Dynamic authority management system and method based on identity association

Abstract

The invention provides a dynamic authority management system and method based on identity association, and relates to the technical field of authority management, and the system comprises the steps: carrying out the identity authentication of a user according to a preset identity authentication strategy, and determining the real identity of the user; managing system resources, allocating access required permissions to the system resources, setting access roles and allocating access permissions to the access roles; determining an access scene in which the user accesses the system resources, associating the real identity of the user with the access role according to a preset identity association strategy in the access scene, determining the access role to which the user belongs, and allocating an access permission; when it is monitored that the user accesses a new system resource, updating management is carried out on an access role to which the user belongs based on identity association, and dynamic management is carried out on the access permission; the dynamic management of the user permission is realized, and the security of system resources is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of authority management, and in particular to a dynamic authority management system based on identity association. Background Art

[0002] Traditional permission management mainly implements permission management through access control of roles. Permission allocation is pre-configured, and the permissions of the same user cannot be changed. Moreover, the amount of existing resources is increasing, and the number of users is also increasing. Traditional permission management cannot achieve effective management of user permissions, which leads to security issues in resources. In addition, the same user may correspond to multiple access roles, and different access roles are assigned different access permissions, and the user may have access to system resources with multiple different access permissions.

[0003] Therefore, the present invention provides a dynamic rights management system based on identity association. Summary of the invention

[0004] The present invention provides a dynamic permission management system and method based on identity association, which performs identity authentication on users according to preset identity authentication strategies to determine the real identities of users; manages system resources and allocates required access permissions to each system resource, sets access roles and allocates access permissions to access roles; determines access scenarios for users to access system resources, associates the real identities of users with access roles according to preset identity association strategies under access scenarios, determines the access roles to which users belong and allocates access permissions; when monitoring users to access new system resources, performs update management on the access roles to which users belong based on identity association and dynamically manages access permissions; implements dynamic management of user permissions and ensures the security of system resources.

[0005] The present invention provides a dynamic rights management system based on identity association, comprising: The identity authentication module is used to authenticate the user according to the preset identity authentication strategy and determine the user's true identity; The permission allocation module is used to manage system resources and allocate the required access permissions to each system resource, set access roles and allocate access permissions to access roles; The identity association module is used to determine the access scenario of the user to access system resources, associate the user's real identity with the access role according to the preset identity association strategy under the access scenario, determine the access role to which the user belongs and assign access rights; The dynamic permission module is used to update the access role of the user and dynamically manage the access rights based on identity association when a user is detected accessing new system resources.

[0006] According to the dynamic rights management system based on identity association provided by the present invention, the identity authentication module includes: An identity authentication strategy unit, used to obtain an identity authentication method, set rules for the identity authentication strategy, and determine a preset identity authentication strategy, wherein the identity authentication methods include: a username-password authentication method, a biometric authentication method, a one-time password authentication method, and a multi-mode authentication method; The identity authentication unit is used to authenticate the user according to the preset identity authentication strategy to determine the user's real identity.

[0007] According to the dynamic rights management system based on identity association provided by the present invention, the rights allocation module includes: A system resource management unit, used to obtain system resources and classify system resources according to their types, uses and attributes; assigning a unique identifier to the system resource according to the classification result; Manage system resources based on unique identifiers; A system resource permission allocation unit, used to set the permission type of the permission required for accessing the system resources, wherein the permission type of the permission required for accessing the system resources includes: a read permission type, a write permission type, a create permission type, an execute permission type, a delete permission type, and a modify permission type; Allocate required access permissions to each system resource according to the unique identifier and the permission type of the required access permission to the system resource; The access role unit is used to set access roles and assign access rights to access roles.

[0008] According to the dynamic permission management system based on identity association provided by the present invention, the access role unit includes: An access role setting block is used to set access roles, where the access roles include: administrator role, guest role, creator role, and internal user role; The access role relationship block is used to set the role relationship between access roles, where the role relationship includes: inclusion relationship, no relationship and partial association relationship; The Access Role Permission Assignment block is used to assign access rights based on access roles.

[0009] According to the dynamic rights management system based on identity association provided by the present invention, the identity association module includes: An access scenario unit, used to generate an initial access scenario when a user accesses system resources; Obtain the resource type that the user needs to access the system resources and limit the initial access scenario; Obtain the user's attempted execution operations on the system resources that the user needs to access, and perform secondary restrictions on the initial access scenario, where the attempted execution operations include: read operation, write operation, create operation, execute operation, delete operation, and modify operation; Extract user access related data and limit the initial access scenario three times, where the user access related data includes: user's current access time data, user's current access device data, user's current access location data and user's historical access behavior data; Determine the access scenario of the user to the system resources according to the primary restriction, the secondary restriction and the tertiary restriction; The identity association strategy unit is used to determine the preset identity association strategy under the access scenario according to the real identity of the user and the access scenario of the user accessing the system resources, wherein the preset identity association strategy includes: identity association determination strategy, identity association verification strategy and identity association allocation strategy; The identity association unit is used to associate the user's real identity with the access role according to the preset identity association strategy in the access scenario, determine the access role to which the user belongs and allocate access rights.

[0010] According to the dynamic rights management system based on identity association provided by the present invention, the identity association module further includes: An access permission detection unit is used to detect the user's access permission when the user accesses the system resources, determine the user's access role according to the user's real identity, and allow the user to access the system resources when the access permission corresponding to the user's access role is not less than the access permission required for the user to access the system resources; When the access rights corresponding to the access role to which the user belongs are lower than the access rights required for the user to access system resources, the user is prohibited from accessing system resources, the user's access behavior is recorded and stored, and the user is prompted that the access rights are insufficient.

[0011] According to the dynamic permission management system based on identity association provided by the present invention, the dynamic permission module includes: A new system resource determination unit is used to monitor user access behavior in real time when the user accesses system resources; Obtain the system resources that are allowed to be accessed under the access rights corresponding to the access role to which the user belongs, and mark them as old system resources; Obtain the system resources that are not allowed to be accessed under the access rights corresponding to the access role to which the user belongs, and mark them as new system resources; A dynamic management unit is used to continuously allocate access rights corresponding to the access role of the user when it is detected that the user accesses the old system resources; When a user is detected accessing new system resources, the user's access role is updated and managed based on the new system resources and identity association; The access rights are dynamically managed according to the role relationship between the access roles to which the user belongs after the update management and the access roles to which the user belongs before the update management.

[0012] The present invention provides a dynamic rights management method based on identity association, comprising: Step 1: According to the preset identity authentication strategy, authenticate the user and determine the user's true identity; Step 2: Manage system resources and assign required access permissions to each system resource, set access roles and assign access permissions to access roles; Step 3: Determine the access scenario for the user to access system resources, associate the user's real identity with the access role according to the preset identity association policy under the access scenario, determine the access role to which the user belongs and assign access rights; Step 4: When a user is detected accessing new system resources, the user's access role is updated and managed based on identity association, and access rights are dynamically managed.

[0013] Compared with the prior art, the beneficial effects of this application are as follows: By authenticating users according to preset identity authentication policies, the user's real identity is determined; system resources are managed and the required access permissions are assigned to each system resource, access roles are set and access permissions are assigned to access roles; the access scenarios for users to access system resources are determined, and the user's real identity is associated with the access role according to the preset identity association policy under the access scenario, the user's access role is determined and access permissions are assigned; when a user is monitored to access new system resources, the user's access role is updated based on identity association and access permissions are dynamically managed; dynamic management of user permissions is achieved to ensure the security of system resources.

[0014] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0015] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 It is a structural diagram of a dynamic rights management system based on identity association provided by an embodiment of the present invention; Figure 2 It is a flow chart of a dynamic permission management method based on identity association provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0018] Embodiment 1: The embodiment of the present invention provides a dynamic rights management system based on identity association, such as Figure 1 As shown, including: The identity authentication module is used to authenticate the user according to the preset identity authentication strategy and determine the user's true identity; The permission allocation module is used to manage system resources and allocate the required access permissions to each system resource, set access roles and allocate access permissions to access roles; The identity association module is used to determine the access scenario of the user to access system resources, associate the user's real identity with the access role according to the preset identity association strategy under the access scenario, determine the access role to which the user belongs and assign access rights; The dynamic permission module is used to update the access role of the user and dynamically manage the access rights based on identity association when a user is detected accessing new system resources.

[0019] In this embodiment, the preset identity authentication policy refers to a preset policy for implementing real identity authentication of a user.

[0020] In this embodiment, the real identity refers to the original identity of the user, that is, not the identity that has been disguised.

[0021] In this embodiment, the system resources refer to the resources in the dynamic rights management system.

[0022] In this embodiment, the required access authority refers to the authority required by the user when accessing system resources.

[0023] In this embodiment, the access role refers to a role used to simply represent a user.

[0024] In this embodiment, the access permission refers to the permission of a user to access system resources.

[0025] In this embodiment, the access scenario refers to a scenario used to accurately represent a user's access to system resources.

[0026] In this embodiment, the preset identity association policy refers to a preset policy for associating the real identity of the user with the access role.

[0027] In this embodiment, the access role to which the user belongs refers to the access role corresponding to the user determined by associating the real identity of the user with the access role according to a preset identity association policy in an access scenario.

[0028] In this embodiment, the new system resource refers to a system resource that is not allowed to be accessed under the access permission corresponding to the access role to which the user belongs, that is, a system resource that is inaccessible under the user's current access permission.

[0029] In this embodiment, identity association refers to an operation of associating the real identity of the user with the access role.

[0030] In this embodiment, update management refers to management of the access role to which the user belongs based on the new system resources and identity association when it is monitored that the user accesses new system resources.

[0031] In this embodiment, dynamic management refers to management of access rights that are changed accordingly to changes in system resources.

[0032] The working principle and beneficial effects of the above technical solution are: according to the preset identity authentication strategy, the user is authenticated to determine the user's real identity; the system resources are managed and the required access permissions are assigned to each system resource, the access role is set and the access permission is assigned to the access role; the access scenario for the user to access the system resources is determined, and the user's real identity is associated with the access role according to the preset identity association strategy under the access scenario, the access role to which the user belongs is determined and the access permission is assigned; when the user is monitored to access a new system resource, the access role to which the user belongs is updated based on the identity association and the access permission is dynamically managed; the dynamic management of user permissions is realized to ensure the security of system resources.

[0033] Embodiment 2: The embodiment of the present invention provides a dynamic rights management system based on identity association, an identity authentication module, including: An identity authentication strategy unit, used to obtain an identity authentication method, set rules for the identity authentication strategy, and determine a preset identity authentication strategy, wherein the identity authentication methods include: a username-password authentication method, a biometric authentication method, a one-time password authentication method, and a multi-mode authentication method; The identity authentication unit is used to authenticate the user according to the preset identity authentication strategy to determine the user's real identity.

[0034] In this embodiment, the identity authentication method refers to a method for authenticating the real identity of the user, such as a username-password authentication method, a biometric authentication method, a one-time password authentication method, and a multi-mode authentication method.

[0035] In this embodiment, the rules of the identity authentication policy refer to the rules used by the identity authentication policy to realize the true authentication of the user identity, such as the rules of using biometric authentication methods for identity authentication, such as the rules of combining multiple identity authentication methods for authentication of important system resources.

[0036] In this embodiment, the preset identity authentication policy refers to a preset policy for implementing real identity authentication of a user.

[0037] In this embodiment, the real identity refers to the original identity of the user, that is, not the identity that has been disguised.

[0038] The working principle and beneficial effects of the above technical solution are: by authenticating the user according to the preset identity authentication strategy, the user's real identity is determined, which lays the foundation for the user's real identity for subsequent dynamic permission management, and at the same time, ensures the security of subsequent access to system resources.

[0039] Embodiment 3: The embodiment of the present invention provides a dynamic rights management system based on identity association, and a rights allocation module, including: A system resource management unit, used to obtain system resources and classify system resources according to their types, uses and attributes; assigning a unique identifier to the system resource according to the classification result; Manage system resources based on unique identifiers; A system resource permission allocation unit, used to set the permission type of the permission required for accessing the system resources, wherein the permission type of the permission required for accessing the system resources includes: a read permission type, a write permission type, a create permission type, an execute permission type, a delete permission type, and a modify permission type; Allocate required access permissions to each system resource according to the unique identifier and the permission type of the required access permission to the system resource; The access role unit is used to set access roles and assign access rights to access roles.

[0040] In this embodiment, the system resources refer to the resources in the dynamic rights management system.

[0041] In this embodiment, the type of system resources, for example, video type, image and text type.

[0042] In this embodiment, the purpose of system resources is, for example, management purpose and recording purpose.

[0043] In this embodiment, the attributes of the system resources include, for example, the system resource name and the system resource creation time.

[0044] In this embodiment, the unique identifier refers to a symbol used to identify and distinguish system resources, and is used to achieve rapid management and rapid access to system resources.

[0045] In this embodiment, the required access permission refers to the permission required by the user when accessing system resources. For example, the required access permission b1 of system resource a1 means that when a user accesses system resource a1, the user's permission must not be less than the required access permission b1 of system resource a1.

[0046] In this embodiment, the permission type refers to the type of permission required for access.

[0047] In this embodiment, the access role refers to a role used to simply represent a user, such as an administrator role, a guest role, a creator role, and an internal user role.

[0048] The working principle and beneficial effects of the above technical solution are: by managing system resources and assigning required access permissions to each system resource, setting access roles and assigning access permissions to access roles, it is conducive to the subsequent dynamic management of permissions while ensuring the security of system resources.

[0049] Embodiment 4: The embodiment of the present invention provides a dynamic permission management system based on identity association, an access role unit, including: An access role setting block is used to set access roles, where the access roles include: administrator role, guest role, creator role, and internal user role; The access role relationship block is used to set the role relationship between access roles, where the role relationship includes: inclusion relationship, no relationship and partial association relationship; The Access Role Permission Assignment block is used to assign access rights based on access roles.

[0050] In this embodiment, the role relationship refers to the relationship between access roles. For example, the administrator role includes the creator role, and the role relationship between the administrator role and the creator role is an inclusion relationship.

[0051] In this embodiment, the access permission refers to the permission of a user to access system resources.

[0052] The working principle and beneficial effect of the above technical solution are: by setting access roles and setting role relationships between access roles and allocating access rights according to access roles, it is conducive to the subsequent implementation of dynamic permission management.

[0053] Embodiment 5: The embodiment of the present invention provides a dynamic rights management system based on identity association, and the identity association module includes: An access scenario unit, used to generate an initial access scenario when a user accesses system resources; Obtain the resource type that the user needs to access the system resources and limit the initial access scenario; Obtain the user's attempted execution operations on the system resources that the user needs to access, and perform secondary restrictions on the initial access scenario, where the attempted execution operations include: read operation, write operation, create operation, execute operation, delete operation, and modify operation; Extract user access related data and limit the initial access scenario three times, where the user access related data includes: user's current access time data, user's current access device data, user's current access location data and user's historical access behavior data; Determine the access scenario of the user to the system resources according to the primary restriction, the secondary restriction and the tertiary restriction; The identity association strategy unit is used to determine the preset identity association strategy under the access scenario according to the real identity of the user and the access scenario of the user accessing the system resources, wherein the preset identity association strategy includes: identity association determination strategy, identity association verification strategy and identity association allocation strategy; The identity association unit is used to associate the user's real identity with the access role according to the preset identity association strategy in the access scenario, determine the access role to which the user belongs and allocate access rights.

[0054] In this embodiment, the initial access scenario refers to a scenario generated when it is monitored that a user accesses a system resource and is used to represent the user's access to the system resource.

[0055] In this embodiment, the system resource that the user needs to access refers to the system resource that the user wants to access when accessing the system resource.

[0056] In this embodiment, the primary limitation refers to limiting the initial access scenario according to the resource type of the system resource that the user needs to access, for example, limiting the scenario to video system resources.

[0057] In this embodiment, the attempted operation refers to the operation that the user wants to perform when accessing system resources, such as a read operation, a write operation, a create operation, an execute operation, a delete operation, and a modify operation.

[0058] In this embodiment, the secondary limitation refers to limiting the initial access scenario according to the user's attempted execution operation on the system resource that the user needs to access, for example, limiting to the scenario of reading the video system resource.

[0059] In this embodiment, user access related data refers to related data when the user accesses system resources, such as the user's current access time data, the user's current access device data, the user's current access location data, and the user's historical access behavior data.

[0060] In this embodiment, the three limitations refer to the limitation of the initial access scenario according to the user access related data, for example, limiting the scenario of reading the video system resources during working hours.

[0061] In this embodiment, the access scenario of a user accessing a system resource refers to an access scenario determined according to the primary limitation, the secondary limitation, and the tertiary limitation, and is used to accurately represent the user accessing the system resource.

[0062] In this embodiment, the preset identity association policy refers to a preset policy for associating the real identity of the user with the access role.

[0063] In this embodiment, the identity association determination strategy refers to a strategy used to determine to which access role the real identity of the user belongs.

[0064] In this embodiment, the identity association verification policy refers to a policy used to verify whether the real identity of the user belongs to the access role.

[0065] In this embodiment, the identity association allocation strategy refers to allocating the access rights corresponding to the access roles to the real identities of the users.

[0066] In this embodiment, the access role to which the user belongs refers to the access role corresponding to the user determined by associating the real identity of the user with the access role according to a preset identity association policy in an access scenario.

[0067] The working principle and beneficial effects of the above technical solution are: by determining the access scenario of the user to access system resources, the user's real identity is associated with the access role according to the preset identity association strategy under the access scenario, the access role to which the user belongs is determined and access rights are assigned, effectively realizing permission management based on identity association and ensuring the security of system resources.

[0068] Embodiment 6: The embodiment of the present invention provides a dynamic rights management system based on identity association, and the identity association module further includes: An access permission detection unit is used to detect the user's access permission when the user accesses the system resources, determine the user's access role according to the user's real identity, and allow the user to access the system resources when the access permission corresponding to the user's access role is not less than the access permission required for the user to access the system resources; When the access rights corresponding to the access role to which the user belongs are lower than the access rights required for the user to access system resources, the user is prohibited from accessing system resources, the user's access behavior is recorded and stored, and the user is prompted that the access rights are insufficient.

[0069] The working principle and beneficial effect of the above technical solution are: by detecting the user's access rights, the security of system resources is further ensured.

[0070] Embodiment 7: The embodiment of the present invention provides a dynamic permission management system based on identity association, and a dynamic permission module includes: A new system resource determination unit is used to monitor user access behavior in real time when the user accesses system resources; Obtain the system resources that are allowed to be accessed under the access rights corresponding to the access role to which the user belongs, and mark them as old system resources; Obtain the system resources that are not allowed to be accessed under the access rights corresponding to the access role to which the user belongs, and mark them as new system resources; A dynamic management unit is used to continuously allocate access rights corresponding to the access role of the user when it is detected that the user accesses the old system resources; When a user is detected accessing new system resources, the user's access role is updated and managed based on the new system resources and identity association; The access rights are dynamically managed according to the role relationship between the access roles to which the user belongs after the update management and the access roles to which the user belongs before the update management.

[0071] In this embodiment, the user access behavior refers to the behavior of the user when accessing system resources.

[0072] In this embodiment, the old system resources refer to system resources that are allowed to be accessed under the access rights corresponding to the access role to which the user belongs, that is, system resources that the user can currently access without changing the user rights.

[0073] In this embodiment, the new system resource refers to a system resource that is not allowed to be accessed under the access permission corresponding to the access role to which the user belongs, that is, a system resource that is inaccessible under the user's current access permission.

[0074] In this embodiment, when a user is monitored to access a new system resource, the access role to which the user belongs is updated and managed based on the new system resource and identity association. For example, user a1 includes access role b1 and access role b2. When user a1 accesses the old system resource c1, the access rights corresponding to access role b1 are assigned. When the user accesses the new system resource c2, the access role b2 is automatically switched and the corresponding access rights are assigned, allowing the user to access the new system resource c2.

[0075] In this embodiment, when a user is monitored to access a new system resource, the access role to which the user belongs is updated and managed based on the new system resource and identity association. If the access role corresponding to the new system resource does not belong to the access role to which the user belongs, update management is not performed and the user is prohibited from accessing the new system resource. For example, user a1 is currently assigned access rights corresponding to access role b2, and user a1 is currently trying to access a new system resource c3, which corresponds to access role b3. In this case, user a1 is prohibited from accessing the new system resource c3.

[0076] In this embodiment, update management refers to management of the access role to which the user belongs based on the new system resources and identity association when it is monitored that the user accesses new system resources.

[0077] In this embodiment, dynamic management refers to management of access rights that are changed accordingly to changes in system resources.

[0078] The working principle and beneficial effect of the above technical solution are: by updating the access role of the user based on identity association and dynamically managing the access rights when monitoring the user accessing new system resources, dynamic permission management based on identity association is effectively realized.

[0079] Embodiment 8: The embodiment of the present invention provides a dynamic rights management method based on identity association, such as Figure 2 As shown, including: Step 1: According to the preset identity authentication strategy, authenticate the user and determine the user's true identity; Step 2: Manage system resources and assign required access permissions to each system resource, set access roles and assign access permissions to access roles; Step 3: Determine the access scenario for the user to access system resources, associate the user's real identity with the access role according to the preset identity association policy under the access scenario, determine the access role to which the user belongs and assign access rights; Step 4: When a user is detected accessing new system resources, the user's access role is updated and managed based on identity association, and access rights are dynamically managed.

[0080] The working principle and beneficial effects of the above technical solution are: according to the preset identity authentication strategy, the user is authenticated to determine the user's real identity; the system resources are managed and the required access permissions are assigned to each system resource, the access role is set and the access permission is assigned to the access role; the access scenario for the user to access the system resources is determined, and the user's real identity is associated with the access role according to the preset identity association strategy under the access scenario, the access role to which the user belongs is determined and the access permission is assigned; when the user is monitored to access a new system resource, the access role to which the user belongs is updated based on the identity association and the access permission is dynamically managed; the dynamic management of user permissions is realized to ensure the security of system resources.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dynamic rights management system based on identity association, characterized in that: include: The identity authentication module is used to authenticate the user according to the preset identity authentication strategy and determine the user's true identity; The permission allocation module is used to manage system resources and allocate the required access permissions to each system resource, set access roles and allocate access permissions to access roles; The identity association module is used to determine the access scenario of the user to access system resources, associate the user's real identity with the access role according to the preset identity association strategy under the access scenario, determine the access role to which the user belongs and assign access rights; The dynamic permission module is used to update the access role of the user and dynamically manage the access rights based on identity association when a user is detected accessing new system resources.

2. The dynamic rights management system based on identity association according to claim 1 is characterized in that: Identity authentication module, including: An identity authentication strategy unit, used to obtain an identity authentication method, set rules for the identity authentication strategy, and determine a preset identity authentication strategy, wherein the identity authentication methods include: a username-password authentication method, a biometric authentication method, a one-time password authentication method, and a multi-mode authentication method; The identity authentication unit is used to authenticate the user according to the preset identity authentication strategy to determine the user's real identity.

3. The identity-association-based dynamic rights management system according to claim 1 is characterized in that: Permission allocation module, including: A system resource management unit, used to obtain system resources and classify system resources according to their types, uses and attributes; assigning a unique identifier to the system resource according to the classification result; Manage system resources based on unique identifiers; A system resource permission allocation unit, used to set the permission type of the permission required for accessing the system resources, wherein the permission type of the permission required for accessing the system resources includes: a read permission type, a write permission type, a create permission type, an execute permission type, a delete permission type, and a modify permission type; Allocate required access permissions to each system resource according to the unique identifier and the permission type of the required access permission to the system resource; The access role unit is used to set access roles and assign access rights to access roles.

4. The identity-association-based dynamic rights management system according to claim 3 is characterized in that: Access role units, including: An access role setting block is used to set access roles, where the access roles include: administrator role, guest role, creator role, and internal user role; The access role relationship block is used to set the role relationship between access roles, where the role relationship includes: inclusion relationship, no relationship and partial association relationship; The Access Role Permission Assignment block is used to assign access rights based on access roles.

5. The identity-association-based dynamic rights management system according to claim 1, characterized in that: Identity association module, including: An access scenario unit, used to generate an initial access scenario when a user accesses system resources; Obtain the resource type that the user needs to access the system resources and limit the initial access scenario; Obtain the user's attempted execution operations on the system resources that the user needs to access, and perform secondary restrictions on the initial access scenario, where the attempted execution operations include: read operation, write operation, create operation, execute operation, delete operation, and modify operation; Extract user access related data and limit the initial access scenario three times, where the user access related data includes: user's current access time data, user's current access device data, user's current access location data and user's historical access behavior data; Determine the access scenario of the user to the system resources according to the primary restriction, the secondary restriction and the tertiary restriction; The identity association strategy unit is used to determine the preset identity association strategy under the access scenario according to the real identity of the user and the access scenario of the user accessing the system resources, wherein the preset identity association strategy includes: identity association determination strategy, identity association verification strategy and identity association allocation strategy; The identity association unit is used to associate the user's real identity with the access role according to the preset identity association strategy in the access scenario, determine the access role to which the user belongs and allocate access rights.

6. The identity-association-based dynamic rights management system according to claim 5, characterized in that: The identity association module also includes: An access permission detection unit is used to detect the user's access permission when the user accesses the system resources, determine the user's access role according to the user's real identity, and allow the user to access the system resources when the access permission corresponding to the user's access role is not less than the access permission required for the user to access the system resources; When the access rights corresponding to the access role to which the user belongs are lower than the access rights required for the user to access system resources, the user is prohibited from accessing system resources, the user's access behavior is recorded and stored, and the user is prompted that the access rights are insufficient.

7. The dynamic rights management system based on identity association according to claim 1 is characterized in that: Dynamic permission module, including: A new system resource determination unit is used to monitor user access behavior in real time when the user accesses system resources; Obtain the system resources that are allowed to be accessed under the access rights corresponding to the access role to which the user belongs, and mark them as old system resources; Obtain the system resources that are not allowed to be accessed under the access rights corresponding to the access role to which the user belongs, and mark them as new system resources; A dynamic management unit is used to continuously allocate access rights corresponding to the access role of the user when it is detected that the user accesses the old system resources; When a user is detected accessing new system resources, the user's access role is updated and managed based on the new system resources and identity association; The access rights are dynamically managed according to the role relationship between the access roles to which the user belongs after the update management and the access roles to which the user belongs before the update management.

8. A dynamic rights management method based on identity association, characterized in that: include: Step 1: According to the preset identity authentication strategy, authenticate the user and determine the user's true identity; Step 2: Manage system resources and assign required access permissions to each system resource, set access roles and assign access permissions to access roles; Step 3: Determine the access scenario for the user to access system resources, associate the user's real identity with the access role according to the preset identity association policy under the access scenario, determine the access role to which the user belongs and assign access rights; Step 4: When a user is detected accessing new system resources, the user's access role is updated and managed based on identity association, and access rights are dynamically managed.

Images