a second multi-scale neural network to determine a second membership feature of the user permission under the multi-scale architecture;

[0078] Inputting the first membership feature and the second membership first feature into the trained multi-authority fusion network to generate multiple authority mapping functions;

[0079] According to the permission mapping function, a permission fusion identifier of the user is generated, and the permission fusion identifier is bound to multiple organizations to which the user belongs.

[0080] The principle of the above technical solution is:

[0081] In actual implementation, the present invention first obtains the organizational authority and authority level of the user in different organizations and generates an authority data set. It queries the authority records of the user in each organization through user identity authentication to obtain the authority and authority level of the user in different organizations. Then, according to the organizational authority, it determines the authority attributes and authority objects of the user in different organizations. It determines the authority attributes and authority objects of the user in different organizations by analyzing the authority data.

[0082] Then, according to the permission level, the permission weight and permission threshold of the user in different organizations are determined. Specifically, the permission weight and permission threshold of the user in different organizations are determined through further analysis of the permission data and permission attributes.

[0083] Next, the permission attributes, permission weights, and permission thresholds are input into the first multiscale neural network to determine the first membership characteristics of the user permissions under the multi-organizational architecture. Specifically, the permission attributes, permission weights, and permission thresholds of the user in different organizations are used as inputs, and the first membership characteristics of the user permissions under the multi-organizational architecture are obtained through learning and processing by the first multiscale neural network.

[0084] Then, the permission object, permission weight and permission threshold are input into the second multiscale neural network to determine the second membership characteristics of the user's permission under the multiscale architecture. Specifically, the permission object, permission weight and permission threshold of the user in different organizations are used as input, and the second membership characteristics of the user's permission under the multiscale architecture are obtained through learning and processing of the second multiscale neural network.

[0085] Finally, the first membership feature and the second membership feature are input into the trained multi-authority fusion network to generate multiple authority mapping functions. Specifically, the first membership feature and the second membership feature obtained in the first two steps are fused and combined to obtain multiple authority mapping functions. Then, according to the authority mapping function, the user's authority fusion identifier is generated, and the authority fusion identifier is bound to the multiple organizations to which the user belongs.

[0086] In this process, the user rights are mapped to the corresponding permission objects, and the user's permission fusion identifier is generated. The identifier is bound to the multiple organizations to which the user belongs, so that the user can switch freely between multiple organizations while ensuring the consistency and integrity of the user's rights. The present invention extracts the membership characteristics of user rights through a multi-scale neural network to more accurately determine the user's permission positioning in a complex organizational structure.

[0087] The beneficial effects of the above scheme are:

[0088] The present invention can achieve refined management of user permissions by analyzing the user's organizational permissions and permission levels. For the permissions of the same user in different organizational structures, the permission fusion can be achieved, and then the permission call of multiple organizational structures can be realized through a verification method. The present invention trains a multi-permission fusion network, and the generated permission mapping function can intelligently handle the permission fusion problem, adapt to the permission management under multiple organizational structures, and has strong adaptability and extensibility for organizational structure adjustment or permission change. The generation and binding of the user permission fusion identifier in the present invention makes the permission range of each user clearly visible, and improves the transparency of permission management.

[0089] As an embodiment of the present invention, the generating permission set further includes:

[0090] Get the organization to which the user belongs, and build the permission model for the user in each organization;

[0091] According to the permission model, identify the permission scope and permission type of users in each organization in turn;

[0092] According to the permission type of users in each organization, determine the permission triggering events of users with different permissions in each organization;

[0093] Determine the permission identification of users in each organization based on the permission trigger event;

[0094] According to the permission type and permission identifier, the permission data of users in each organization is identified in turn, and the corresponding permission subset is generated;

[0095] The permission subsets are merged to form a permission data set.

[0096] The principle of the above technical solution is:

[0097] like Figure 2 As shown in the figure, in the actual implementation process, organization affiliation identification is to determine which organizations the user belongs to. Determine the organizational classification for permission integration, because the permissions of different organizations may be different. Permission model construction is to build a permission model for each organization to which the user belongs. The permission model defines the permission structure and type of users within the organization.

[0098] Permission scope and type identification is to identify the user's permission scope (that is, what resources the user can access) and permission type (such as functional permissions, data permissions, etc.) in each organization through the permission model. Permission trigger event determination is to define permission trigger events based on permission types. These events are conditions or actions that trigger permissions to take effect, such as user login, access to specific applications, or execution of specific operations.

[0099] Permission identification is to determine a permission identification for each permission triggering event. The permission identification is used to uniquely identify the permission in the permission data set. Permission data identification and subset generation is to identify the specific permission data of the user in each organization based on the permission type and permission identification, and generate permission subsets.

[0100] The fusion of permission subsets is to merge all permission subsets to form a comprehensive permission data set, which represents the user's comprehensive permissions in all organizations.

[0101] The present invention provides fine-grained permission management by identifying and defining permission scope, type and triggering events, and can accurately control user behavior and resource access. The design of the permission model adapts to changes in organizational structure and can flexibly add or modify permissions, thereby improving the scalability of the system. By integrating permission subsets of different organizations, the consistency of permissions of users in different organizations is ensured, avoiding permission conflicts and confusion.

[0102] As an embodiment of the present invention, the step of sequentially identifying the permission data of users in each organization includes:

[0103] Determine a first trigger result of a first permission trigger event of a user target permission in each organization, wherein the first trigger result is used to execute a user instruction after the first permission trigger event is triggered;

[0104] Based on the first trigger result, determine the permission scope of the user's target permission and the topological organization nodes that meet the corresponding permission;

[0105] According to the topological organization nodes, the node data of each topological organization node is obtained in turn, and the permission data is generated.

[0106] The principle of the above technical solution is:

[0107] In the actual implementation process, the permission triggering event and the triggering result can determine the first permission triggering event of the user's target permission, that is, the specific event or condition that triggers the permission to take effect. The first triggering result is the action or command that should be executed when this permission triggering event occurs, usually executing a certain instruction of the user.

[0108] The scope of permissions and topological organization nodes are based on the first trigger result to determine the scope of permissions of the user's target permissions, that is, the specific resources or functions that the user can access or operate. At the same time, the topological organization nodes that meet these permissions are identified. Topological organization nodes refer to specific locations in the network or organizational structure, which represent the specific scope of the permissions.

[0109] Node data acquisition and permission data generation is to obtain the data of each node in turn according to the determined topological organization nodes. This data may include organizational structure information, resource information, role information, etc. Based on these node data, permission data is generated, which defines the user's permissions on a specific organizational node.

[0110] Event-driven permission management is achieved by defining permission triggering events and triggering results, so that the effectiveness of permissions is closely related to specific user behaviors or system events, improving the real-time and responsiveness of permission management.

[0111] The present invention can accurately define the scope of user permissions by determining the scope of permissions and topological organization nodes, thereby avoiding abuse and misuse of permissions. By acquiring data from topological organization nodes, structured permission data can be generated, which is easier to be understood and executed by the system, improving the accuracy and efficiency of permission configuration. This solution allows permission configuration to be combined with the topological structure of the organization, making permission configuration more flexible and able to adapt to dynamic changes in the organizational structure.

[0112] As an embodiment of the present invention, determining the permission attributes and permission objects of users in different organizations according to the organizational permissions includes:

[0113] According to the organization authority, obtain application response information involved when the user triggers the corresponding user authority; wherein the application response information is the function options generated by the application program triggered by the user authority when executing the user authority;

[0114] According to the application response information, determine the permission attributes of the corresponding user permissions; wherein the permission attributes include: permission identification, permission name, permission description, permission level, permission group, permission scope, permission status, permission grantability, permission dependency, permission dynamicity and permission inheritance;

[0115] According to the permission attributes, determine the permission object directly associated with the corresponding user permission.

[0116] The principle of the above technical solution is:

[0117] In actual implementation, application response information acquisition means obtaining application response information related to a specific permission when the user triggers the permission. Application response information is the functional options provided by the application when executing the user permission, which reflects the application's response to the permission request.

[0118] Permission attribute judgment is to judge the permission attributes of user permissions based on the obtained application response information. These attributes are metadata that describe and classify permissions in detail, including the permission's identification, name, description, level, grouping, scope, status, grantability, dependency, dynamicity, and inheritance.

[0119] The permission object is determined based on the permission attributes. The system determines the permission object directly associated with the user's permission. The permission object refers to the specific entity to which the permission applies, such as a specific data record, function module or resource.

[0120] The present invention achieves fine-grained management of permissions by obtaining application response information and judging permission attributes, making permission configuration more accurate and flexible. The acquisition and use of application response information ensure that users can obtain appropriate feedback and functional options when exercising permissions, thereby improving user experience. The detailed definition of permission attributes helps to clearly describe various aspects of permissions, making the management and understanding of permissions more intuitive. By determining the permission object, the user's access and operation to specific resources can be more accurately controlled, thereby improving the security of the system. Permission attributes provide multiple dimensions to describe permissions, allowing administrators to flexibly configure permissions according to actual needs. This solution takes into account the dependency and inheritance of permissions, which helps to deal with complex permission relationships, especially in multi-organizational architectures.

[0121] As an embodiment of the present invention, determining the authority weight and authority threshold of the user in different organizations according to the authority level includes:

[0122] Determine the user's authority role in different organizations based on the authority level;

[0123] According to the authority role, determine the correspondence between the customer's organizational authority in different organizations and the resource sensitivity of the business of different organizations;

[0124] Based on resource sensitivity, determine the minimum and maximum resource sensitivity of users in different organizations accessing different organizations' businesses, and determine the permission thresholds for business users in different organizations;

[0125] According to the permission threshold, determine the first configuration weight of different organizational businesses relative to the corresponding organizational structure; wherein the first configuration weight is the business weight, and the business weight is used to indicate the importance of user permissions;

[0126] According to the authority role, determine the second configuration weight of different organizational businesses relative to the organizational structure; wherein the second configuration weight is a machine weight, and the machine weight is used to indicate the degree of influence of different authority roles on user authority;

[0127] The permission weight is determined based on the deep weighting of business weight and machine weight, where the deep weighting is used to regularize the weight.

[0128] The principle of the above technical solution is:

[0129] In actual implementation, permission roles are assigned to users in different organizations based on permission levels. Permission roles are an abstraction of the operations that users can perform and the resources they can access within an organization. Resource sensitivity analysis is the analysis of the correspondence between user permission roles and resource sensitivity of different organizational businesses. Resource sensitivity refers to the degree of confidentiality, integrity and availability required by business resources. Permission thresholds are based on resource sensitivity, and determine the minimum and maximum sensitivity of users accessing resources of different organizational businesses, thereby determining the user's permission threshold. Permission thresholds are permission restrictions for users to access specific resources. Business weight configuration is to configure the first configuration weight, namely business weight, for different organizational businesses relative to their organizational structure based on permission thresholds, which indicates the importance of user permissions relative to the business. Machine weight configuration is to determine the second configuration weight, namely machine weight, for different organizational businesses relative to the organizational structure based on permission roles, which indicates the size of the impact of different permission roles on user permissions. Depth weighting determines permission weights by depth weighting of business weights and machine weights, that is, regularizing the weights to determine the final permission weights. Deep weighting is to balance the differences between different weights and ensure the rationality and accuracy of authority weights.

[0130] By determining the permission roles and resource sensitivity, the present invention can achieve refined management of permissions and ensure that users can only access resources within their permission scope. By setting permission thresholds, sensitive resources can be effectively protected to prevent unauthorized access. The configuration of business weights enables the importance of different businesses to be reflected, which helps to make reasonable permission decisions when permissions conflict. The configuration of machine weights takes into account the degree of influence of different permission roles, so that permission allocation is more in line with the actual needs of the organization. Through deep weighting, permission weights can be flexibly adjusted to adapt to changes in organizational structure and business processes.

[0131] As an embodiment of the present invention, inputting the permission attribute, the permission weight and the permission threshold into the first multi-scale neural network to determine the first membership feature of the user permission under the multi-organization architecture includes:

[0132] Obtain the permission attributes, permission weights, and permission thresholds of users under different organizational structures to generate multi-scale permission data;

[0133] Mapping the multi-scale authority data to the multi-scale correlation model of multi-scale fusion to generate a multi-scale fusion feature set;

[0134] According to the multi-scale fusion features, the membership functions of different authority attributes, authority weights and authority thresholds in different organizational structures are established in turn;

[0135] According to the membership function, a first authority association matrix under the multi-organizational structure is established to determine the first membership feature.

[0136] The principle of the above technical solution is:

[0137] In actual implementation, the generation of multi-scale permission data is to collect the permission attributes (such as permission identification, name, description, etc.), permission weights (reflecting the importance of permissions) and permission thresholds (restriction conditions of permissions) of users under different organizational structures, and generate multi-scale permission data. These data contain permission information of different dimensions and granularity. The generation of multi-scale fusion feature sets is to map the generated multi-scale permission data into a multi-scale fusion multi-scale correlation model. The multi-scale correlation model can process and fuse data of different scales to generate a comprehensive feature set, which can reflect the correlation of permission data at different scales. The establishment of membership function is to establish membership functions for permission attributes, permission weights and permission thresholds in different organizational structures based on multi-scale fusion features. The membership function is a concept in fuzzy logic, which is used to describe the degree to which an element belongs to a set. The establishment of the first permission association matrix is ​​to establish the first permission association matrix under the multi-organizational structure through the membership function. The first permission association matrix is ​​used to represent the degree of correlation between different permissions. The determination of the first membership feature is to determine the user's permission membership feature according to the first permission association matrix, that is, the degree to which the user's permission belongs to a specific permission set.

[0138] The present invention can more comprehensively understand and manage user rights through multi-scale data analysis, and adapt to the complexity of different organizational structures. The generation of multi-scale fusion feature sets enables different rights information to be fused in multiple dimensions, thereby improving the accuracy of rights management. The application of membership functions makes rights management more flexible, can handle the uncertainty of rights boundaries, and better simulate the rights relationship in actual multi-organizational structures.

[0139] As an embodiment of the present invention, inputting the permission object, the permission weight and the permission threshold into the second multiscale neural network to determine the second membership feature of the user permission under the multiscale architecture includes:

[0140] According to the effects of permission objects, permission weights and permission thresholds in the process of triggering user organization permissions, a multi-level hierarchical permission triggering model is established;

[0141] Determine multi-scale input parameters based on the permission trigger model;

[0142] According to the multi-scale input parameters, determine the indicator weight of each authority indicator in the multi-level hierarchy;

[0143] Input the indicator weights into the second multi-scale neural network to determine the multi-scale feature weights;

[0144] The multi-scale feature weights are converted into the second membership features through the Sigmoid function.

[0145] The principle of the above technical solution is:

[0146] In the actual implementation process, a multi-level hierarchical permission trigger model is established. It mainly analyzes the role of permission objects, permission weights and permission thresholds in different operations or decision-making processes, and builds a multi-level model to simulate how these permissions are triggered or applied in different situations. The multi-level hierarchical permission trigger model can reflect the interaction and influence between different permission elements. Determining multi-scale input parameters is to determine the input parameters that need to be considered at different levels and scales based on the constructed permission trigger model. Input parameters may include the user's role, the sensitivity of the operation, environmental conditions (such as access time and location), etc.

[0147] Multiscale analysis allows the model to consider these factors at different levels of abstraction, thereby better capturing the details of complex permission logic. Determining the indicator weights of each permission indicator is to assign a weight to each indicator by analyzing and evaluating the contribution and impact of different permission indicators on the overall permission management goal. This step directly affects the quality of the final permission decision. Inputting into the second multiscale neural network and converting it into the second membership feature is to input the above-obtained indicator weights into a specially designed multiscale neural network, and further optimize and synthesize these weights to generate a more accurate and adaptable permission configuration scheme. Through the Sigmoid function conversion, the output result can be standardized between 0 and 1 to form the so-called second membership feature. The second membership feature more intuitively represents the user's degree of membership or access ability to different permission objects.

[0148] As an embodiment of the present invention, the first membership feature and the second membership feature are input into a trained multi-authority fusion network to generate multiple authority mapping functions, including:

[0149] Determine the multi-organizational structure where the user is located and build a distributed multi-organizational network;

[0150] Obtaining a fusion parameter determined after inputting the first membership feature and the second membership feature into a trained multi-authority fusion network;

[0151] The fusion parameters are associated and mapped with different network branches of the multi-organizational structure network to generate a permission mapping function.

[0152] The technical principle of the above technical solution is:

[0153] In the actual implementation process, building a distributed multi-organizational network involves establishing a network model that can reflect the relationship between different organizations, departments or roles in the multi-organizational structure where the user is located. The network model is essentially a graph structure in which nodes represent organizations, departments or roles, and edges represent the authority or data flow relationship between them.

[0154] To determine the fusion parameters, the first membership feature (which may represent the allocation of permissions based on roles or attributes) and the second membership feature (which may represent the adjustment of permissions based on behavior, context, or predictive analysis) are input into a pre-trained multi-permission fusion network. The multi-permission fusion network learns the interaction and influence between the two membership features to determine a set of fusion parameters that can best combine the two features to generate a more accurate and adaptable permission configuration.

[0155] Generating permission mapping functions is to use the determined fusion parameters to associate and map different network branches of the distributed multi-organizational network. In essence, the fusion parameters are applied to different parts of the network model to generate a series of permission mapping functions. The permission mapping function describes which permissions a user should be granted under different organizational structures and operating scenarios.

[0156] As an embodiment of the present invention, the associating and mapping the fusion parameters with different network branches of the multi-organization structure network includes.

[0157] Determine the associated computing tasks corresponding to any network branch in the multi-organizational structure network;

[0158] According to the fusion parameters and the associated computation tasks, the unique functional associations of different network branches with respect to the fusion parameters are determined;

[0159] According to the unique function correlation, the correlation mapping relationship between different network branches and fusion parameters is determined, and the correlation mapping function is generated;

[0160] The association mapping function is matched with the user authority to generate the authority mapping function.

[0161] The principle of the above technical solution is:

[0162] In actual implementation, the associated computing tasks are determined, which involves identifying the specific computing tasks that need to be performed by each network branch in the multi-organizational network. These tasks may be related to data access, permission verification, policy execution, etc. The determination of unique functional association is based on fusion parameters (these parameters take into account multiple factors such as user attributes, behavior patterns, environmental conditions, etc.). This step aims to establish a mathematical relationship between each network branch and the fusion parameters. This usually involves complex algorithm design to ensure that each network branch can adjust its behavior (such as access control policy) according to changes in the fusion parameters.

[0163] Generate an association mapping function, which is to generate an association mapping function for each network branch according to the unique function association determined above. These functions define how to dynamically adjust the permission configuration according to the fusion parameters, so as to achieve more flexible and sophisticated permission management.

[0164] As an embodiment of the present invention, generating a user's permission fusion identifier according to a permission mapping function includes:

[0165] In response to the permission mapping function, generating a permission hash ring of the user;

[0166] Through the permission hash ring, the unique function solutions of user permissions in the multi-organization architecture are recorded in sequence, and the unique function solutions are used as the unique mapping of the permission hash ring;

[0167] Generate the user's permission fusion identifier through unique mapping.

[0168] The principle of the above technical solution is:

[0169] like Figure 3 As shown, in actual implementation, a permission hash ring is generated, and a permission mapping function is used to generate a user's permission hash ring. A hash ring is a data structure used for consistent hashing algorithms in distributed systems, which can effectively manage and locate data. In this application, it is used to manage and locate user permission information. The unique function solution records the unique function solution of user permissions in a multi-organization architecture in sequence through a permission hash ring. A unique function solution refers to a unique result calculated by a permission mapping function for each permission, which represents the position of the permission on the hash ring. A unique mapping, which is based on a unique function solution for each permission, is used as a unique mapping on the permission hash ring. This means that each permission can find a unique position on the hash ring, thereby ensuring the uniqueness of the permission identifier. The permission fusion identifier is a permission fusion identifier generated by the above-mentioned unique mapping. The permission fusion identifier is a comprehensive representation of all permissions of a user in a multi-organization architecture, which can be used to quickly identify and verify the user's permission set.

[0170] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A multi-organizational architecture and user authority integration method, characterized in that: include: Obtain the user's organizational permissions and permission levels in different organizations and generate permission data sets; According to the organizational authority, determine the user's authority attributes and authority objects in different organizations; Determine the authority weight and authority threshold of users in different organizations based on the authority level; Inputting permission attributes, permission weights, and permission thresholds into a first multi-scale neural network to determine a first affiliation feature of user permissions under a multi-organizational structure; Inputting the permission object, permission weight and permission threshold into a second multi-scale neural network to determine a second membership feature of the user permission under the multi-scale architecture; Inputting the first membership feature and the second membership first feature into the trained multi-authority fusion network to generate multiple authority mapping functions; According to the permission mapping function, a permission fusion identifier of the user is generated, and the permission fusion identifier is bound to multiple organizations to which the user belongs.

2. A multi-organization architecture and user authority integration method as claimed in claim 1, characterized in that: The generating permission data set further includes: Get the organization to which the user belongs, and build the permission model for the user in each organization; According to the permission model, identify the permission scope and permission type of users in each organization in turn; According to the permission type of users in each organization, determine the permission triggering events of different permissions of users in each organization; Determine the permission identification of users in each organization based on the permission trigger event; According to the permission type and permission identifier, the permission data of users in each organization is identified in turn, and the corresponding permission subset is generated; The permission subsets are merged to form a permission data set.

3. A multi-organization architecture and user authority integration method as claimed in claim 2, characterized in that: The step of sequentially identifying the permission data of users in each organization includes: Determine a first trigger result of a first permission trigger event of a user target permission in each organization, wherein the first trigger result is used to execute a user instruction after the first permission trigger event is triggered; Based on the first trigger result, determine the permission scope of the user's target permission and the topological organization nodes that meet the corresponding permission; According to the topological organization nodes, the node data of each topological organization node is obtained in turn, and the permission data is generated.

4. A multi-organization architecture and user authority integration method as claimed in claim 1, characterized in that: Determining the permission attributes and permission objects of users in different organizations according to the organizational permissions includes: According to the organization authority, obtain application response information involved when the user triggers the corresponding user authority; wherein the application response information is the function options generated by the application program triggered by the user authority when executing the user authority; According to the application response information, determine the permission attributes of the corresponding user permissions; wherein the permission attributes include: permission identification, permission name, permission description, permission level, permission group, permission scope, permission status, permission grantability, permission dependency, permission dynamicity and permission inheritance; According to the permission attributes, determine the permission object directly associated with the corresponding user permission.

5. A multi-organization architecture and user authority integration method as claimed in claim 4, characterized in that: Determining the authority weights and authority thresholds of users in different organizations according to the authority levels includes: Determine the user's authority role in different organizations based on the authority level; According to the authority role, determine the resource sensitivity of different organizational businesses corresponding to the customer's organizational authority in different organizations; Based on resource sensitivity, determine the minimum and maximum resource sensitivity of users in different organizations accessing different organizations' businesses, and determine the permission thresholds for business users in different organizations; According to the permission threshold, determine the first configuration weight of different organizational businesses relative to the corresponding organizational structure; wherein the first configuration weight is the business weight, and the business weight is used to indicate the importance of user permissions; According to the authority role, determine the second configuration weight of different organizational businesses relative to the organizational structure; wherein the second configuration weight is a machine weight, and the machine weight is used to indicate the degree of influence of different authority roles on user authority; The permission weight is determined based on the deep weighting of business weight and machine weight, where the deep weighting is used to regularize the weight.

6. A multi-organization architecture and user authority integration method as claimed in claim 1, characterized in that: The step of inputting the permission attribute, the permission weight and the permission threshold into the first multi-scale neural network to determine the first affiliation characteristic of the user permission under the multi-organization architecture includes: Obtain the permission attributes, permission weights, and permission thresholds of users under different organizational structures to generate multi-scale permission data; Mapping the multi-scale authority data to the multi-scale correlation model of multi-scale fusion to generate a multi-scale fusion feature set; According to the multi-scale fusion features, the membership functions of different authority attributes, authority weights and authority thresholds in different organizational structures are established in turn; According to the membership function, a first authority association matrix under the multi-organizational structure is established to determine the first membership feature.

7. A multi-organization architecture and user authority integration method as claimed in claim 1, characterized in that: The step of inputting the permission object, the permission weight and the permission threshold into a second multiscale neural network to determine a second membership feature of the user permission under the multiscale architecture includes: According to the effects of permission objects, permission weights and permission thresholds in the process of triggering user organization permissions, a multi-level hierarchical permission triggering model is established; Determine multi-scale input parameters based on the permission trigger model; According to the multi-scale input parameters, determine the indicator weight of each authority indicator in the multi-level hierarchy; Input the indicator weights into the second multi-scale neural network to determine the multi-scale feature weights; The multi-scale feature weights are converted into the second membership features through the Sigmoid function.

8. A multi-organization architecture and user authority integration method as claimed in claim 1, characterized in that: The first membership feature and the second membership feature are input into the trained multi-authority fusion network to generate multiple authority mapping functions, including: Determine the multi-organizational structure where the user is located and build a distributed multi-organizational network; Obtaining a fusion parameter determined after inputting the first membership feature and the second membership feature into a trained multi-authority fusion network; The fusion parameters are associated and mapped with different network branches of the multi-organizational structure network to generate a permission mapping function.

9. A multi-organization architecture and user authority integration method as claimed in claim 8, characterized in that: The step of associating and mapping the fusion parameters with different network branches of the multi-organization structure network includes: Determine the associated computing tasks corresponding to any network branch in the multi-organizational structure network; According to the fusion parameters and the associated computation tasks, the unique functional associations of different network branches with respect to the fusion parameters are determined; According to the unique function correlation, the correlation mapping relationship between different network branches and fusion parameters is determined, and the correlation mapping function is generated; The association mapping function is matched with the user authority to generate the authority mapping function.

10. A multi-organization architecture and user authority integration method as claimed in claim 1, characterized in that: The step of generating a user's permission fusion identifier according to the permission mapping function includes: In response to the permission mapping function, generating a permission hash ring of the user; Through the permission hash ring, the unique function solutions of user permissions in the multi-organization architecture are recorded in sequence, and the unique function solutions are used as the unique mapping of the permission hash ring; Generate the user's permission fusion identifier through unique mapping.

Images