Permission processing method and device

Abstract

The embodiment of the invention provides a permission processing method and device. The method comprises the following steps: obtaining operation behavior data obtained by performing operation on a third-party platform by a user based on an operation permission; based on the operation behavior data, generating a change strategy for performing authority change on the operation authority, and sending the change strategy to the block chain; if the change detection result of the change strategy is that the detection is passed, determining an authority change parameter corresponding to the change strategy according to the operation environment data of the user and the change strategy; and sending the permission change parameter to the block chain to perform permission change processing of the operation permission. By adopting the embodiment of the invention, the flexibility of authority management can be improved.

Description

Technical Field

[0001] This document relates to the field of data processing technology, and in particular to a permission processing method and device. Background Art

[0002] With the continuous development of Internet technology and the continuous advancement of social information, more and more business platforms have begun to pay attention to the information security of the platform. As the cornerstone of information security, permission management is directly related to the operational security of the business platform. At the same time, there are many users involved in the operation of the business platform, and different users may have different permissions on the business platform. In order to ensure the operational security of the business platform, it is very important to manage the permissions of the users of the business platform.

[0003] At present, in the process of managing the permissions of users of business platforms, the method of "prior application, manual review, and authorization" is often adopted. The manual review workload is large and the efficiency is low. At the same time, when users need to apply for permissions temporarily, such as handling emergencies, it is impossible to temporarily open permissions to users, and the flexibility of permission management is poor. Summary of the invention

[0004] The purpose of one embodiment of this specification is to provide a permission processing method and device to enhance the flexibility of permission management. To solve the above technical problems, one embodiment of this specification is implemented as follows: In a first aspect, an embodiment of the present specification provides a permission processing method, the method comprising: Obtaining the operation behavior data obtained by users through operations based on their operation permissions on third-party platforms; Based on the operation behavior data, a change strategy for changing the operation authority is generated, and the change strategy is sent to the blockchain; If the change detection result of the change policy returned is detection passed, determining the permission change parameters corresponding to the change policy according to the user's operating environment data and the change policy; The permission change parameters are sent to the blockchain to perform permission change processing on the operation permission.

[0005] The permission processing method provided in this embodiment obtains the operation behavior data obtained by the user based on the operation permission on the third-party platform, generates a change strategy for changing the operation permission based on the operation behavior data, sends the change strategy to the blockchain to perform change detection of the change strategy, and when the change detection result of the change strategy is a detection pass, determines the permission change parameters corresponding to the change strategy according to the user's operation environment data and the change strategy, and sends the permission change parameters to the blockchain to perform permission change of the operation permission, thereby improving the security and credibility of the permission change by setting the change detection of the change strategy on the blockchain, and performing the permission change when the change detection passes, and at the same time, through the obtained operation behavior data of the user on the third-party platform, the permission change of the operation permission is performed for the user, the automation of the permission change is improved, and the user does not need to apply, thereby improving the flexibility and convenience of the permission change, and thus improving the flexibility of permission management.

[0006] In a second aspect, another embodiment of the present specification provides another permission processing method, the method comprising: Receive change strategies for changing the user's operating permissions on third-party platforms; Call the smart contract to perform change detection on the change strategy and return the change detection result; Receive the permission change parameters corresponding to the change strategy, and call the smart contract to perform permission change processing on the operation permission according to the permission change parameters.

[0007] The permission processing method provided in this embodiment, after receiving a change policy for changing the user's operating permissions on a third-party platform, calls a smart contract to perform change detection on the change policy and returns the change detection result, and then calls the smart contract to perform permission change processing on the operating permissions according to the permission change parameters corresponding to the change policy. In this way, the change policy is change-detected through the smart contract to improve the security of permission changes for user operating permissions. At the same time, permission changes are performed through smart contracts to improve the credibility of permission changes.

[0008] In a third aspect, another embodiment of the present specification provides a permission processing device, the device comprising: A data acquisition module is used to obtain the operation behavior data obtained by users based on their operation permissions on the third-party platform; A strategy generation module, used to generate a change strategy for changing the operation authority based on the operation behavior data, and send the change strategy to the blockchain; A parameter determination module, configured to determine, if the returned change detection result of the change policy is detection passed, the permission change parameter corresponding to the change policy according to the user's operating environment data and the change policy; A parameter sending module is used to send the permission change parameter to the blockchain to perform permission change processing on the operation permission.

[0009] In a fourth aspect, another embodiment of the present specification provides another permission processing device, the device comprising: A policy receiving module is used to receive a change policy for changing the user's operating permissions on a third-party platform; A change detection module is used to call the smart contract to perform change detection on the change strategy and return the change detection result; The permission change module is used to receive the permission change parameters corresponding to the change strategy, and call the smart contract to perform permission change processing on the operation permission according to the permission change parameters.

[0010] In the fifth aspect, another embodiment of the present specification provides a permission processing device, which includes: a memory, a processor, and computer executable instructions stored on the memory and executable on the processor, and when the computer executable instructions are executed by the processor, the steps of the permission processing method described in the first aspect above are implemented.

[0011] In the sixth aspect, another embodiment of the present specification provides another permission processing device, which includes: a memory, a processor, and computer executable instructions stored in the memory and executable on the processor, and when the computer executable instructions are executed by the processor, the steps of the permission processing method described in the second aspect above are implemented.

[0012] In a seventh aspect, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the permission processing method described in the first aspect above are implemented.

[0013] In an eighth aspect, another embodiment of the present specification provides another computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the permission processing method described in the second aspect above are implemented.

[0014] In a ninth aspect, another embodiment of the present specification provides a computer program product, wherein the computer program product includes a permission processing program, and the permission processing program is executed by a processor to implement the steps of the permission processing method as described in the first aspect above.

[0015] In a tenth aspect, another embodiment of the present specification provides another computer program product, wherein the computer program product includes a permission processing program, and the permission processing program is executed by a processor to implement the steps of the permission processing method as described in the second aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate one or more embodiments of the present specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. Figure 1 A flowchart of a permission processing method provided in one embodiment of this specification; Figure 2 A flowchart of a permission processing method applied to a permission change scenario provided by an embodiment of this specification; Figure 3 A flowchart of another permission processing method provided in one embodiment of this specification; Figure 4 A schematic diagram of a permission processing device provided in one embodiment of this specification; Figure 5 A schematic diagram of another permission processing device provided in one embodiment of this specification; Figure 6 A schematic diagram of the structure of a permission processing device provided in one embodiment of this specification; Figure 7 A schematic diagram of the structure of another permission processing device provided in one embodiment of this specification. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will be combined with the drawings in one or more embodiments of this specification to clearly and completely describe the technical solutions in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0018] An embodiment of a permission processing method provided in this specification is as follows: The permission processing method provided in this embodiment can be executed by a computer device, which can be a terminal or a server, wherein the terminal can include a mobile phone, a laptop computer, an intelligent interactive device, etc., and the server can include an independent physical server, a server cluster composed of multiple servers, or a cloud server capable of cloud computing.

[0019] Reference Figure 1 The permission processing method provided in this embodiment specifically includes the following steps S102 to S108.

[0020] Step S102, obtaining operation behavior data obtained by the user performing operations based on the operation authority on the third-party platform.

[0021] The third-party platform in this embodiment can be any business platform, and the third-party platform can be the business platform to which the user belongs; this embodiment can be applied to a rights management platform, and the rights management platform can be deployed on a computer device; the third-party platform can include a third-party platform for rights management that accesses the rights management platform, such as a communication platform or an e-commerce platform. In addition, the third-party platform can also be other types of platforms, such as a financial platform.

[0022] The operation permission refers to the permission of the user to perform operations on the third-party platform, such as the permission to access the database, the permission to call the interface, and the permission to modify the database. In addition, the operation permission may also be other types of operation permissions; the user may include an institutional member of the institution corresponding to the third-party platform. For example, if the third-party platform is an e-commerce platform, the user may be an institutional member of the e-commerce institution corresponding to the e-commerce platform. This embodiment does not specifically limit the identity of the user on the third-party platform. For example, the user may be a development user or an operation user of the third-party platform. In addition, the user may also be a franchisee user of the third-party platform; the operation permission may be the user's current operation permission on the third-party platform.

[0023] The operation behavior data refers to the operation behavior data formed by the user's operation on the third-party platform. The operation behavior data can be an operation behavior sequence, that is, it can be a sequence composed of one or more operation behaviors, that is, it can be a sequence composed of one or more operation behaviors arranged in chronological order. For example, the operation behavior data is b={ }Such a sequence of operation behaviors, Represents the operation behavior at the tth moment, such as The data that users browse on third-party platforms. A sequence in which a user modifies a certain data in database a into another data.

[0024] In actual applications, when users encounter emergencies on third-party platforms, they may need to temporarily apply for operating permissions. In this regard, in order to improve the convenience of permission management of users' operating permissions on third-party platforms, permission management can be handed over to a permission management platform for professional permission management. That is, the third-party platform can sign a permission management agreement with the permission management platform. After the permission management agreement is signed, the permission management platform can manage the operating permissions of users belonging to the third-party platform on the third-party platform; specifically, after detecting the user's access instruction to the third-party platform, the permission management platform can initialize the user's attribute data and operating permissions. The operating permissions here can be the user's initial operating permissions, and the access instruction can be the first access instruction.

[0025] During specific implementation, the operation behavior data obtained by users on the third-party platform based on their operation permissions can be obtained at regular intervals. Specifically, the data acquisition interface can be called at regular intervals to obtain the operation behavior data obtained by users on the third-party platform based on their operation permissions. Data can be transmitted between the third-party platform and the permission management platform through interface calls, such as the API (Application Programming Interface) interface.

[0026] Step S104: Based on the operation behavior data, a change strategy for changing the operation authority is generated, and the change strategy is sent to the blockchain.

[0027] After obtaining the operation behavior data obtained by the user on the third-party platform based on the operation authority, in this step, in order to better meet the user's change requirements for the operation authority change, and at the same time to improve the credibility and security of the authority change, a change strategy for changing the operation authority is generated based on the operation behavior data, and the change strategy is sent to the blockchain. The change strategy in this embodiment may include a change method for changing the user's operation authority on the third-party platform, such as a change strategy for adding a modification authority for modifying data in database a, and another example is a change strategy for adding a deletion authority for deleting data in database a.

[0028] During specific implementation, a change strategy for changing the operating permissions can be generated based on the operating behavior data, and the change strategy can be sent to the blockchain to detect changes to the change strategy. Specifically, the change detection can be performed on the change strategy by calling the smart contract. That is, the blockchain can call the smart contract to detect changes to the change strategy, so as to determine whether to change the operating permissions in accordance with the change strategy, thereby improving the security of permission changes.

[0029] In actual applications, the user's demand for operating permissions on a third-party platform may change continuously. For example, the user may need the permission to modify the data in database a at the previous moment, and the user may need the permission to delete the data in database a at the next moment. In view of this, in order to meet the user's diverse needs for operating permissions on a third-party platform, in order to automatically provide users with operating permissions that meet user needs; in an optional implementation manner provided by this embodiment, in the process of generating a change strategy for changing the operating permissions based on the operating behavior data, user behavior prediction, user status identification, and behavior abnormality index calculation can be performed according to the operating behavior data, and the predicted behavior data, user status, and behavior abnormality index are obtained. The change strategy is generated according to the predicted behavior data, the user status, and the behavior abnormality index. Specifically, the following operations can be performed: Identify the user's state according to the operation behavior characteristics of the operation behavior data to obtain the user's state, and predict the user's behavior based on the operation behavior characteristics to obtain the predicted behavior data; The user's abnormal behavior index is calculated based on the operation behavior characteristics, and a change strategy is generated based on the user status, predicted behavior data and abnormal behavior index.

[0030] The user status may be a user type, for example, the user status may be an administrative user status, an operating user status, or a browsing user status. In addition, the user status may be other types of user status, such as an audit user status; or, the user status may be a behavior pattern, such as an administrative behavior pattern, a browsing behavior pattern, or an audit behavior pattern. It should be noted that the user status may be a user status sequence, that is, a behavior pattern sequence. For example, the operation behavior data is b={ } Such an operation behavior sequence, the user state can be for each operation behavior in the operation behavior sequence There are respective user states, ie, sequences of user states or sequences of behavior patterns.

[0031] On this basis, in order to mine the dependency relationship between the operation behaviors in the operation behavior data, generate high-quality operation behavior features, and at the same time to clarify the location of each operation behavior data in the operation behavior data; in an optional implementation manner provided by this embodiment, the operation behavior features are obtained by: Embedding the operation behavior data to obtain a behavior embedding vector, and performing position encoding on the operation behavior data to obtain a position vector; Attention calculation is performed based on the behavior embedding vector and position vector to obtain the operation behavior characteristics.

[0032] The operation behavior feature may be an operation behavior feature corresponding to an operation behavior sequence, that is, may be an operation behavior feature sequence.

[0033] Specifically, in the process of embedding the operation behavior data to obtain the behavior embedding vector, the operation behavior sequence can be input into the embedding algorithm for embedding processing to obtain the behavior embedding vector; in the process of performing attention calculation based on the behavior embedding vector and the position vector to obtain the operation behavior feature, the behavior embedding vector and the position vector can be input into the attention algorithm for attention calculation to obtain the operation behavior feature; or, the query vector, key vector and value vector of each moment corresponding to the operation behavior data can be calculated based on the behavior embedding vector and the position vector, and the attention weight of each moment to the remaining moments is calculated based on the query vector, key vector and value vector of each moment, and the operation behavior feature is calculated according to the attention weight and the value vector of each moment to the remaining moments; in this way, by fusing the position vector into the behavior embedding vector, the position information of each operation behavior is integrated into the behavior embedding vector, thereby improving the comprehensiveness and effectiveness of the operation behavior feature.

[0034] For example, embedding algorithms include:

[0035] in, Represents the operation behavior data Operational behavior at a given moment; represent The corresponding behavior embedding vector; Attention algorithms include:

[0036]

[0037]

[0038] in, , , Represent the query vector, key vector and value vector at the tth moment respectively; Representative The moment The key vector at each moment; Representative The moment The value vector at each moment; Representative The position vector at the moment; , , , , , , , , Represents the nonlinear transformation matrices of query, key, and value respectively; , , Bias items representing queries, keys, and values; Represents the Sigmoid activation function; represents the hyperbolic tangent activation function; stands for element-wise multiplication; Representative The moment The attention weight at each moment; represents the time scale parameter; Indicates The operation behavior characteristics at each moment, that is, represents the operation behavior characteristics; T represents the number of operation behaviors in the operation behavior data; Represents the operation behavior data moment, i and j represent the i-th and j-th moments respectively.

[0039] Through the attention calculation of the behavior embedding vector and the position vector, not only the operation behaviors in the operation behavior data are fused, but also the operation behavior data and position information are fused to improve the effectiveness of the operation behavior features.

[0040] In actual application scenarios, users in different user states may have different operation permissions. For example, a user in an operation user state may have permissions to modify data in a database and also have permissions to browse data in a database, while a user in a browsing user state may only have permissions to browse data in a database. In view of this, in order to improve the comprehensiveness and accuracy of the change strategy generated for changing the user's operation permissions, the user's state may be identified according to the operation behavior characteristics of the operation behavior data to obtain the user state, which in turn helps to subsequently generate a change strategy based on the user state. Based on the above-mentioned identification of the user's state according to the operation behavior characteristics of the operation behavior data to obtain the user state, in an optional implementation manner provided by this embodiment, in the process of identifying the user's state according to the operation behavior characteristics of the operation behavior data to obtain the user state, a behavior feature graph is constructed based on the operation behavior characteristics, and feature compression is performed based on the behavior feature graph to obtain the compressed feature as the user's user state; specifically, the following operations may be performed: Construct a behavior feature map based on the operational behavior features; According to the node feature matrix, adjacency matrix and degree matrix of the behavior feature graph, the global features are calculated and normalized to obtain the user status of the user.

[0041] The user state of the user may be a user state sequence. For example, if the operation behavior data is an operation behavior sequence, the user state of the user is the user state corresponding to each operation behavior in the operation behavior sequence, that is, the user state sequence corresponding to the operation behavior sequence. For example, the user state sequence is {manage user state, manage user state...browse user state}, which represents The corresponding user status is the management user status. The corresponding user status is the management user status. The corresponding user state is the browsing user state. The node feature matrix may include a feature matrix of each node in the behavior feature graph.

[0042] Specifically, in the process of calculating the global features of the behavior feature graph based on the node feature matrix, adjacency matrix and degree matrix of the behavior feature graph, the node feature matrix can be calculated based on the node feature matrix, adjacency matrix and degree matrix of the behavior feature graph to update the node feature matrix. When the updated node feature matrix meets the conditions, the global features are calculated based on the updated node feature matrix, and the global features are normalized to obtain the user status of the user; in the process of calculating the global features based on the updated node feature matrix, the updated node matrix can be graph pooled to obtain the global features. It should be noted that the above process of identifying the user status based on the operational behavior characteristics of the operational behavior data and obtaining the user status can be performed through a graph neural network.

[0043] In addition, in the process of calculating the global features based on the node feature matrix, adjacency matrix and degree matrix of the behavior feature graph, the node feature matrix, adjacency matrix and degree matrix of the behavior feature graph can be input into the global feature calculation algorithm for global feature calculation to obtain global features; wherein the global feature calculation algorithm can include a node feature update algorithm and a global feature algorithm, and the node feature update algorithm can be multi-layered, that is, the node feature matrix obtained by calculation in the previous layer can be input into the next layer, and the next layer can calculate the adjacency matrix and degree matrix based on the node feature matrix of the previous layer, and calculate the node feature matrix based on the node feature matrix of the previous layer and the adjacency matrix and degree matrix calculated by itself. Similarly, the node feature matrix output by the last layer is obtained, and then the node feature matrix output by the last layer can be input into the global feature algorithm for global feature calculation to obtain global features; in the process of normalizing the global features to obtain the user status of the user, the global features can be input into the normalization algorithm for normalization to obtain the user status of the user.

[0044] For example, the global feature calculation algorithm includes:

[0045]

[0046] in, Representative The node feature matrix of the layer; represents the adjacency matrix; Degree matrix; Representative The weight matrix of the layer; represents the activation function; Representative +1 layer node feature matrix; Represents the graph-level pooling function, which is used to generate global features of the graph; Represents global features.

[0047] For another example, the normalization algorithm includes:

[0048] in, Represents the user status of the user; represents the weight matrix; Represents the bias term.

[0049] In the above-mentioned process of predicting user behavior based on operation behavior characteristics and obtaining predicted behavior data, the similarity between the candidate behavior and each operation behavior feature in the operation behavior feature sequence can be calculated, and the predicted behavior data of the operation behavior sequence can be determined based on the similarity; in the process of determining the predicted behavior data of the operation behavior sequence based on the similarity, the prediction score of the candidate behavior can be calculated based on the similarity and the coefficient vector of the kernel function, and the target candidate behavior can be determined as the predicted behavior data among the candidate behaviors based on the prediction score. Specifically, the candidate behaviors can be sorted based on the prediction score, and the target candidate behavior whose arrangement position is before the preset position in the sorting result can be determined as the predicted behavior data; in the process of calculating the similarity between the candidate behavior and each operation behavior feature in the operation behavior feature sequence, the candidate behavior and the operation behavior feature sequence can be input into the kernel function for similarity calculation to obtain the similarity; for example, the kernel function is a Gaussian kernel function, a polynomial kernel function or a Laplace kernel function; wherein the predicted behavior data can be a predicted behavior sequence, that is, a sequence composed of one or more predicted behaviors.

[0050] In addition, in the process of predicting user behavior based on operational behavior characteristics and obtaining predicted behavior data, the operational behavior characteristics can also be input into a behavior prediction algorithm to predict user behavior and obtain predicted behavior data.

[0051] For example, behavior prediction algorithms include:

[0052]

[0053] in, represents predicted behavioral data; Representative candidate behavior; Represents a set of one or more candidate behaviors; Represents the behavior prediction function and the operation behavior feature sequence Next, the prediction score of candidate behavior b; represents the kernel function; Represents the coefficient vector of the kernel function; Represents the bias term.

[0054] It should be noted that the coefficient vector of the kernel function may be an algorithm parameter of the behavior prediction algorithm, and the coefficient vector of the kernel function is obtained after the algorithm to be trained is trained.

[0055] During the process of training the algorithm to be trained, the parameters of the algorithm to be trained may be adjusted once or multiple times. During each parameter adjustment, the parameters may be calculated based on the predicted behavior labels corresponding to the operation behavior sequence and the operation behavior feature sequence, and the parameters of the algorithm to be trained may be adjusted using the calculated parameters. During the process of calculating the parameters, the predicted behavior labels and the operation behavior feature sequence may also be input into the parameter calculation algorithm for parameter calculation to obtain the parameters.

[0056] For example, the parameter calculation algorithm includes:

[0057] in, Represents the coefficient vector of the kernel function in the behavior prediction algorithm; Represents the kernel matrix. , represents the similarity between the operation behavior characteristics at the i-th moment and the operation behavior characteristics at the j-th moment; Represents the regularization parameter, which is used to control the complexity of the algorithm and prevent overfitting; represents the identity matrix; The label vector representing the predicted behavior label corresponding to the operation behavior sequence.

[0058] It should be added that in the process of training the training algorithm, the training process can be transformed into a least squares problem with a regularization term, and the optimal kernel function coefficient vector can be obtained by calculating the linear equation system. .

[0059] Based on the calculation of the user's abnormal behavior index based on the operation behavior characteristics, in an optional implementation provided by this embodiment, in the process of calculating the user's abnormal behavior index based on the operation behavior characteristics, the following operations are performed: Calculate the posterior distribution based on the operational behavior characteristics, and convert the latent variables in the posterior distribution into intermediate operational behavior characteristics; The average log-likelihood is calculated based on the posterior distribution and the intermediate operation behavior characteristics, and the behavior anomaly index is calculated based on the average log-likelihood, the posterior distribution and the prior distribution.

[0060] The posterior distribution may include an approximate posterior distribution, which may be a posterior distribution of a latent variable mapped by the encoder; the intermediate operation behavior features may be obtained by converting the latent variables in the posterior distribution by the decoder; the prior distribution may include a standard normal distribution, such as the prior distribution is a standard normal distribution The user's abnormal behavior indicator may specifically be an abnormal behavior score.

[0061] Specifically, in the process of calculating the behavior anomaly index based on the average log-likelihood, the posterior distribution and the prior distribution, the divergence value between the posterior distribution and the prior distribution can be calculated, and the root divergence value and the average log-likelihood can be used to calculate the user's behavior anomaly index; wherein the divergence value may include KL (Kullback–Leibler divergence, relative entropy) divergence; thereby, the reconstruction error of the reconstructed intermediate operation behavior characteristics can be reflected through the average log-likelihood, and calculating the user's behavior anomaly index helps to subsequently determine the method of changing the user's permissions.

[0062] In the above process of calculating the user's abnormal behavior index based on the operation behavior characteristics, the operation behavior characteristics may also be input into the index calculation algorithm to calculate the abnormal index and obtain the user's abnormal behavior index.

[0063] For example, the indicator calculation algorithm includes:

[0064] in, represents latent variable; Represents the characteristics of operational behavior; represents the posterior distribution, which can be an approximate posterior distribution; Represents the behavioral characteristics of intermediate operations; , , and represent the mean and standard deviation of the approximate posterior distribution and the decoding distribution, respectively; The representative mean is , the variance is Normal distribution (Gaussian distribution); represents the average log-likelihood, which can be the average log-likelihood when reconstructing the operation behavior characteristics; Represents the encoder, mapping the operation behavior features into latent variables The posterior distribution of ; represents the decoder, and the hidden variable Refactoring to intermediate operation behavior features ; Represents the posterior distribution With prior distribution The KL divergence between .

[0065] Based on the above-mentioned generation of a change strategy according to the user status, predicted behavior data and abnormal behavior indicators, in an optional implementation manner provided by this embodiment, in the process of generating a change strategy according to the user status, predicted behavior data and abnormal behavior indicators, the following operations are performed: Combine and process the user status, predicted behavior data, and operation permissions to obtain a combined result; Calculating a first contribution value of the candidate change strategy based on the combination result and the behavior abnormality indicator, and calculating a second contribution value of the candidate change strategy based on the combination result; A change strategy is determined from the candidate change strategies according to the first contribution value, the second contribution value, and the third contribution value of the candidate change strategies.

[0066] The first contribution value may include the contribution value of the candidate change strategy in the security dimension, and the second contribution value may include the contribution value of the candidate change strategy in the convenience dimension; the operation authority may be the current operation authority of the user on the third-party platform; the combination result may include the combined data obtained by combining the user status, the predicted behavior data and the behavior abnormality indicator, for example, the combination result may be , r represents the operation permission, Represents the user status, Represents predicted behavior data. The candidate change strategy may be a candidate strategy for increasing or decreasing the operation authority.

[0067] Specifically, the above-mentioned process of calculating the first contribution value of the candidate change strategy based on the combination result and the behavior abnormality index, and calculating the second contribution value of the candidate change strategy based on the combination result can be replaced by inputting the combination result, the behavior abnormality index and the candidate abnormality index into the contribution value algorithm to calculate the contribution value, so as to obtain the first contribution value and the second contribution value of the candidate change strategy; the second contribution value can also be obtained by experts making multi-objective decisions during the process of initializing the user's operating rights on the third-party platform, that is, the second contribution value can be generated in advance.

[0068] For example, the contribution value algorithm includes:

[0069] in, Represents the first contribution value of the candidate change strategy, that is, the contribution value of the candidate change strategy in the security dimension; Represents the second contribution value of the candidate change strategy, that is, the contribution value of the candidate change strategy in the convenience dimension; Both can represent weight values.

[0070] In the process of determining the change strategy among the candidate change strategies based on the first contribution value, the second contribution value and the third contribution value of the candidate change strategies, the first contribution value, the second contribution value, the third contribution value of the candidate change strategy and the candidate change strategy can be input into a probability prediction algorithm to perform probability prediction of the candidate change strategies, obtain the predicted probability of the candidate change strategies, and determine the change strategy among the candidate change strategies based on the predicted probability; the predicted probability can include the probability of selecting the candidate change strategy; specifically, the change strategy with the largest predicted probability can be selected among the candidate change strategies.

[0071] For example, probabilistic prediction algorithms include:

[0072] in, A third contribution value representing the candidate change strategy, where the third contribution value may specifically be a long-term contribution value, that is, a long-term benefit; represents candidate change strategies; Represents the combined result; Represents the set of all candidate change strategies; represents the exploration temperature, which can be used to control the trade-off between exploration and exploitation; Represents the policy function, using the Boltzmann exploration method.

[0073] The third contribution value of the candidate change strategy may be obtained by performing contribution value calculation using a contribution value calculation algorithm.

[0074] For example, the contribution value calculation algorithm includes:

[0075] in, Represents the combined result Candidate Change Strategy Then transfer to the next combination result; Represents the next candidate change strategy corresponding to the next combination result; represents the learning rate; Represents the discount factor.

[0076] In actual application scenarios, user status, predicted behavior data, and operation permissions may belong to data of different dimensions. If the user status, predicted behavior data, and operation permissions are directly combined, there may be combination barriers. In view of this, in order to improve the convenience and flexibility of combining user status, predicted behavior data, and operation permissions, and to improve the combination success rate; in the above process of combining the user status, predicted behavior data, and operation permissions to obtain the combination result, the following operations can be performed: Convert user status into binary vectors, convert predicted behavior data into probability vectors, and convert operation permissions into binary vectors; The binary vector, the probability vector and the binary vector are combined to obtain a combined result.

[0077] The binary vector can be a one-hot vector. For example, the user state is converted into a one-hot vector. , among which Represents a user state set and converts the predicted behavior data into a probability vector , Represents predictive behavior data , convert the operation permissions into a binary vector , Represents a set of operation permissions.

[0078] It should be added that, in the process of generating the change strategy for changing the operation permissions based on the operation behavior data, the user status can be identified based on the operation behavior data to obtain the user status, the user behavior can be predicted based on the operation behavior data to obtain the predicted behavior data, and / or the user's abnormal behavior indicators can be calculated based on the operation behavior data; and the change strategy can be generated based on the user status, the predicted behavior data and / or the abnormal behavior indicators.

[0079] During the specific implementation process, after the change strategy for changing the operation authority based on the operation behavior data is generated, the change strategy can be sent to the blockchain to detect changes to the change strategy. Specifically, the blockchain can call the smart contract to change the change strategy and return the change detection result of the change strategy. Specifically, the blockchain can return the change detection result of the change strategy to the authority management platform.

[0080] Specifically, in the above-mentioned process of change detection on the change strategy, the blockchain can determine that the change detection result is passed when the change strategy is inconsistent with the user's previous change strategy, and determine that the change detection result is failed when the change strategy is consistent with the previous change strategy. In addition, when the change strategy is inconsistent with the user's previous change strategy and the trusted detection of the change strategy is passed, the change detection result can be determined as passed, and when the change strategy is consistent with the previous change strategy or the trusted detection of the change strategy is failed, the change detection result can be determined as failed.

[0081] Step S106: If the returned change detection result of the change policy is detection passed, the permission change parameters corresponding to the change policy are determined according to the user's operating environment data and the change policy.

[0082] If the change detection result of the returned change strategy is failure to pass the detection, no processing is required.

[0083] In this embodiment, the user's operating environment data may include the environment data of the user's operations on the third-party platform. For example, the user's operating environment data may include the platform identifier of the third-party platform, the security level requirements of the third-party platform, the user's operating time on the third-party platform and / or the user's operating device data. In addition, the user's operating environment data may also include other types of data, such as the user's operating system data.

[0084] The permission change parameter corresponding to the change strategy may be the permission parameter of the change operation permission corresponding to the change strategy, and the change operation permission may be the operation permission for making changes; optionally, the permission parameter includes the permission identifier, permission level, effective time, expiration time, issuer public key and / or expiration condition of the change operation permission; for example, if the change strategy is a strategy for adding the modification permission of modifying data in database a, then the change operation permission corresponding to the change strategy is the modification permission of modifying data in database a, and the permission parameter of the change permission may be the permission identifier, permission level, effective time, expiration time, issuer public key and / or expiration condition of the modification permission.

[0085] In actual applications, the user's operating environment data may affect the user's need for the change operation authority corresponding to the change policy, and the user's abnormal behavior index may also affect the user's need for the change operation authority. At the same time, in order to improve the security and flexibility of user authority changes, the user's authority can be dynamically changed according to the user's operating environment data and the change policy, that is, the authority change parameters can be determined; in an optional implementation manner provided by this embodiment, in the process of determining the authority change parameters corresponding to the change policy according to the user's operating environment data and the change policy, the following operations are performed: Calculate the behavior risk characteristics based on the user's behavior abnormality indicators, and sort the change operation permissions corresponding to the change strategy according to the environment characteristics, behavior risk characteristics and change strategy of the operation environment data; The change time of the sorted change operation permissions is calculated, and the sorting rank and change time of the sorted change operation permissions are used as permission change parameters.

[0086] Among them, the behavioral risk feature may include a feature vector used to characterize the user's behavioral risk level, which may specifically be a behavioral risk vector; the environmental feature of the operating environment data may specifically be an environmental feature tensor of the operating environment data; the change time may include an effective time and / or an expiration time.

[0087] On this basis, in order to improve the convenience of calculating the behavior risk characteristics, a pre-generated preset risk vector can be introduced, and the behavior risk characteristics can be calculated through multiple preset risk vectors; in an optional implementation provided by this embodiment, in the process of calculating the behavior risk characteristics based on the user's behavior abnormality index, the following operations are performed: assigning a mapping coefficient to each of a plurality of preset risk vectors; Based on each preset risk vector, mapping coefficient and behavioral anomaly indicator, the behavioral risk characteristics are calculated.

[0088] The multiple preset risk vectors may be preset risk vectors under multiple risk dimensions, the multiple preset risk vectors may be normalized multiple risk vectors, the multiple preset risk vectors may be manually designed based on domain knowledge, or may be automatically extracted from historical data through unsupervised learning methods such as clustering, and each preset risk vector in the multiple preset risk vectors may correspond to its own risk dimension or risk type. For example, the multiple preset risk vectors are , where M represents the dimension of the preset risk vector, represents the i-th preset risk vector among multiple preset risk vectors, and D represents the number of multiple preset risk vectors; the mapping coefficient represents the mapping coefficient corresponding to each preset risk vector, and the mapping coefficient can specifically be the projection coefficient of the behavior anomaly indicator under the risk dimension corresponding to each preset risk vector, that is, each preset risk vector can have its own mapping coefficient, that is, the mapping coefficient corresponding to each preset risk vector.

[0089] Specifically, in the process of calculating the behavioral risk characteristics based on each preset risk vector, mapping coefficient and behavioral abnormality index, the product of each preset risk vector and the mapping coefficient corresponding to each preset risk vector can be calculated, the sum of each product can be calculated, and the sum and the product of the behavioral abnormality index can be calculated as the behavioral risk characteristic; each preset risk vector, the mapping coefficient corresponding to each preset risk vector and the behavioral abnormality index can also be input into the risk characteristic algorithm to calculate the behavioral risk characteristic to obtain the behavioral risk characteristic.

[0090] For example, risk signature algorithms include:

[0091] in, represents behavioral risk characteristics; Represents an indicator of abnormal behavior; Represents the mapping coefficient of the i-th preset risk vector; Represents the i-th preset risk vector.

[0092] In the above process of allocating mapping coefficients to each preset risk vector in the plurality of preset risk vectors, the present embodiment may allocate mapping coefficients to each preset risk vector in the plurality of preset risk vectors by any one of the three methods of uniform mapping, soft mapping or hard mapping, so as to improve the flexibility and effectiveness of allocating mapping coefficients. In an optional implementation manner provided by the present embodiment, in the process of allocating mapping coefficients to each preset risk vector in the plurality of preset risk vectors, the following operations are performed: Calculating a mapping coefficient according to the number of a plurality of preset risk vectors and a preset mapping ratio; or, Calculating the similarity between each preset risk vector and the operation behavior characteristics of the operation behavior data, and calculating the mapping coefficient of each preset risk vector based on the similarity; or, A target risk vector is determined from each preset risk vector based on the similarity, and a preset mapping ratio is used as a mapping coefficient of the target risk vector.

[0093] The preset mapping ratio may be a preset mapping ratio, for example, the preset mapping ratio is 1. The similarity may be a cosine similarity. Optionally, the similarity has a positive correlation with the mapping coefficient, that is, the higher the similarity, the higher the mapping coefficient of the preset risk vector may be.

[0094] Specifically, in the process of calculating the mapping coefficient according to the number of multiple preset risk vectors and the preset mapping ratio, the ratio of the preset mapping ratio to the multiple preset risk vectors can be calculated as the mapping coefficient corresponding to each preset risk vector; on the basis of using the preset mapping ratio as the mapping coefficient of the target risk vector, the preset mapping coefficient can be used as the mapping coefficient of the residual risk vector; wherein the preset mapping coefficient can be 0, and the residual risk vector can be the residual risk vector other than the target risk vector in the multiple preset risk vectors. In the process of determining the target risk vector from each preset risk vector based on similarity, the target risk vector with the greatest similarity can be determined from each preset risk vector.

[0095] In addition, in the process of assigning mapping coefficients to each preset risk vector among multiple preset risk vectors, the number of multiple preset risk vectors can be input into the first mapping algorithm for mapping coefficient calculation to obtain the mapping coefficient of each preset risk vector; the operation behavior characteristics of the operation behavior data and each preset risk vector can be input into the second mapping algorithm for mapping coefficient calculation to obtain the mapping coefficient of each preset risk vector; the operation behavior characteristics of the operation behavior data and each preset risk vector can also be input into the third mapping algorithm for mapping coefficient calculation to obtain the mapping coefficient of each preset risk vector.

[0096] For example, the first mapping algorithm includes:

[0097] The second mapping algorithm includes:

[0098] in, represents the mapping intensity; Operation behavior characteristics representing operation behavior data; represents the i-th preset risk vector; represents the jth preset risk vector; The third mapping algorithm includes:

[0099] The environmental characteristics of the operating environment data mentioned above can be obtained in the following ways: Decomposing and processing the preset environment features including the plurality of operation environment data to obtain a decomposition result; Key environmental features are extracted from the decomposition results, and environmental features of the operating environment data are extracted from the key environmental features.

[0100] The preset environment feature containing multiple operating environment data may be a high-order environment tensor, for example, the preset environment feature is , among which Represents the number of entities in dimensions such as environment type, security level, operation time, and operation equipment. Each element in Represents the environmental features of each operating environment data in the multiple operating environment data; the decomposition process here is such as Tucker decomposition (tensor decomposition). The decomposition result may include a low-dimensional tensor, or may include a low-dimensional tensor and multiple factor matrices. The key environmental features may be a low-dimensional tensor.

[0101] Specifically, a preset environmental feature containing a plurality of operating environment data may be subjected to tensor decomposition to obtain a low-dimensional tensor and a plurality of factor matrices, and the environmental feature of the operating environment data may be extracted from the low-dimensional tensor.

[0102] For example, a low-rank approximation of the preset environment tensor containing multiple operating environment data is performed through Tucker decomposition:

[0103] in, Represents a low-dimensional tensor; represents the factor matrix; Represents the preset environment tensor The dimensions are multiplied by the factor matrix; Convert the preset environment tensor into a low-dimensional tensor through Tucker decomposition and multiple factor matrices , and then from the low-dimensional tensor Extract the environment tensor of the operating environment data ; That is, the environmental characteristics of the current operating environment data.

[0104] In actual applications, there may be multiple change operation permissions corresponding to the change strategy, and the urgency of the user's demand for each change operation permission may be different. Therefore, in order to improve the diversified needs of users for change operation permissions; in the process of sorting the change operation permissions corresponding to the change strategy according to the environmental characteristics, behavioral risk characteristics and change strategy of the operating environment data, the evaluation score of the change operation permission can be calculated according to the change strategy, environmental characteristics and behavioral risk characteristics, and the change operation permissions are sorted based on the evaluation score to obtain the sorted change operation permissions. Specifically, the following operations can be performed: Calculate the weight values ​​of change strategies, environmental characteristics, and behavioral risk characteristics respectively; Calculate the evaluation score of the change operation authority based on the change strategy, environmental characteristics, behavioral risk characteristics and their corresponding weight values; The change operation permissions are sorted based on the evaluation scores to obtain sorted change operation permissions.

[0105] Specifically, in the process of respectively calculating the weight values ​​of change strategy, environmental characteristics and behavioral risk characteristics, the change strategy, environmental characteristics and behavioral risk characteristics can be input into multiple attention layers in the attention algorithm to obtain multiple attention weights of the change strategy, environmental characteristics and behavioral risk characteristics output by the multiple attention layers, and then based on the multiple attention weights of the change strategy, environmental characteristics and behavioral risk characteristics, the weight values ​​of the change strategy, environmental characteristics and behavioral risk characteristics are calculated; specifically, in the process of calculating the weight values ​​of the change strategy, environmental characteristics and behavioral risk characteristics based on the multiple attention weights of the change strategy, environmental characteristics and behavioral risk characteristics, the multiple attention weights of the change strategy, environmental characteristics and behavioral risk characteristics can be converted to obtain multiple conversion weights of the change strategy, environmental characteristics and behavioral risk characteristics, and the weight values ​​of the change strategy, environmental characteristics and behavioral risk characteristics are calculated based on the multiple conversion weights.

[0106] For example, attention algorithms include:

[0107] in, Embedding vector representing the change strategy; Representative Layer attention parameters; Representative for , respectively represent the change strategy ( )、Environmental characteristics( ) and behavioral risk characteristics ( )’s feature representation vector; Representative In the attention layer, it is used to calculate the factors The parameter vector of attention weights; Representative In the attention layer, it is used to calculate the factors The bias term of the attention weight, Represents the transpose operation of a vector or matrix; Indicates In the attention layer, it is used to calculate the policy action Bias term for importance weights. Representative In the attention layer, it is used to calculate the change strategy The transpose of the parameter vector of weight values; similarly, the other , , , Representative environmental characteristics , behavioral risk characteristics The corresponding parameters.

[0108] It should be noted that the above-mentioned multiple attention weights of the change strategy, multiple attention weights of the environmental characteristics and multiple attention weights of the behavioral risk characteristics can be output from the multiple attention layers of the attention algorithm.

[0109] For another example, the following method is used to convert the multiple attention weights of the change strategy, environmental characteristics and behavioral risk characteristics to obtain the multiple conversion weights of the change strategy, environmental characteristics and behavioral risk characteristics:

[0110] Where T represents the pre-generated transformation matrix, ; In this way, the attention weights output by each attention layer are aggregated to improve the effectiveness of multiple conversion weights.

[0111] In the process of calculating the weight values ​​of the change strategy, environmental characteristics and behavioral risk characteristics based on multiple conversion weights, the multiple conversion weights of the change strategy, the multiple conversion weights of the environmental characteristics, the multiple conversion weights of the behavioral risk characteristics and the number of attention layers in the attention algorithm can be input into the weight value calculation algorithm for weight value calculation to obtain the weight values ​​of the change strategy, environmental characteristics and behavioral risk characteristics.

[0112] For example, the weight value calculation algorithm includes:

[0113] Where N represents the number of attention layers; Multiple transition weights representing the change strategy; multiple transformation weights representing environmental characteristics; multiple transition weights representing behavioral risk characteristics; Represents the weight value of the change strategy; The weight value representing the environmental characteristics; Represents the weight value of the behavioral risk feature.

[0114] In the above process of calculating the evaluation score of the change operation authority based on the change strategy, environmental characteristics and behavioral risk characteristics and the corresponding weight values ​​of the three, the change strategy, environmental characteristics and behavioral risk characteristics and the corresponding weight values ​​of the three can be input into the evaluation algorithm for authority evaluation processing to obtain the evaluation score of the change operation authority.

[0115] For example, evaluation algorithms include:

[0116] in, Represents the change of operation permissions The feature vectors of change strategy, environmental characteristics and behavioral risk characteristics; Represents the weight parameter corresponding to the change strategy; Represents the weight parameter corresponding to the environmental characteristics; Represents the weight parameter corresponding to the behavioral risk characteristics; represents the Sigmoid activation function; L represents the number of change operation permissions; Represents the evaluation score of the i-th change operation permission; After sorting the change operation permissions based on the evaluation scores, the sorted change operation permissions are obtained as follows: .

[0117] In the above process of calculating the change time of the sorted change operation authority, the sorted change operation authority may be input into a time algorithm to calculate the change time, so as to obtain the change time of the sorted change operation authority.

[0118] For example, time algorithms include:

[0119] in, represents the failure intensity function of the i-th change operation authority at time t; represents the basic failure rate; Representative Change operation permissions for The impact coefficient of changing the operation authority; It is the time decay kernel function, which characterizes the duration of the impact between changing operation permissions.

[0120] It should be supplemented that the above step S106 can be replaced by determining the permission change parameters corresponding to the change strategy according to the user's operating environment data and the change strategy.

[0121] Step S108: Send the permission change parameters to the blockchain to perform permission change processing on the operation permissions.

[0122] After determining the permission change parameters corresponding to the change strategy based on the user's operating environment data and change strategy, the permission change parameters can be sent to the blockchain to perform permission change processing of the operating permissions based on the permission change parameters, specifically by calling the smart contract to perform permission change processing of the operating permissions based on the permission change parameters. In specific implementation, the permission change parameters can be encapsulated as a permission change parameter sequence, and the blockchain standard Protobuf protocol can be used to encapsulate the permission change parameters as a permission change parameter sequence.

[0123] For example, the change operation permission corresponding to the change strategy is the modification permission of modifying the data in database a, and the permission change parameters are the permission identifier, permission level, effective time, expiration time, issuer public key and / or expiration condition of the modification permission. Then, the modification permission of modifying the data in database a is added to the user's current operation permission, and the permission change parameters can be associated with the modification weight.

[0124] It should be added that after the blockchain has processed the permission change of the operating permissions, it can write the permission change log into the block, and after the blockchain calls the smart contract and detects that the expiration time of the change operating permissions has expired, the user's change operating permissions will be closed. After detecting abnormal operation behavior of the user based on the change operating permissions on a third-party platform, the user's change operating permissions can also be closed or an early warning can be issued.

[0125] The rights management platform in this embodiment can regularly analyze the relevant data of the third-party platform stored on the blockchain, evaluate the effects of the algorithms involved, and continuously iterate and optimize the algorithms.

[0126] In addition, steps S102 to S108 of this embodiment can also be replaced by: calling a smart contract to perform the following operations: obtaining the operation behavior data obtained by the user based on the operation authority on the third-party platform, generating a change strategy for changing the operation authority based on the operation behavior data, and performing change detection on the change strategy. If the change detection passes, the permission change parameters corresponding to the change strategy are determined according to the user's operation environment data and the change strategy, and the permission change processing of the operation authority is performed based on the permission change parameters; the specific execution process is similar to the above and will not be repeated here; the blockchain in this embodiment can be replaced by a blockchain system.

[0127] It should be supplemented that each optional implementation method or each feasible execution method in steps S102 to S108 provided in this embodiment can be executed independently as needed, or can be combined and referenced with each other. At the same time, each specific execution step in each optional implementation method or each feasible execution method can also be executed independently.

[0128] In summary, the permission processing method provided in this embodiment first obtains the operation behavior data obtained by the user on the third-party platform based on the operation permission, identifies the user's state according to the operation behavior characteristics of the operation behavior data, obtains the user state, and predicts the user's behavior based on the operation behavior characteristics to obtain the predicted behavior data, calculates the user's behavior abnormality index based on the operation behavior characteristics, and generates a change strategy for changing the operation permission according to the user state, the predicted behavior data and the behavior abnormality index, and sends the change strategy to the blockchain to perform change detection on the change strategy, thereby combining the three different aspects of user state, predicted behavior data and behavior abnormality index to generate a change strategy, thereby improving the comprehensiveness and effectiveness of the change strategy; Secondly, if the change detection result of the returned change strategy is passed, the behavioral risk characteristics are calculated based on the user's abnormal behavior indicators, and the change operation permissions corresponding to the change strategy are sorted according to the environmental characteristics, behavioral risk characteristics and change strategies of the operating environment data. The change time of the sorted change operation permissions is calculated, and the sorting position and change time of the sorted change operation permissions are used as permission change parameters. The permission change parameters are sent to the blockchain for permission change processing of the operation permissions. In this way, the change operation permissions are dynamically adjusted in sequence through the three dimensions of environmental characteristics, behavioral risk characteristics and change strategies, so that the sorted change operation permissions are more in line with the user's urgency for changing the operation permissions, and meet the user's diverse needs. At the same time, the change operation permissions are dynamically regulated and constrained through the change time, thereby improving the flexibility and security of permission changes to users.

[0129] The implementation process of one permission processing provided above can be executed by a permission management platform, and the implementation process of another permission processing method provided in the following method embodiment can be executed by a blockchain or a blockchain system. The two can cooperate with each other during the execution process. Therefore, when reading the above implementation process, you can refer to the corresponding content of the following another permission processing method embodiment. Correspondingly, when reading the following another permission processing method embodiment, you can also refer to the corresponding content of the above method embodiment.

[0130] The following combination Figure 2 , taking the application of the permission processing method provided in this embodiment in the permission change scenario as an example, the permission processing method provided in this embodiment is further explained. Figure 2 ,The permission processing method applied to the permission change scenario specifically includes the following steps.

[0131] Step S202: obtaining a sequence of operation behaviors obtained by the user performing operations on the third-party platform based on the operation authority.

[0132] Step S204: identifying the state of the user according to the operation behavior feature sequence of the operation behavior sequence to obtain a user state sequence, and predicting the user behavior based on the operation behavior feature sequence to obtain a predicted behavior sequence.

[0133] Step S206, calculating the user's abnormal behavior index based on the operation behavior feature sequence, and generating a change strategy for changing the operation authority according to the user state sequence, the predicted behavior sequence and the abnormal behavior index.

[0134] Step S208: Send the change strategy to the blockchain to perform change detection on the change strategy.

[0135] Step S210, if the change detection result of the change strategy is detection passed, the behavior risk characteristics are calculated based on the user's behavior abnormality indicators, and the change operation permissions corresponding to the change strategy are sorted according to the environment characteristics, behavior risk characteristics and change strategy of the user's operating environment data.

[0136] Step S212, calculate the change time of the sorted change operation authority, and send the authority change parameter including the change time of the sorted change operation authority and the sorting position to the blockchain to perform authority change processing of the operation authority.

[0137] The specific blockchain can call the smart contract to change the operation permissions according to the permission change parameters.

[0138] It should be noted that any one of steps S202 to S212 or any combination of multiple steps can be replaced by the corresponding technical means provided in the above steps S102 to S108 according to the needs of implementation and deployment, and will not be described one by one here.

[0139] Another permission processing method embodiment provided in this specification is as follows: This embodiment may be executed by a computer device, which may be a terminal or a server.

[0140] Reference Figure 3 The permission processing method provided in this embodiment can be applied to a blockchain or a blockchain system. The blockchain can be deployed on a computer device, and specifically includes the following steps S302 to S306.

[0141] Step S302: receiving a change policy for changing the user's operating permissions on a third-party platform.

[0142] It can receive the change strategy sent by the permission management platform to change the user's operating permissions on the third-party platform.

[0143] Step S304, calling the smart contract to perform change detection on the change strategy and return the change detection result.

[0144] Step S306, receiving the permission change parameters corresponding to the change strategy, and calling the smart contract to perform permission change processing on the operation permission according to the permission change parameters.

[0145] When the change detection result is passed, the permission change parameters corresponding to the change strategy can be received, and the smart contract can be called to change the operation permissions according to the permission change parameters; the permission change parameters corresponding to the change strategy sent by the permission management platform can be received, and the smart contract can be called to change the operation permissions according to the permission change parameters.

[0146] For other specific implementation processes in step S302 to step S306 provided in this embodiment, reference may be made to the above-mentioned embodiment of the permission processing method applied to the permission management platform, and this embodiment will not be repeated here.

[0147] Figure 4 A schematic diagram of a permission processing device provided by an embodiment of the present invention is shown in FIG. Figure 4 As shown, the device comprises: The data acquisition module 402 is used to acquire the operation behavior data obtained by the user through operations based on the operation authority on the third-party platform; A policy generation module 404 is used to generate a change policy for changing the operation permission based on the operation behavior data, and send the change policy to the blockchain; The parameter determination module 406 is used to determine the permission change parameters corresponding to the change policy according to the user's operating environment data and the change policy if the change detection result of the change policy returned is detection passed; The parameter sending module 408 is used to send the permission change parameter to the blockchain to perform permission change processing on the operation permission.

[0148] The permission processing device provided in this embodiment first obtains the operation behavior data obtained by the user performing operations based on the operation authority on the third-party platform by running the data acquisition module 402, and runs the strategy generation module 404 to generate a change strategy for changing the operation authority based on the operation behavior data, and sends the change strategy to the blockchain, and then runs the parameter determination module 406. If the change detection result of the change strategy returned is a detection pass, the permission change parameters corresponding to the change strategy are determined according to the user's operating environment data and the change strategy, and finally runs the parameter sending module 408 to send the permission change parameters to the blockchain to perform permission change processing of the operation authority, so as to improve the flexibility of permission change.

[0149] A permission processing device provided in an embodiment of this specification can implement each process in the method embodiment of the aforementioned permission processing method and achieve the same functions and effects, which will not be repeated here.

[0150] Figure 5 A schematic diagram of another permission processing device provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the device comprises: A policy receiving module 502 is used to receive a change policy for changing the user's operating permissions on a third-party platform; A change detection module 504 is used to call the smart contract to perform change detection on the change strategy and return the change detection result; The permission change module 506 is used to receive the permission change parameters corresponding to the change strategy, and call the smart contract to perform permission change processing on the operation permission according to the permission change parameters.

[0151] The permission processing device provided in this embodiment first receives a change policy for changing the user's operating permissions on a third-party platform by running the policy receiving module 502, runs the change detection module 504, calls the smart contract to perform change detection on the change policy, and returns the change detection result, then receives the permission change parameters corresponding to the change policy by running the permission change module 506, and calls the smart contract to perform permission change processing on the operating permissions according to the permission change parameters to improve the security of permission changes.

[0152] Another permission processing device provided in an embodiment of this specification can implement each process in the method embodiment of the aforementioned another permission processing method and achieve the same functions and effects, which will not be repeated here.

[0153] Furthermore, an embodiment of the present specification also provides a permission processing device, Figure 6 A schematic diagram of a permission processing device provided in an embodiment of this specification is shown in FIG. Figure 6 As shown, the device includes: a memory 601, a processor 602, a bus 603 and a communication interface 604. The memory 601, the processor 602 and the communication interface 604 communicate through the bus 603, and the communication interface 604 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0154] Figure 6 In the embodiment, the memory 601 stores computer executable instructions that can be run on the processor 602. When the computer executable instructions are executed by the processor 602, the following process is implemented: Obtaining the operation behavior data obtained by users through operations based on their operation permissions on third-party platforms; Based on the operation behavior data, a change strategy for changing the operation authority is generated, and the change strategy is sent to the blockchain; If the change detection result of the change policy returned is detection passed, determining the permission change parameters corresponding to the change policy according to the user's operating environment data and the change policy; The permission change parameters are sent to the blockchain to perform permission change processing on the operation permission.

[0155] The permission processing device provided in this embodiment, through the cooperation of the memory 601, the processor 602, the bus 603 and the communication interface 604, generates a change strategy for changing the operation permission based on the operation behavior data obtained by the user on the third-party platform based on the operation permission, and sends the change strategy to the blockchain. If the change detection result of the returned change strategy is that the detection is passed, the permission change parameters corresponding to the change strategy are determined according to the user's operating environment data and the change strategy, and the permission change parameters are sent to the blockchain permission change processing to improve the flexibility of permission change.

[0156] A permission processing device provided in an embodiment of this specification can implement each process in the method embodiment of the aforementioned permission processing method and achieve the same functions and effects, which will not be repeated here.

[0157] Furthermore, an embodiment of this specification also provides another permission processing device, Figure 7 A schematic diagram of a permission processing device provided in an embodiment of this specification is shown in FIG. Figure 7 As shown, the device includes: a memory 701, a processor 702, a bus 703 and a communication interface 704. The memory 701, the processor 702 and the communication interface 704 communicate through the bus 703, and the communication interface 704 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0158] Figure 7 In the embodiment, the memory 701 stores computer executable instructions that can be run on the processor 702, and when the computer executable instructions are executed by the processor 702, the following process is implemented: Receive change strategies for changing the user's operating permissions on third-party platforms; Call the smart contract to perform change detection on the change strategy and return the change detection result; Receive the permission change parameters corresponding to the change strategy, and call the smart contract to perform permission change processing on the operation permission according to the permission change parameters.

[0159] The permission processing device provided in this embodiment, through the cooperation of the memory 701, the processor 702, the bus 703 and the communication interface 704, calls the smart contract to perform change detection on the change strategy, and returns the change detection result, receives the permission change parameters corresponding to the change strategy, and calls the smart contract to perform permission change processing on the operation permission according to the permission change parameters to improve the security of permission changes.

[0160] Another permission processing device provided in an embodiment of this specification can implement each process in the method embodiment of the aforementioned another permission processing method and achieve the same functions and effects, which will not be repeated here.

[0161] Furthermore, an embodiment of the present specification also provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Obtaining the operation behavior data obtained by users through operations based on their operation permissions on third-party platforms; Based on the operation behavior data, a change strategy for changing the operation authority is generated, and the change strategy is sent to the blockchain; If the change detection result of the change policy returned is detection passed, determining the permission change parameters corresponding to the change policy according to the user's operating environment data and the change policy; The permission change parameters are sent to the blockchain to perform permission change processing on the operation permission.

[0162] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0163] A computer-readable storage medium provided in an embodiment of this specification can implement each process in the method embodiment of the aforementioned permission processing method and achieve the same functions and effects, which will not be repeated here.

[0164] Furthermore, an embodiment of the present specification also provides another computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Receive change strategies for changing the user's operating permissions on third-party platforms; Call the smart contract to perform change detection on the change strategy and return the change detection result; Receive the permission change parameters corresponding to the change strategy, and call the smart contract to perform permission change processing on the operation permission according to the permission change parameters.

[0165] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0166] Another computer-readable storage medium provided in an embodiment of this specification can implement each process in the method embodiment of the aforementioned another permission processing method and achieve the same functions and effects, which will not be repeated here.

[0167] Furthermore, an embodiment of the present specification also provides a computer program product, which implements the following process when executed by a processor: Obtaining the operation behavior data obtained by users through operations based on their operation permissions on third-party platforms; Based on the operation behavior data, a change strategy for changing the operation authority is generated, and the change strategy is sent to the blockchain; If the change detection result of the change policy returned is detection passed, determining the permission change parameters corresponding to the change policy according to the user's operating environment data and the change policy; The permission change parameters are sent to the blockchain to perform permission change processing on the operation permission.

[0168] A computer program product provided in an embodiment of this specification can implement each process in the method embodiment of the aforementioned permission processing method and achieve the same functions and effects, which will not be repeated here.

[0169] Furthermore, an embodiment of the present specification also provides another computer program product, which implements the following process when executed by a processor: Receive change strategies for changing the user's operating permissions on third-party platforms; Call the smart contract to perform change detection on the change strategy and return the change detection result; Receive the permission change parameters corresponding to the change strategy, and call the smart contract to perform permission change processing on the operation permission according to the permission change parameters.

[0170] Another computer program product provided in one embodiment of this specification can implement each process in the method embodiment of the aforementioned another permission processing method and achieve the same functions and effects, which will not be repeated here.

[0171] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0172] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0173] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0174] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0175] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory. The memory may include non-permanent storage in a computer-readable storage medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable storage medium.

[0176] Computer-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable storage media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0177] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0178] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0179] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A permission processing method, characterized in that: The method comprises: Obtaining the operation behavior data obtained by users through operations based on their operation permissions on third-party platforms; Based on the operation behavior data, a change strategy for changing the operation authority is generated, and the change strategy is sent to the blockchain; If the change detection result of the change policy returned is detection passed, determining the permission change parameters corresponding to the change policy according to the user's operating environment data and the change policy; The permission change parameters are sent to the blockchain to perform permission change processing on the operation permission.

2. The permission processing method according to claim 1, characterized in that: The generating a change strategy for changing the operation authority based on the operation behavior data includes: Identifying the state of the user according to the operation behavior characteristics of the operation behavior data to obtain the user state, and predicting the user behavior based on the operation behavior characteristics to obtain predicted behavior data; The abnormal behavior index of the user is calculated based on the operational behavior characteristics, and the change strategy is generated according to the user status, the predicted behavior data and the abnormal behavior index.

3. The permission processing method according to claim 2, characterized in that: The operation behavior characteristics are obtained in the following manner: Performing embedding processing on the operation behavior data to obtain a behavior embedding vector, and performing position encoding processing on the operation behavior data to obtain a position vector; Attention calculation is performed based on the behavior embedding vector and the position vector to obtain the operation behavior feature.

4. The permission processing method according to claim 2, characterized in that: The step of identifying the state of the user according to the operation behavior characteristics of the operation behavior data to obtain the user state includes: Constructing a behavior characteristic graph based on the operation behavior characteristics; According to the node feature matrix, adjacency matrix and degree matrix of the behavior feature graph, global features are calculated, and the global features are normalized to obtain the user status of the user.

5. The permission processing method according to claim 2, characterized in that: The calculating the abnormal behavior index of the user based on the operation behavior feature includes: Calculating a posterior distribution based on the operational behavior characteristics, and converting latent variables in the posterior distribution into intermediate operational behavior characteristics; An average log likelihood is calculated based on the posterior distribution and the intermediate operation behavior feature, and the behavior abnormality indicator is calculated based on the average log likelihood, the posterior distribution and the prior distribution.

6. The permission processing method according to claim 2, characterized in that: The step of generating the change strategy according to the user status, the predicted behavior data and the abnormal behavior indicator includes: Combining the user status, the predicted behavior data, and the operation authority to obtain a combination result; Calculating a first contribution value of a candidate change strategy based on the combination result and the abnormal behavior indicator, and calculating a second contribution value of the candidate change strategy based on the combination result; The change strategy is determined from among the candidate change strategies according to the first contribution value, the second contribution value, and third contribution values ​​of the candidate change strategies.

7. The permission processing method according to claim 1, characterized in that: The step of determining the permission change parameter corresponding to the change strategy according to the user's operating environment data and the change strategy includes: Calculating a behavior risk feature based on the user's behavior abnormality index, and sorting the change operation permissions corresponding to the change strategy according to the environment features of the operation environment data, the behavior risk feature and the change strategy; The change time of the sorted change operation authority is calculated, and the sorting rank and change time of the sorted change operation authority are used as the authority change parameter.

8. The permission processing method according to claim 7, characterized in that: The calculating of the behavior risk characteristics based on the abnormal behavior index of the user includes: assigning a mapping coefficient to each of a plurality of preset risk vectors; The behavior risk feature is calculated based on the respective preset risk vectors, the mapping coefficients and the behavior abnormality indicators.

9. The permission processing method according to claim 8, characterized in that: The allocating a mapping coefficient to each of the plurality of preset risk vectors comprises: Calculating the mapping coefficient according to the number of the plurality of preset risk vectors and a preset mapping ratio; or, Calculating the similarity between each of the preset risk vectors and the operation behavior characteristics of the operation behavior data, and calculating the mapping coefficient of each of the preset risk vectors based on the similarity; or, A target risk vector is determined from the preset risk vectors based on the similarity, and a preset mapping ratio is used as a mapping coefficient of the target risk vector.

10. A permission processing method, characterized in that: The method comprises: Receive change strategies for changing the user's operating permissions on third-party platforms; Call the smart contract to perform change detection on the change strategy and return the change detection result; Receive the permission change parameters corresponding to the change strategy, and call the smart contract to perform permission change processing on the operation permission according to the permission change parameters.

Images