Data permission configuration method and system based on semantics

Abstract

The present application relates to the technical field of permission configuration, and in particular, to a data permission configuration method and system based on semantics. The method includes: obtaining semantic keywords corresponding to the object to be processed; generating corresponding permission coding feature groups based on the semantic keywords; inputting the permission coding feature groups into the business permission configuration model to obtain permission configuration information of the data to be processed; the business permission configuration model is used to generate a dynamic permission configuration scheme associated with the target business scenario where the object to be processed is located; and executing permission configuration of the object to be processed based on the permission configuration information. By introducing semantic keywords, permission coding feature groups and dynamic permission configuration models, the method significantly improves the accuracy, flexibility and security of permission management, can dynamically adapt to changes in business needs, reduce manual intervention, reduce management costs, and at the same time ensure data security and compliance, so that users can achieve efficient and intelligent permission management in complex business environments.

Description

Technical Field

[0001] The present application relates to the technical field of permission configuration, and in particular to a semantic-based data permission configuration method, system and electronic device. Background Art

[0002] Traditional methods of data permission management mainly include three strategies: role-based access control (RBAC), user-based access control (UBAC), and access control list (ACL). RBAC manages user access by assigning fixed permissions to roles. It is suitable for environments with a large number of users, but it is difficult to cope with frequently changing organizational structures. UBAC directly assigns permissions to each user, providing high control accuracy, but as the number of users increases, permission management becomes complex and difficult to maintain. ACL maintains a permission list for each data object, allowing fine-grained control, but management becomes complex when the number of data objects and users is large.

[0003] In the above-mentioned related technologies, the traditional method manages data access by assigning fixed permissions to each role. This method assumes that the permission requirements of the role are static and fixed. However, as the organizational structure and business change, the roles and responsibilities of employees may change, and the fixed permission assignment may not be able to adapt to these changes in a timely manner. For example, if an employee transfers from the sales department to the marketing department, his old sales data permissions may no longer apply, but the traditional system may require manual adjustment of permissions, which is cumbersome and error-prone. In a system with fixed role permission encoding, role permissions need to be manually updated every time the organizational structure or business process changes. This update process is not only time-consuming, but also prone to permission configuration errors, leading to data access problems. For example, when adding a new department or team, role permissions need to be redefined and assigned, which may lead to inconsistent or missing permission configurations.

[0004] In addition, in the related art, the traditional role-based permission model is usually based on a predefined set of roles and permissions, and has poor adaptability to data access control scenarios that require dynamic adjustment. The workflow and business needs within an organization are often changing, and this static permission model is difficult to adjust in real time and may not be able to effectively meet the dynamic needs of the business. In large organizations, the hierarchy of roles and permissions can be very complex. Fixed permission coding systems often have difficulty effectively managing such complex hierarchical relationships. When business needs or organizational structures change, adjusting the permission hierarchy requires complex manual modifications, which increases the difficulty of management.

[0005] In summary, it is urgent to propose a completely new technical solution to solve at least one of the above technical problems. Summary of the invention

[0006] In response to the technical problems existing in the prior art, this application provides a semantic-based data permission configuration method and system to improve the accuracy, flexibility and security of permission management, dynamically adapt to changes in business needs, reduce manual intervention, reduce management costs, and ensure data security and compliance.

[0007] In a first aspect, an embodiment of the present application provides a data permission configuration method based on semantics, the method comprising:

[0008] Obtaining semantic keywords corresponding to the object to be processed; the semantic keywords at least include the data type, data dimension, and identity attribute corresponding to the object to be processed;

[0009] Generate corresponding permission coding feature groups based on semantic keywords; the permission coding feature groups are used to represent specific change trends of data access behaviors of the objects to be processed;

[0010] Input the permission coding feature group into the business permission configuration model to obtain permission configuration information of the data to be processed; the business permission configuration model is used to generate a dynamic permission configuration scheme associated with the target business scenario where the object to be processed is located; the business permission configuration model is pre-built based on the organizational structure and business requirements of the target business scenario;

[0011] Execute permission configuration of the object to be processed based on the permission configuration information.

[0012] In a second aspect, the embodiment of the present application provides a data permission configuration system based on semantics, the system includes the following units, wherein:

[0013] An acquisition unit is configured to acquire semantic keywords corresponding to the object to be processed; the semantic keywords at least include data types, data dimensions, and identity attributes corresponding to the object to be processed;

[0014] A generating unit is configured to generate a corresponding permission coding feature group based on the semantic keywords; the permission coding feature group is used to represent a specific change trend of the data access behavior of the object to be processed;

[0015] The permission division unit is configured to input the permission coding feature group into the business permission configuration model to obtain permission configuration information of the data to be processed; the business permission configuration model is used to generate a dynamic permission configuration scheme associated with the target business scenario where the object to be processed is located; the business permission configuration model is pre-built based on the organizational structure and business requirements of the target business scenario;

[0016] The configuration unit is configured to perform permission configuration of the object to be processed based on the permission configuration information.

[0017] In a third aspect, an embodiment of the present application provides an electronic device, the electronic device comprising:

[0018] at least one processor, memory, and input-output unit;

[0019] The memory is used to store computer programs, and the processor is used to call the computer programs stored in the memory to execute the semantic-based data permission configuration method of the first aspect.

[0020] In a fourth aspect, a computer-readable storage medium is provided, which includes instructions, and when the instructions are executed on a computer, the computer executes the semantic-based data permission configuration method of the first aspect.

[0021] The beneficial effect of the present application is: a data permission configuration method and system based on semantics is provided. In the technical solution, the semantic keywords corresponding to the object to be processed are obtained; the semantic keywords at least include the data type, data dimension, and identity attribute corresponding to the object to be processed. Then, the corresponding permission coding feature group is generated based on the semantic keywords; the permission coding feature group is used to represent the specific change trend of the data access behavior of the object to be processed. Then, the permission coding feature group is input into the business permission configuration model to obtain the permission configuration information of the data to be processed; the business permission configuration model is used to generate a dynamic permission configuration scheme associated with the target business scenario where the object to be processed is located; the business permission configuration model is pre-built based on the organizational structure and business requirements of the target business scenario. Finally, the permission configuration of the object to be processed is executed based on the permission configuration information. By introducing semantic keywords, permission coding feature groups and dynamic permission configuration models, the technical solution significantly improves the accuracy, flexibility and security of permission management, can dynamically adapt to changes in business needs, reduce manual intervention, reduce management costs, and at the same time ensure data security and compliance, so that users can achieve efficient and intelligent permission management in a complex business environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a flowchart of a semantic-based data permission configuration method and system according to an embodiment of the present application;

[0023] Figure 2 It is a structural diagram of a semantic-based data permission configuration system according to an embodiment of the present application;

[0024] Figure 3 It is a structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0026] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0027] The embodiment of the present application provides a data permission configuration method and system based on semantics. In this technical solution, the semantic keywords corresponding to the object to be processed are obtained; the semantic keywords at least include the data type, data dimension, and identity attribute corresponding to the object to be processed. Furthermore, a corresponding permission coding feature group is generated based on the semantic keywords; the permission coding feature group is used to represent the specific change trend of the data access behavior of the object to be processed. Next, the permission coding feature group is input into the business permission configuration model to obtain the permission configuration information of the data to be processed; the business permission configuration model is used to generate a dynamic permission configuration scheme associated with the target business scenario where the object to be processed is located; the business permission configuration model is pre-built based on the organizational structure and business requirements of the target business scenario. Finally, the permission configuration of the object to be processed is executed based on the permission configuration information.

[0028] From a technical point of view, in the embodiments of the present application, the data type, data dimension and identity attribute of the object to be processed are extracted by semantic keywords, and the system can more accurately classify and process the data accessed by the user. Compared with the traditional permission configuration method, this semantic method can identify the user's permission requirements and data characteristics in a more fine-grained manner, ensuring that users can only access content related to their business needs, avoiding excessive authorization or unauthorized access. The permission configuration scheme is dynamically generated based on the organizational structure and business needs of the business scenario, and can update the permission configuration at any time according to changes in the business (such as department adjustments, job responsibilities changes, etc.). This enables the system to respond to changes in business scenarios in real time, reduce the workload of manually adjusting permission configurations, and ensure that the system remains in compliance.

[0029] In an embodiment of the present application, the permission coding feature group generated based on semantic keywords can more flexibly represent the user's access behavior characteristics and data change trends. This coding feature group can dynamically reflect the user's permission requirements, allowing the system to adjust permissions according to the user's actual access behavior, ensuring that both business needs are met and data security is guaranteed. Through fine-grained analysis of user access behavior and generation of permission coding feature groups, the system can monitor and predict possible data access risks in real time in the permission configuration model. For example, frequent abnormal access behaviors or behaviors that exceed the user's routine operations can limit potential risks by dynamically adjusting the permission configuration. In addition, combined with the company's security compliance rules, the system can ensure the implementation of compliance requirements during the permission configuration process, such as access control of sensitive data, protection of privacy data, etc.

[0030] In the embodiments of the present application, the complexity of a large number of manual settings in traditional permission configuration is greatly reduced by automatically generating permission configuration information. Especially in large enterprises or organizations, dynamic permission management can reduce the operational burden of operation and maintenance personnel in permission allocation and update, and improve management efficiency. At the same time, reducing manual intervention can also reduce permission misallocation or loopholes caused by human errors.

[0031] Compared with the traditional permission management method, which takes a lot of time to reset or update permissions when business needs change, in the embodiment of the present application, permission configuration is dynamically generated through semantic keywords and permission coding feature groups, and the permission model can quickly respond to changes in needs according to real-time data, greatly shortening the time for permission adjustment and ensuring business continuity. Specifically, based on the personalized access behavior characteristics and identity information of users, a personalized permission configuration scheme is provided. For example, users with different positions and different permission requirements will be given different permissions according to their behavior patterns and business needs, ensuring that permission configuration is closely related to the user's actual business, improving user experience while avoiding excessive allocation or abuse of permissions. In addition, through the user access behavior and permission usage recorded by the system, the system can perform data analysis, identify common access patterns, permission usage rates, etc., so as to further optimize the permission configuration model. This continuous optimization mechanism not only improves the rationality of permission configuration, but also can adjust permission policies in a timely manner to avoid long-term excessive looseness or excessive strictness of permissions.

[0032] Of course, it should also be noted that the semantic permission configuration method of the embodiment of the present application has good scalability. With the expansion of business scenarios or the complexity of organizational structures, the system can easily cope with more data types and permission requirements by expanding the semantic keyword library and permission coding feature group. At the same time, this method can also be compatible with other permission management systems or platforms to achieve cross-system permission linkage and management. As the system's ability to automatically process permission configuration is enhanced, the cost of permission management for enterprises is reduced. This is not only reflected in the reduction of the workload of operation and maintenance personnel, but also in more efficient permission review and compliance inspection processes. Dynamic permission management reduces the manual operation of permission management, making overall permission management more efficient and economical.

[0033] In summary, the embodiments of the present application significantly improve the accuracy, flexibility and security of permission management by introducing semantic keywords, permission coding feature groups and dynamic permission configuration models. It can dynamically adapt to changes in business needs, reduce manual intervention, and reduce management costs, while ensuring data security and compliance, allowing users to achieve efficient and intelligent permission management in complex business environments.

[0034] The semantic-based data permission configuration solution provided in the embodiment of the present application can also be executed by an electronic device, which can be a server, a server cluster, or a cloud server.

[0035] Figure 1 A flowchart of a semantic-based data permission configuration method provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method comprises the following steps:

[0036] 101, obtaining semantic keywords corresponding to the object to be processed;

[0037] 102, generating a corresponding permission coding feature group based on the semantic keywords;

[0038] 103, input the permission coding feature group into the business permission configuration model to obtain the permission configuration information of the data to be processed;

[0039] 104. Execute permission configuration of the object to be processed based on the permission configuration information.

[0040] In the embodiment of the present application, the object to be processed refers to the specific data or data set that needs to be subject to permission control and access management, which usually involves various types of business information in the organization, such as users, files, database records, business forms, application data, etc. Specifically, it includes the following categories: business data related to the core business of the enterprise (such as customer information, order data, etc.), whose permissions determine the user's access and operation capabilities to these data; documents and files in the enterprise system (such as contracts, reports, etc.), which need to ensure the safe access and management of files according to permissions; various database records (such as employee information, financial data, etc.), permission control determines who can access or operate specific records; the system resources of the enterprise (such as application resources, background configuration files, etc.), also need permission control; personal identity information (such as role information, department affiliation, etc.), this type of information affects the scope of the user's permissions; other sensitive data (such as confidential information, financial statements, etc.), require strict permission management to ensure security. In the actual permission configuration process, the type and scope of the object to be processed vary according to different business scenarios.

[0041] In the embodiment of the present application, the semantic keywords at least include the data type, data dimension, and identity attribute corresponding to the object to be processed. In the embodiment of the present application, the semantic keywords are key information for classifying and describing the object to be processed. At least three categories are included: data type, data dimension, and identity attribute. These keywords help the system to more accurately identify the object to be processed, and then dynamically generate the corresponding permission configuration. The data type is a description of the category of the object to be processed itself, which is used to distinguish different data contents. For example, the data can be customer information, order data, product information, financial statements, etc. For example, if the object to be processed is an order record of an enterprise, the data type is "order data". The data dimension is used to further refine and describe the characteristics of the data, and is usually related to the statistics, analysis, and permission control of the data. For example, the data can be divided according to the time dimension (by day, month, year), the regional dimension (by country, city), or the business dimension (department, product line). For example, assuming that the object to be processed is sales data, the data dimension may include "time dimension" (such as 2023), "regional dimension" (such as North America), and "product dimension" (such as sales data of product line A). Identity attributes are used to describe the identity information of users who access data, and affect what data users can access. Identity attributes usually include roles (such as managers, employees, administrators), departments (such as sales departments, finance departments), job levels (such as junior, intermediate, senior), and permission levels. For example, if the user is a financial manager, the identity attributes can include information such as "Finance Department", "Manager", and "Senior Permissions".

[0042] Assuming that the object to be processed is a set of annual sales data of a company, for the manager of the finance department, the system will extract the following semantic keywords: data type: sales data; data dimension: 2023, North America; identity attributes: finance department, manager, senior authority. Based on these semantic keywords, the system can generate corresponding permission configurations to allow the finance manager to access the company's sales data in North America in 2023.

[0043] 101, obtain the semantic keywords corresponding to the object to be processed. In the embodiment of the present application, obtaining the semantic keywords corresponding to the object to be processed is the first step in the entire permission configuration process, and its purpose is to extract information that can accurately describe the essential characteristics of the object to be processed. These semantic keywords include data types, data dimensions, and identity attributes.

[0044] In the embodiment of the present application, the data type is used to describe what type of data the object to be processed is, which helps the system identify the basic categories of data. The data structure analyzes the table structure or file format of the object to be processed. For example, the table name and field name in the database can usually reveal the data type. Metadata includes a data dictionary defined in the database system, or related meta information in the file system. Labels / annotations, that is, some data sources may come with labels or annotation information, which can also be used as a basis for identifying data types. A table "CustomerInfo" in the customer management system can be judged from the table name and fields (such as "CustomerID", "CustomerName") that the data type is customer information. The file name in the order system is "Orders_2023.xlsx", and it can be inferred that the data type is order data.

[0045] In the embodiment of the present application, the data dimension is used to describe different ways of segmenting data, which can be time, geographic location or business logic classification. Field information analyzes the fields in the data table or file. Such as date fields, geographic location fields, etc. The data content directly analyzes the data content, and the value of the data item can also provide dimension information. Business rules determine possible dimensions based on business logic and rules. The sales data table contains the fields "SaleDate" and "Region", and it can be determined that the data dimensions are time dimensions and regional dimensions. The report file summarizes the sales data of different regions in 2023, and it can be determined that the data dimensions are time dimensions (2023) and regional dimensions (different regions).

[0046] In the embodiment of the present application, identity attributes are used to describe the specific characteristics of users accessing data, including roles, departments, ranks, etc. User authority system The internal authority management system of the enterprise saves the detailed identity information of users. User sessions are obtained through the information provided by the user when logging in (such as user name, identity identifier). LDAP / Active Directory: The identity attributes of users are obtained through the user directory service of the enterprise. For example, the user table of the financial system contains the fields "Role" and "Department", and these fields can be used to extract the role and department information of the user. The information returned by the single sign-on system after the user logs in includes "UserLevel" and "Team", which can be used to determine that the identity attributes are "senior authority" and "such and such team". Extract data type and dimension information from data tables, file structures, or data content. Use system-predefined metadata or data dictionaries to obtain semantic keywords. Obtain the identity attributes of users from the enterprise authority system or user directory service. Integrate the information obtained in the above steps to form a complete set of semantic keywords, including data types, data dimensions, and identity attributes. Through these steps, the system can obtain semantic keywords that accurately describe the objects to be processed, providing a basis for subsequent authority configuration.

[0047] As an optional embodiment, in 101, obtaining the semantic keywords corresponding to the object to be processed can be implemented as follows:

[0048] 201, identifying the data type to which the object to be processed belongs, and using the identified data type as the first semantic keyword corresponding to the object to be processed; the data type is set and entered based on the target business scenario;

[0049] 202, determining the data dimension to which the object to be processed belongs;

[0050] 203, extracting key attribute information and / or behavior information of the object to be processed in the corresponding data dimension as a second semantic keyword corresponding to the object to be processed;

[0051] 204 , based on the identified data type, select a corresponding identity attribute from an identity attribute library corresponding to the target business scenario as a third semantic keyword.

[0052] In this optional embodiment, first, the system will identify the data type to which the object to be processed belongs, and use it as the first semantic keyword. The data type is usually set and entered in advance based on the target business scenario. During the system initialization or configuration phase, the business system of the enterprise will predefine different data types according to specific business needs. These types may include: customer information, order data, sales records, product information, etc. In actual applications, the system will extract or match the corresponding data type from the business scenario by analyzing the object to be processed (such as reading metadata, table structure, file name, etc.). For example, in the order management module of an e-commerce platform, the object to be processed may be an order table or order file. After parsing, the system identifies the data type of the object as "order data" and uses it as the first semantic keyword. Next, the system will analyze the data dimension to which the object to be processed belongs. The data dimension is important information for segmenting the data from different perspectives, usually including time, region, product category, etc. The system identifies the dimension information contained therein by analyzing the field structure or data content of the object to be processed, such as date field, region field, etc. The system can also automatically identify the dimensions associated with the object, such as time dimension, region dimension, business dimension, etc., in combination with the settings in the business scenario. For example, for order data, the system recognizes that there is a date field "OrderDate" and a region field "Region" in the order table, thereby determining that the dimensions of the data are "time dimension" and "region dimension". After identifying the data dimensions, key attribute information or behavior information is further extracted from these dimensions, and this information is used as the second semantic keyword. Key attribute information may include specific values ​​under the dimension, such as: year, month under the time dimension, country or city under the region dimension. Behavior information refers to operations or behaviors related to the dimension, such as a user's operation record in a specific time period, or sales activities in a specific region. For example, for order data, the system extracts the key attribute information "2023" from the "time dimension" and the key attribute information "North America" ​​from the "region dimension", and uses this information as the second semantic keyword. Finally, based on the identified data type (i.e., the first semantic keyword), the system selects appropriate identity attributes from the identity attribute library corresponding to the target business scenario as the third semantic keyword. Identity attributes are used to determine the user's access rights and operation permissions to the data object.

[0053] Enterprise systems usually have an identity attribute library that stores information such as user roles, departments, job levels, and authority levels. The library is associated based on specific business scenarios and data types. Based on the data type, the system automatically selects the identity attribute related to the current business scenario from the identity attribute library as the third semantic keyword. Assuming that the order data needs to be reviewed by the financial manager, during the matching process, the system selects the identity attribute "Finance Manager" from the identity attribute library based on the data type "Order Data" as the third semantic keyword.

[0054] For example, the object to be processed is the order data table in the e-commerce platform. The first semantic keyword: the data type is "order data". The second semantic keyword: the data dimension is "orders in North America in 2023". The third semantic keyword: the identity attribute is "finance manager".

[0055] Through this process, the system can automatically generate semantic keywords for different business scenarios to help accurately manage permission control and data access.

[0056] Further optionally, after selecting the corresponding identity attribute as the third semantic keyword from the identity attribute library corresponding to the target business scenario based on the identified data type, a semantic association network of the object to be processed can be constructed based on the first semantic keyword, the second semantic keyword, and the third semantic keyword corresponding to the object to be processed. Furthermore, the dynamic influence characteristics between different data dimensions are extracted from the semantic association network of the object to be processed as the fourth semantic keyword of the object to be processed. The fourth semantic keyword is used to characterize the associative semantic information of the object to be processed.

[0057] In this further optional embodiment, a semantic association network of the objects to be processed is constructed, and the dynamic influence features therein are extracted to generate a fourth semantic keyword. The main purpose is to enhance the understanding of the complex relationships between the objects to be processed, especially the correlation between different data dimensions.

[0058] After extracting the first semantic keyword (data type), the second semantic keyword (data dimension), and the third semantic keyword (identity attribute), the system builds a semantic association network based on these keywords. This network can help the system understand the association between different objects and analyze the mutual influence between different dimensions.

[0059] Node: The nodes in the semantic association network represent different semantic keywords, such as data types, data dimensions, and identity attributes. Each keyword (such as "order data", "2023", "financial manager") will be a node in the network.

[0060] Edges: The edges between nodes represent the semantic associations between these keywords. For example, the edge between "order data" and "2023" represents "the performance of order data in 2023", while the edge between "2023" and "financial manager" represents the association of "the financial manager handles the order data in 2023".

[0061] For example, for the order data of an e-commerce platform, the semantic association network may contain the following nodes and edges. Nodes: "order data", "2023", "North America", "financial manager". Edges: "order data" and "2023", "order data" and "North America", "financial manager" and "2023 order data", etc.

[0062] After the semantic association network is constructed, the system further analyzes the dynamic influence characteristics between different data dimensions. These characteristics characterize the strength of the relationship between different dimensions, the size of the influence, and how they interact with each other.

[0063] Relationship strength: By calculating the association frequency, data interaction times, or behavior patterns between nodes, the system can quantify the strength of the relationship between different data dimensions. For example, the order data for "2023" and "North America" ​​may be closely related, as reflected by the high frequency of large-scale data interactions or co-occurrences.

[0064] Impact assessment: By analyzing the correlation between different nodes, the system can identify whether certain dimensions have a greater impact on the overall data. For example, the data performance of a specific time period or region may dominate the trend of the entire business.

[0065] Behavioral patterns: The system can also extract relevant behavioral features based on the user's behavior in different dimensions, further reflecting the mutual influence of data dimensions. For example, the operation behaviors of different roles (such as financial managers and sales managers) at a specific time or region can be regarded as influence features.

[0066] Orders in North America showed significant growth in 2023, which may indicate a strong correlation and influence between the two dimensions of "North America" ​​and "2023". The actions of financial managers are concentrated in specific months or regions, which can become a behavioral pattern, indicating that in a specific time period or region, the decisions of financial managers have a significant impact on order data.

[0067] The system generates a fourth semantic keyword based on the dynamic influence features extracted from the semantic association network. This keyword is used to characterize the semantic information of the association between different data dimensions of the object to be processed, and describes how these dimensions influence each other.

[0068] After the dynamic influence features are extracted, the system uses these features as the fourth semantic keyword. For example, based on the strength of correlation and the size of influence, keywords such as "high time-region correlation" and "significant user behavior impact" can be generated. This fourth semantic keyword can not only describe the current state of the object, but also be used to predict future trends or behaviors, further improving the system's understanding of the object to be processed.

[0069] Assume that in the order data of North America in 2023, the system recognizes that the operations of the financial manager have a significant impact on the order data, and the sales growth in North America in a specific time period is particularly obvious. Based on these characteristics, the fourth semantic keyword generated by the system may be: high time-region dynamic influence; the financial manager has a significant impact on the order data.

[0070] For example, the object to be processed is the order data of North America in 2023 on the e-commerce platform. The first semantic keyword is order data. The second semantic keyword is 2023, North America. The third semantic keyword is financial manager. The fourth semantic keyword is that the time-region correlation is high, and the financial manager's operation has a significant impact.

[0071] In this way, we can not only understand the static characteristics of the object to be processed, but also capture the dynamic relationship between different data dimensions through the semantic association network, and generate richer semantic keywords for subsequent processing and analysis.

[0072] Optionally, the data type is one of customer data, supplier data, financial data, product data, business data, and operation data. Furthermore, the semantic keywords include at least one of identity information, position information, customer information, supplier information, supply chain relationship, financial transaction information, product attributes, product sales, business process, business change trend, product operation, and business operation.

[0073] In a further optional embodiment, the data type may specifically include one of the following: customer data (such as basic customer information, purchase records, etc.), supplier data (such as supplier qualifications, cooperation records), financial data (such as income and expenditure records, financial statements), product data (such as product specifications, inventory information), business data (such as business processes, market dynamics), and operation data (such as equipment status, operating indicators). The semantic keywords corresponding to each data type can be extracted from the following dimensions to further enrich the semantic expression of the data.

[0074] Identity information includes basic identity characteristics related to individuals or enterprises, such as the name and contact information of customers, or the registration information of suppliers. Position information refers to the job attributes of data accessors or operators, such as managers, salesmen, and financial personnel. Customer information covers information such as customer behavior patterns, demand characteristics, and loyalty. Supplier information refers to the qualifications, performance capabilities, credit ratings, and other characteristics related to suppliers. Supply chain relationships reflect the upstream and downstream supply chain relationships between enterprises and suppliers and customers. Financial transaction information involves the company's income and expenditure records, accounts receivable and payable, and financial statements. Product attributes describe basic information such as product specifications, quality, and categories. Product sales include sales data, market share, sales trends, etc. Business processes reflect the operation of internal business of an enterprise, such as procurement processes and production processes. Business change trends identify dynamic trends such as business growth and changes in market demand. Product operations include product marketing, user feedback, and after-sales service. Business operations involve the overall operational efficiency, strategic execution, and daily management of the enterprise.

[0075] These keywords can better capture the relationship and influence between different data dimensions through the construction of semantic association networks, and ultimately generate fourth semantic keywords that describe the complex semantic information of data objects. For example, customer data may be closely associated with financial transaction information and business change trends, thereby revealing the dynamic impact of customer behavior on financial status and business development. Through this process, the system can establish deeper semantic associations between different data types, providing strong support for data analysis and decision-making.

[0076] As an optional embodiment, a corresponding permission coding feature group is generated based on the semantic keywords in 102. In the embodiment of the present application, the permission coding feature group is used to represent a specific change trend of the data access behavior of the object to be processed.

[0077] In an embodiment of the present application, the permission coding feature group is used to represent a specific change trend in the data access behavior of the object to be processed. Specifically, the permission coding feature group can reflect the regularity or abnormal trend of data access behavior by analyzing the access rights of users or systems to data and their changes. The permission coding feature group is generated by encoding the access rights of users or roles to data in the system. Each feature group includes multiple dimensions related to data access, such as user identity, access right level, data access frequency, time span, etc. The permission coding method can be to assign levels according to the user's access rights to different data objects (such as customer data, financial data, etc.), or to record access behavior within a specific time period. Specifically, user identities such as the access behavior of different roles such as financial managers and salesmen to the system. Access right levels such as read permissions, modify permissions, delete permissions, etc. Data access frequency such as the number of times a user accesses specific data within a period of time. Time span is such as the change of the user's access rights within a specific time period.

[0078] By monitoring and analyzing data access behaviors in permission-encoded feature groups, change trends can be identified. These change trends can be manifested as an increase or decrease in access frequency, an upgrade or downgrade of access rights, or changes in user access behaviors to different data objects. These trends can help the system identify potential abnormal behaviors, security risks, or reveal changes in internal workflows within the enterprise.

[0079] Changes in access frequency: If a user frequently accesses a certain type of sensitive data within a short period of time, it may indicate a risk of data leakage.

[0080] Permission adjustment trend: The system finds that the permission levels of multiple users are increased in batches within a certain period of time, indicating changes in business needs or potential security risks.

[0081] Changes in access to data objects: For example, if a salesperson previously accessed mainly customer data but recently began to frequently access financial data, this may indicate a change in job responsibilities or abnormal behavior.

[0082] The permission coding feature group not only records static permission information, but also extracts dynamic change features through long-term monitoring and comparative analysis of historical records of permission changes. For example, when the permissions of a role are gradually expanded and data types that do not match their responsibilities are frequently accessed, the system can issue a warning based on this dynamic change trend. When the system recognizes that the user's access behavior does not match the normal pattern (for example, permissions are increased too quickly or the frequency of access to sensitive data increases abnormally), anomaly detection can automatically trigger a security review. By analyzing the trend of permission changes, the business process optimization system can evaluate whether the permission configuration of certain positions is reasonable and whether adjustments are needed to adapt to new business needs or workflows.

[0083] Through the permission coding feature group, the system can monitor and analyze the trends in data access behavior in a more detailed manner. This can not only help enterprises improve security and prevent data leakage, but also optimize resource allocation and process management by analyzing changes in permissions. For example, frequent changes in permissions may indicate changes in organizational structure or business needs, thereby providing reference information for decision makers.

[0084] In the embodiment of the present application, the permission coding feature group can express specific change trends of permissions and data access behaviors by encoding and analyzing user data access behaviors. These change trends can reflect dynamic changes in access frequency, permission level, etc., help the system identify potential security risks and business process changes, and thus provide strong support for enterprise data security and process optimization.

[0085] Specifically, in 102, a data isolation range corresponding to the object to be processed is generated according to the semantic keywords. The semantic keywords correspond to multiple data types, and each data type corresponds to a data isolation range delineation method. Then, the semantic keywords are converted into corresponding permission coding feature groups according to the corresponding data isolation ranges, and the permission coding feature groups are used to indicate the data access permission characteristics of the object to be processed.

[0086] In the embodiment of the present application, the core of step 102 is to generate the data isolation scope corresponding to the object to be processed according to the semantic keywords, and to characterize and manage the data access rights by combining these semantic keywords with the permission coding feature group. Specifically, this process can be broken down into the following steps:

[0087] Semantic keywords correspond to a variety of data types, and different data types reflect the various businesses and objects involved in the system (such as customer data, financial data, product data, etc.). Each data type has its corresponding data isolation scope demarcation method, which means that the system defines different access rights and isolation strategies based on different data types and semantic keywords.

[0088] Specifically, the scope of data isolation can be defined in the following ways: customer data may be isolated based on customer classification, geographic location or importance, such as the isolation between high-value customer data and general customer data. Financial data is isolated based on the sensitivity of financial statements and the importance of transaction records, such as audit data that can only be accessed by senior financial personnel. Product data can be isolated according to product category, inventory status or market performance to prevent non-related departments from accessing sensitive product information. Supplier data is isolated based on the supplier's contract information, qualification level, etc., to ensure that only personnel related to the supply chain can access it.

[0089] Specifically, if the semantic keywords involve "order data in North America" ​​and "financial manager", the system will generate corresponding data isolation scopes based on these keywords. For example, only the financial manager responsible for the North American market can access the order data in North America, while financial managers or personnel in other regions cannot access this data. After generating the data isolation scopes, the system will convert the semantic keywords into permission coding feature groups based on these scopes to define the data access permission characteristics of the objects to be processed. Each permission coding feature group contains multi-dimensional information related to data access, ensuring that the system manages access permissions in a refined manner. The system first identifies the data type and data isolation scope corresponding to the semantic keywords, and then maps these keywords to permission coding feature groups. For example, the keyword "financial manager" is mapped to advanced access permissions, while "order data" is mapped to read and write permissions for specific business data. Based on the data isolation scope, the system assigns appropriate permission levels to different users or roles. For example, the financial manager may have read and analyze permissions for order data, while users in other positions can only view summary data. The generation of permission coding feature groups can not only statically define permissions, but also dynamically adjust them according to business needs and user behavior. For example, if a user's role changes, the system can automatically update its permission coding feature group based on semantic keywords.

[0090] Based on the above principle, for example, user identity: financial manager. Data type: order data. Isolation scope: North American order data. Permission level: read permission, modify permission. Access frequency: review once a month.

[0091] Through these feature groups, the system can clearly indicate under what permissions a certain object to be processed (such as order data in North America) can be accessed, and which users have access rights. The generated permission coding feature groups are used to indicate the data access permission characteristics of the object to be processed. These feature groups can not only define static permission configurations, but also dynamically reflect the changing trends of data access, helping the system to be more flexible and accurate in permission management. By analyzing the dynamic changes of permission coding feature groups, the system can identify abnormal permission operations, optimize permission configurations, and ensure data security.

[0092] If the permission coding feature group shows that users in a certain position frequently access sensitive data, the system can evaluate whether the permission settings need to be adjusted. When semantic keywords involve different data dimensions (such as time and region), the system can automatically limit data access rights at specific times or regions based on the permission coding feature group to enhance data protection.

[0093] In the embodiment of the present application, the system generates the data isolation scope of the object to be processed through semantic keywords, and defines specific isolation strategies according to different data types. Subsequently, the system converts the semantic keywords into permission coding feature groups, which are used to characterize the data access permission characteristics of the object to be processed, helping the system to achieve dynamic management and fine control of data access permissions. In this way, the system can achieve flexible and dynamic data access permission management while ensuring data security.

[0094] Further optionally, before converting the semantic keywords into corresponding permission coding feature groups according to the corresponding data isolation scope, the target business scenario can also be input into the permission coding combination construction model to identify the business needs of the target business scenario and the operating architecture in which it is located; based on the business needs of the target business scenario and the operating architecture in which it is located, an initial permission coding architecture corresponding to the target business scenario is generated; the initial permission coding architecture at least includes the initial access permission level, the initial access permission scope, the initial data isolation rules, and the initial data isolation method; the actual access permission operation data is used to optimize and adjust the initial permission coding architecture to obtain the target permission coding architecture corresponding to the target business scenario.

[0095] In the embodiment of the present application, a method for optimizing data permission management by introducing target business scenarios is further proposed. By inputting the target business scenarios into the permission coding combination construction model, the system can identify business needs and operation architectures, generate and optimize the initial permission coding architecture, and finally form a target permission coding architecture that meets actual needs.

[0096] First, input the target business scenario into the permission coding combination construction model. The target business scenario refers to the specific business environment or situation that the system currently needs to handle, including business processes, user roles, data types, and data access requirements. For example, the target business scenario can be "new product launch process" or "annual financial audit."

[0097] The permission coding combination construction model analyzes the target business scenario, identifies its business requirements and the operational architecture in which it is located. Business requirements refer to the data types, user roles, and data operation permissions involved in the business scenario. For example, the product release process may require the marketing department and the R&D department to access product data at the same time, but with different permission levels. The operational architecture refers to the organizational structure and permission configuration related to the target business scenario within the enterprise, including departments, job responsibilities, and data flow methods. For example, in an annual audit, the finance department and the audit department may have different permission levels and data access scopes.

[0098] Based on the business requirements and operational architecture of the target business scenario, the system generates an initial permission coding architecture. The architecture includes the following elements:

[0099] Initial access permission level: Determine the permission level of different user roles, such as administrator, auditor, general user, etc.

[0100] Scope of initial access permissions: Define the scope of data that each role can access, such as department-level, company-level, and cross-departmental data.

[0101] Initial data isolation rules: Define the principles and policies for data isolation, such as isolation based on data sensitivity, business importance, or geographic region.

[0102] Initial data isolation method: the specific method of implementing data isolation, such as physical isolation, logical isolation, or isolation based on access control lists.

[0103] For example, in the new product release process, the following initial permission coding structure may be generated:

[0104] Initial access permission levels: Marketing Manager (read permission), R&D Director (read and write permission), Product Manager (full permission).

[0105] Initial access rights scope: limited to data related to new products.

[0106] Initial data isolation rules: Product data is isolated according to product stages, such as design stage, testing stage, and release stage.

[0107] Initial data isolation method: logical isolation, permission management based on access control lists.

[0108] After generating the initial permission coding structure, the system will collect and analyze the actual access permission operation data, which reflects the user's data access behavior in actual business scenarios. By comparing the initial structure with the actual access behavior, you can make optimization adjustments:

[0109] Identify deviations: If it is found that the actual access behavior is inconsistent with the initial permission structure, for example, a user frequently requests data that exceeds the scope of permissions, the system can identify and adjust the permission configuration.

[0110] Optimize permission configuration: Adjust the level and scope of access permissions based on actual operating data to ensure that permission settings meet business needs while maintaining data security.

[0111] Improve data isolation: Improve data isolation rules and methods based on actual data access situations. For example, if it is found that certain data is frequently transferred between multiple departments, it may be necessary to relax or refine the isolation rules.

[0112] During the product release process, it was found that the marketing manager frequently needed to access the data in the testing phase, but this permission was not included in the initial permission setting. The system can adjust the permission coding structure to increase the marketing manager's permission to read the test data, or adjust the data isolation method to allow cross-phase data access.

[0113] After optimization and adjustment, the system generates a target permission coding architecture. This architecture optimizes the initial permission configuration based on full consideration of business needs and data security to make it more in line with actual business scenarios: the target permission coding architecture includes the adjusted access permission level, access permission scope, data isolation rules and isolation methods to ensure that users access data within the appropriate permission scope, thereby improving business efficiency and data security.

[0114] In the embodiment of the present application, the system identifies business requirements and operation architecture through the target business scenario, and generates an initial permission coding architecture, including the initial access permission level, access permission scope, data isolation rules and methods. Then, the initial permission architecture is optimized and adjusted through the actual access permission operation data, and finally a target permission coding architecture that meets the target business scenario is generated. This process ensures that permission management not only meets business requirements, but also ensures data security and compliance.

[0115] Further optionally, in the above steps, converting the semantic keywords into corresponding permission coding feature groups according to the corresponding data isolation range can be implemented as follows:

[0116] Based on the data isolation scope, the corresponding target access permission level, target access permission scope, target data isolation rule, and target data isolation method are searched from the target permission coding architecture; based on the found target access permission level, target access permission scope, target data isolation rule, and target data isolation method, the semantic keywords are matched to the corresponding access behavior feature elements, and a permission coding feature group is constructed based on the matched access behavior feature elements. Among them, the access behavior feature elements include the access behavior features of the object to be processed in at least one dimension of the affiliated organization, data flow, business line, region, position, and job title.

[0117] In the embodiment of the present application, the process of converting semantic keywords into corresponding permission coding feature groups is further optimized. By using the data isolation scope, the corresponding permission level, access scope, data isolation rules and methods are found from the target permission coding architecture, and then the access behavior feature elements are matched according to these elements, and finally the permission coding feature group is constructed. Specifically, first, based on the data isolation scope, the system finds the following key elements from the target permission coding architecture:

[0118] Target access permission level: refers to the permission level corresponding to the user or role in the current business scenario. For example, a user may belong to the administrator level, the ordinary user level, etc.

[0119] Target access permission scope: refers to the scope of data that a user can access. This may be based on departments, regions, business lines, etc. For example, a user can only access financial data in a specific area.

[0120] Target data isolation rules: Data access and isolation policies defined according to business needs, such as whether cross-departmental access to data is allowed, or isolation requirements for data of different sensitivity levels.

[0121] Target data isolation method: The specific method of implementing data isolation, such as protecting data security through logical isolation or physical isolation.

[0122] Assuming that the data isolation scope requires that only sales managers in the North American region can access specific sales data, the system will search the target permission coding architecture for the access permission level (such as advanced read permission), access permission scope (such as limited to North American sales data), data isolation rules (such as only allowing cross-regional aggregated data), and data isolation methods (such as logical isolation based on regional divisions) for North American sales managers.

[0123] After finding the relevant target permission elements, the system needs to match these elements with semantic keywords to extract access behavior feature elements. These access behavior feature elements are used to describe the access behavior of the object to be processed in the following dimensions:

[0124] Affiliation: such as department, company, etc.

[0125] Data flow: The path along which data flows from one business line or system to another.

[0126] Business lines: such as finance, sales, production and other specific business lines.

[0127] Region: such as geographical area, market area, etc.

[0128] Position: Such as specific job title, such as manager, supervisor, etc.

[0129] Position: refers to the user's specific position or role, such as senior analyst, ordinary employee, etc.

[0130] For example, assuming that the semantic keywords involve "sales data in the North American region" and "sales manager", based on this, "North American region" is matched to the access behavior characteristic element of the region dimension. "Sales data" will be matched to the access behavior characteristic element of the business line dimension. "Sales manager" will be matched to the access behavior characteristic element of the position dimension.

[0131] Based on the matched access behavior feature elements, the system constructs a permission coding feature group. The permission coding feature group integrates the access permission level, access scope, data isolation rules and methods, and defines data access permissions based on these elements. This feature group can not only describe the current permission configuration, but also form a dynamic description of permissions by combining different feature elements.

[0132] The access permission level, access scope, data isolation rules and methods are integrated to generate a permission coding feature group containing these contents. If the actual access requirements change, the system can dynamically adjust the permission coding feature group by re-matching the access behavior feature elements. For example, if a sales manager is granted access to data in other regions, the system can reflect this change by adjusting the feature elements of the regional dimension.

[0133] For example, the access permission level is: Sales Manager (senior read permission). Access permission scope is: North American sales data. Data isolation rule is: Regional isolation, limited to North American data. Data isolation method is: Logical isolation, based on regional division.

[0134] In an embodiment of the present application, by combining the data isolation scope with the target permission coding architecture, the system can find the corresponding target access permission level, scope, data isolation rules and methods. Then, based on these target permission elements, the system matches the semantic keywords to the corresponding access behavior feature elements. Finally, the system uses these feature elements to construct a permission coding feature group, thereby achieving fine management of data access permissions for the objects to be processed. In this way, the system can dynamically adjust and optimize permission configuration to ensure that permission management meets business needs while maintaining data security.

[0135] In 103, the permission coding feature group is input into the business permission configuration model to obtain the permission configuration information of the data to be processed. As an optional embodiment, through the mapping layer, the access behavior features contained in the permission coding feature group are split and mapped into the multi-dimensional evaluation space of the business permission configuration model to obtain the corresponding access behavior evaluation value. Furthermore, the access behavior evaluation value is obtained by fusing the mapping values ​​of the access behavior features under at least two dimensions of access frequency, data privacy, access restrictions, and role scoring. Through the permission decision layer, the permission configuration path is determined, and the access behavior evaluation value associated with the permission configuration path is selected; the selected access behavior evaluation value is subjected to path optimization and permission configuration decision to obtain the target permission configuration path. Through the application layer, permission configuration information is generated based on the target permission configuration path.

[0136] In an embodiment of the present application, a multi-dimensional permission configuration method based on permission coding feature groups is proposed. By inputting the permission coding feature group into the business permission configuration model, and processing through the mapping layer, the permission decision layer and the application layer, the permission configuration information of the data to be processed is finally obtained. Specifically, the system first inputs the constructed permission coding feature group into the business permission configuration model. The permission coding feature group contains the user's access behavior characteristics, such as data access frequency, role, access permission level, etc. These feature groups provide basic data for subsequent permission configuration.

[0137] In the mapping layer, the system will split the access behavior features in the permission coding feature group and map them into the multi-dimensional evaluation space of the business permission configuration model. These evaluation spaces usually include multiple dimensions to comprehensively evaluate the rationality and risk of access behavior.

[0138] Access frequency: How frequently users access a certain type of data. Data with high access frequency may mean higher business needs or potential risks.

[0139] Data privacy: The sensitivity level of the accessed data, such as whether it involves private information or commercial secrets. Highly private data access permissions usually require stricter control.

[0140] Access restrictions: include restrictions on when, where or how users can access data, such as whether there are geographical restrictions or whether multi-factor authentication is required.

[0141] Role Scoring: User roles are scored based on their importance or level of permissions. For example, senior management roles may have higher role scores and broader data access permissions.

[0142] By mapping access behavior characteristics to these dimensions, the system calculates access behavior evaluation values. These evaluation values ​​are obtained by integrating the mapping values ​​of each dimension, reflecting the comprehensive evaluation of the user's access to data. For example, assuming that a user is a manager of the sales department, has a high access frequency, accesses sales data with medium privacy, and has a high role score, then the system may generate corresponding evaluation values ​​for the user in the three dimensions of access frequency, data privacy, and role score, and finally integrate these evaluation values ​​to obtain the total evaluation value of the user's access to specific data.

[0143] At the permission decision layer, the system determines the permission configuration path based on the access behavior evaluation value. The permission configuration path represents how the system assigns access rights and indicates the priority and security of data access. The path that best suits the current access behavior characteristics is selected from different paths. For example, if a user's access behavior evaluation value is high, the system may give priority to paths with higher access rights. Based on business needs and access security, the system optimizes the selected path. For example, some high-risk operations may require enhanced verification or temporary elevation of permissions, while other more routine operations may be performed through the default path. Based on the access behavior evaluation value and path optimization results, the system ultimately makes a permission configuration decision to determine the user's actual access rights.

[0144] For example, if a user typically accesses low-privacy data but occasionally needs to access highly sensitive financial data, the system may add an additional authentication step during path optimization to ensure that only authenticated users can access the data.

[0145] At the application layer, the system generates the final permission configuration information based on the target permission configuration path. The permission configuration information includes what data the user can access, the scope of access, timeliness, data isolation strategy, etc. The scope of access permissions includes specific data sets or business areas. Access permission levels include read-only permissions, modification permissions, management permissions, etc. The access timeliness refers to the validity period of the permission and whether it needs to be re-authorized regularly. Whether there is geographic, position or departmental level isolation in the data isolation rules. Other security measures include two-factor authentication and multi-layer encryption. For example, user: Sales manager. Data type: North American sales data. Access permissions: Read-only permissions, valid for 6 months. Security measures: Access to data requires two-factor authentication.

[0146] Through this embodiment, the system uses a multi-layer structure to process the permission coding feature group. In the mapping layer, the system maps the access behavior features to the multi-dimensional evaluation space and generates the access behavior evaluation value; in the permission decision layer, the system determines and optimizes the permission configuration path based on the evaluation value, and finally generates the permission configuration information in the application layer. This process ensures that the permission configuration can meet business needs and ensure data security.

[0147] Further optionally, the decision scoring process of the permission configuration decision module is expressed as the following formula: Among them, R j is the evaluation value of the jth access behavior, P ij For the jth access row

[0148] λ

[0149] is the linkage fitness function of the evaluation value under the i-th permission configuration path, is the specific parameter of the fitness function under the i-th permission configuration path, is the importance weight of the fitness function under the i-th permission configuration path, and O is the decision score value corresponding to the j-th access behavior evaluation value under the i-th permission configuration path.

[0150] The purpose of this formula is to calculate the adaptation score of access behavior under different paths by comprehensively considering the characteristics of access behavior and the characteristics of permission paths, so as to help the system make permission configuration decisions. Specifically, through the fitness function, the system evaluates the fitness of each access behavior and each path. A high fitness indicates that the behavior is suitable for permission configuration through this path. Through the weight and specificity parameters of the path, the system adjusts the adaptability of the path. The weight and specificity parameters are used to ensure that certain paths with high priority or special security requirements are strengthened in the calculation. The system calculates the decision score value of each path through the formula and selects the optimal path based on the score value. The higher the score, the more suitable it is for configuring the permissions of the current access behavior. In the case of multiple optional permission configuration paths, this formula can help the system automatically select the optimal path to ensure that users can access data safely and compliantly.

[0151] In the embodiments of the present application, by introducing semantic keywords, permission coding feature groups and dynamic permission configuration models, the accuracy, flexibility and security of permission management are significantly improved. It can dynamically adapt to changes in business needs, reduce manual intervention, and reduce management costs, while ensuring data security and compliance, allowing users to achieve efficient and intelligent permission management in a complex business environment.

[0152] In another embodiment of the present application, a data permission configuration system based on semantics is also provided. Figure 2 ,The semantic-based data permission configuration system includes the following units:

[0153] An acquisition unit is configured to acquire semantic keywords corresponding to the object to be processed; the semantic keywords at least include data types, data dimensions, and identity attributes corresponding to the object to be processed;

[0154] A generating unit is configured to generate a corresponding permission coding feature group based on the semantic keywords; the permission coding feature group is used to represent a specific change trend of the data access behavior of the object to be processed;

[0155] The permission division unit is configured to input the permission coding feature group into the business permission configuration model to obtain permission configuration information of the data to be processed; the business permission configuration model is used to generate a dynamic permission configuration scheme associated with the target business scenario where the object to be processed is located; the business permission configuration model is pre-built based on the organizational structure and business requirements of the target business scenario;

[0156] The configuration unit is configured to perform permission configuration of the object to be processed based on the permission configuration information.

[0157] The system can implement various steps in the above method embodiment, which will not be expanded here.

[0158] In the embodiments of the present application, the accuracy, flexibility and security of permission management are improved, the changes in business needs are dynamically adapted, manual intervention is reduced, management costs are reduced, and data security and compliance are guaranteed.

[0159] See also Figure 3 , Figure 3 Schematic diagram of an electronic device provided in an embodiment of the present application. The electronic device includes a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other via the communication bus 114.

[0160] Memory 113, used for storing computer programs;

[0161] In one embodiment of the present application, the processor 111 is used to implement the semantic-based data permission configuration method provided by any one of the above method embodiments when executing the program stored in the memory 113.

[0162] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the semantic-based data permission configuration method provided by any one of the above method embodiments is implemented.

[0163] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0164] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0165] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0168] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data permission configuration method based on semantics, characterized in that: Methods include: Obtaining semantic keywords corresponding to the object to be processed; the semantic keywords at least include the data type, data dimension, and identity attribute corresponding to the object to be processed; Generate corresponding permission coding feature groups based on semantic keywords; The permission coding feature group is used to represent the specific change trend of the data access behavior of the object to be processed; Input the permission coding feature group into the business permission configuration model to obtain the permission configuration information of the data to be processed; The business permission configuration model is used to generate a dynamic permission configuration scheme associated with the target business scenario where the object to be processed is located; The business permission configuration model is pre-built based on the organizational structure and business requirements of the target business scenario; Execute permission configuration of the object to be processed based on the permission configuration information.

2. According to the semantic-based data permission configuration method of claim 1, it is characterized in that: Get the semantic keywords corresponding to the object to be processed, including: Identify the data type of the object to be processed, and use the identified data type as the first semantic keyword corresponding to the object to be processed; the data type is set and entered based on the target business scenario; Determine the data dimension to which the object to be processed belongs; Extracting key attribute information and / or behavior information of the object to be processed under the corresponding data dimension as a second semantic keyword corresponding to the object to be processed; Based on the identified data type, a corresponding identity attribute is selected from the identity attribute library corresponding to the target business scenario as the third semantic keyword.

3. According to the semantic-based data permission configuration method of claim 2, it is characterized in that: Based on the identified data type, after selecting the corresponding identity attribute from the identity attribute library corresponding to the target business scenario as the third semantic keyword, it also includes: Based on the first semantic keyword, the second semantic keyword, and the third semantic keyword corresponding to the object to be processed, a semantic association network of the object to be processed is constructed; From the semantic association network of the object to be processed, the dynamic influence characteristics between different data dimensions are extracted as the fourth semantic keyword of the object to be processed; the fourth semantic keyword is used to characterize the association semantic information of the object to be processed.

4. According to the semantic-based data permission configuration method of claim 2, it is characterized in that: The data type is one of customer data, supplier data, financial data, product data, business data, and operation data; Semantic keywords include at least: identity information, position information, customer information, supplier information, supply chain relationship, financial transaction information, product attributes, product sales, business processes, business change trends, product operations, and business operations.

5. According to the semantic-based data permission configuration method of claim 1, it is characterized in that: Generate corresponding permission coding feature groups based on semantic keywords, including: Generate a data isolation scope corresponding to the object to be processed according to the semantic keywords; the semantic keywords correspond to multiple data types, and each data type corresponds to a data isolation scope delineation method; The semantic keywords are converted into corresponding permission coding feature groups according to the corresponding data isolation scope, and the permission coding feature groups are used to indicate the data access permission characteristics of the object to be processed.

6. According to the semantic-based data permission configuration method of claim 5, it is characterized in that: Before converting the semantic keywords into corresponding permission coding feature groups according to the corresponding data isolation scope, it also includes: Input the target business scenario into the permission coding combination construction model to identify the business requirements and operating architecture of the target business scenario; Generate an initial permission coding structure corresponding to the target business scenario based on the business requirements of the target business scenario and the operating structure in which it is located; the initial permission coding structure at least includes the initial access permission level, initial access permission scope, initial data isolation rules, and initial data isolation method; Use actual access permission operation data to optimize and adjust the initial permission coding structure to obtain the target permission coding structure corresponding to the target business scenario; According to the corresponding data isolation scope, the semantic keywords are converted into corresponding permission coding feature groups, including: Based on the data isolation scope, find the corresponding target access permission level, target access permission scope, target data isolation rules, and target data isolation method from the target permission coding architecture; Based on the found target access permission level, target access permission range, target data isolation rule, and target data isolation method, the semantic keywords are matched to the corresponding access behavior feature elements, and a permission coding feature group is constructed based on the matched access behavior feature elements; Among them, the access behavior characteristic elements include the access behavior characteristics of the object to be processed in at least one dimension of the organization to which it belongs, data flow, business line, region, position, and job title.

7. The method for configuring data permissions based on semantics according to claim 1 is characterized in that: Input the permission coding feature group into the business permission configuration model to obtain the permission configuration information of the data to be processed, including: Through the mapping layer, the access behavior features contained in the permission coding feature group are split and mapped into the multi-dimensional evaluation space of the business permission configuration model to obtain the corresponding access behavior evaluation value; the access behavior evaluation value is obtained by integrating the mapping values ​​of the access behavior features in at least two dimensions: access frequency, data privacy, access restriction, and role score; Determine the permission configuration path through the permission decision layer, and select the access behavior evaluation value associated with the permission configuration path; and perform path optimization and permission configuration decision on the selected access behavior evaluation value to obtain the target permission configuration path; Generate permission configuration information based on the target permission configuration path through the application layer.

8. The method for configuring data permissions based on semantics according to claim 7 is characterized in that: The decision scoring process of the permission configuration decision module is expressed as the following formula: Among them, R j is the evaluation value of the jth access behavior, P ij The evaluation value for the jth access behavior is in the i-th λ The linkage fitness function under the permission configuration path is the specific parameter of the fitness function under the i-th permission configuration path. is the importance weight of the fitness function under the i-th permission configuration path, and O is the decision score value corresponding to the j-th access behavior evaluation value under the i-th permission configuration path.

9. A data permission configuration system based on semantics, characterized in that: The system includes the following units, among which, An acquisition unit is configured to acquire semantic keywords corresponding to the object to be processed; the semantic keywords at least include a data type, a data dimension, and an identity attribute corresponding to the object to be processed; A generating unit is configured to generate a corresponding permission coding feature group based on the semantic keywords; the permission coding feature group is used to represent a specific change trend of the data access behavior of the object to be processed; The permission division unit is configured to input the permission coding feature group into the business permission configuration model to obtain permission configuration information of the data to be processed; the business permission configuration model is used to generate a dynamic permission configuration scheme associated with the target business scenario where the object to be processed is located; the business permission configuration model is pre-built based on the organizational structure and business requirements of the target business scenario; The configuration unit is configured to perform permission configuration of the object to be processed based on the permission configuration information.

10. An electronic device, characterized in that: include: Memory for storing computer software programs; A processor is used to read and execute a computer software program, thereby implementing the semantic-based data permission configuration method of any one of claims 1-8.

Images