Many-to-one general scene control method and system based on user permission

Abstract

The invention provides a many-to-one general scene control method and system based on user permissions. The method comprises the following steps: establishing a required relatively perfect permission management system in response; defining and classifying each scene needing to be controlled according to needs, defining a corresponding authority requirement for each classification type, and formulating a corresponding authority management strategy according to the definition of each scene; collecting behavior data of the user in different scenes, and analyzing the behavior data to obtain analysis data; based on the collected behavior data and the obtained analysis data, designing and training a decision model for predicting whether the user is allowed to execute a specific operation according to the user identity and authority information; the trained decision model is verified and optimized and then integrated into an authority management system for deployment, and when a user requests to execute operation in a certain scene, the system calls the model for prediction and decides whether to allow the user to execute operation or not according to a prediction result. And the maintenance and special management cost and the time consumption cost are reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of authority control, and in particular relates to a universal scene control method and system based on many-to-one user authority. Background Art

[0002] "Many-to-one" is a common user permission model, which is usually used to distinguish different permission levels and access rights of users in the system. Specifically, it means that multiple users share the same permission level or role.

[0003] The existing multi-user permission management has many shortcomings:

[0004] Complexity: The implementation of multi-user permissions usually involves the management and association of multiple concepts such as users, roles, permissions, etc. This complexity may make system design and development more difficult, and may require additional work and complex logic to ensure correct permission control;

[0005] Granular management: In some cases, the granularity requirements for user permissions may be very detailed, requiring refinement to the specific operation or resource level. Such requirements may make permission management very complicated and prone to errors or omissions;

[0006] Security vulnerabilities: Permission management itself is a key point in system security. If permissions are incorrectly assigned or bypassed, it may lead to unauthorized users accessing sensitive data or performing dangerous operations. Therefore, the security and vulnerabilities of the system need to be carefully considered when implementing multi-user permissions;

[0007] Flexibility and scalability: For large-scale and complex systems, user roles and permissions may change dynamically. Therefore, the permission management mechanism needs to be flexible and scalable enough to cope with such changes and be able to dynamically adjust user permissions;

[0008] Management complexity: Administrators need to manage a large number of users, roles, and permissions, and perform operations such as role assignment, permission authorization, and user association. This may lead to increased management complexity, including the workload of user maintenance, permission review, and role management.

[0009] In view of this, it is very meaningful to propose a universal scene control method and system based on many-to-one user permissions. Summary of the invention

[0010] In order to solve the deficiencies in the prior art, the present invention provides a general scene control method and system based on many-to-one user permissions, which is designed to reduce complexity, granular management, security vulnerabilities, flexibility and scalability, and management complexity to solve the above-mentioned technical defects.

[0011] In a first aspect, the present invention proposes a universal scene control method based on many-to-one user permissions, the method comprising the following steps:

[0012] In response to the establishment of a relatively complete authority management system required;

[0013] Define and classify the various scenarios that need to be controlled as needed, define corresponding permission requirements for each classification type, and formulate corresponding permission management strategies based on the definitions of each scenario;

[0014] Collect user behavior data in different scenarios and analyze them to obtain analytical data;

[0015] Based on the collected behavioral data and obtained analytical data, design and train decision models to predict whether to allow users to perform specific operations based on user identity and permission information; and

[0016] The trained decision model is verified and optimized, then integrated into the permission management system and deployed. When a user requests to perform an operation in a certain scenario, the system will call the model for prediction and decide whether to allow the user to perform the operation based on the prediction results.

[0017] Preferably, the training of the decision model includes:

[0018] Data collection: adjust and expand the user behavior data to be extracted according to specific scenarios and needs, obtain the data set required for training, and divide the data set into a training set and a validation set;

[0019] Feature extraction: adjust and expand the features to be extracted according to specific scenarios and requirements. After feature extraction, use machine learning, data mining, or rule engine technology to train models or formulate rules to convert user permission data into feature vector representation;

[0020] Model training, inputting the obtained feature vectors and label data information in the training set into the machine learning algorithm for model training to obtain the original prediction model;

[0021] Model testing: using the validation set to test the original prediction model to obtain a target prediction model.

[0022] Further preferably, the machine learning algorithm comprises logistic regression, decision tree or random forest.

[0023] Further preferably, the model prediction formula is as follows:

[0024] z=w'x+b

[0025] Among them, x represents the feature vector as input, w represents the weight vector, w' represents the transpose of w, and b represents the bias.

[0026] Further preferably, an activation function sigmoid is used to convert z into a probability value p; the activation function sigmoid is expressed as follows:

[0027] p=sigmoid(z)=1 / (1+exp(-z))

[0028] When predicting a new feature vector during the model prediction process, a decision is made based on the output probability p of the model, and a threshold is set. If p is greater than the threshold, it is allowed, otherwise it is rejected.

[0029] Further preferably, a cross entropy loss function is used to measure the difference between the predicted result and the true label. The cross entropy loss function is expressed as follows:

[0030] L(w,b)=-[y*log(p)+(1-y)*log(1-p)]

[0031] Among them, y represents the true label permission or rejection, that is, whether the user performs the operation.

[0032] Further preferably, the gradient descent method is used to optimize the parameters w and b during the model training process to minimize the loss function; wherein,

[0033] The parameter update rule is expressed as follows:

[0034]

[0035]

[0036] The parameter gradient calculation formula is as follows:

[0037]

[0038]

[0039] Where α represents the learning rate, Represents the partial derivative of the loss function L with respect to a certain parameter or variable, represents the partial derivative of the loss function L with respect to the bias term b, Represents the partial derivative of the loss function L with respect to the weight w;

[0040] During the training process, the focus is on minimizing the loss function by adjusting the parameters w and b. The methods for updating the parameters include batch gradient descent, stochastic gradient descent, or mini-batch gradient descent optimization algorithms.

[0041] In a second aspect, an embodiment of the present invention further provides a universal scene control system based on many-to-one user permissions, including:

[0042] The authority management module is configured to establish a relatively complete authority management system required;

[0043] The scenario module is configured to define and classify the various scenarios that need to be controlled as needed, define the corresponding permission requirements for each classification type, and formulate corresponding permission management strategies based on the definition of each scenario;

[0044] A data analysis module is configured to collect user behavior data in different scenarios and analyze it to obtain analysis data;

[0045] A model training module, configured to design and train a decision model based on the collected behavior data and the obtained analysis data to predict whether to allow the user to perform a specific operation according to the user identity and permission information;

[0046] The deployment module is configured to verify and optimize the trained decision model, integrate it into the permission management system and deploy it. When a user requests to perform an operation in a certain scenario, the system will call the model for prediction and decide whether to allow the user to perform the operation based on the prediction results.

[0047] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0048] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0049] Compared with the prior art, the beneficial results of the present invention are:

[0050] (1) The technical solution of the present invention aims at solving the shortcomings of the prior art by reducing complexity, granular management, security vulnerabilities, flexibility and scalability, and management complexity. In order to reduce complexity, a table of shared provinces, cities and districts is used to determine permissions and control them, reducing granular management to a certain extent and optimizing it. There is no need for the front-end to transmit values ​​and the back-end to determine whether there is permission based on the basic information of the user, thereby ensuring security. The solution can be applied to various regions and can be deployed with one click without modifying the configuration and maintaining the configuration user selection table. It solves the problem of administrators having to manage a large number of users, roles and permissions, and performing operations such as role allocation, permission authorization and user association. This solution frees your hands and does not require excessive attention to the allocation of the selection, thereby reducing manpower and material resources.

[0051] (2) Flexibility, scalability, and versatility. It can be deployed in different regions. It reduces the complexity of multi-user permission control and improves security. It does not require special management, thereby reducing the cost and time of maintenance and special management. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and are used together with the description to explain the principles of the present invention. It will be easy to recognize other embodiments and many expected advantages of the embodiments because they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with each other. The same reference numerals refer to corresponding similar parts.

[0053] Figure 1 is a diagram of an exemplary device architecture in which an embodiment of the present invention may be applied;

[0054] Figure 2 It is a flowchart of a universal scene control method based on many-to-one user permissions according to an embodiment of the present invention;

[0055] Figure 3 A schematic diagram of a process flow of process permissions in a universal scene control method based on many-to-one user permissions in an embodiment of the present invention;

[0056] Figure 4 It is a flowchart of a training formula in a universal scene control method based on many-to-one user authority according to an embodiment of the present invention;

[0057] Figure 5 It is a schematic diagram of a universal scene control system based on many-to-one user permissions according to an embodiment of the present invention;

[0058] Figure 6 It is a schematic diagram of the structure of a computer device suitable for implementing an electronic device of an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In the following detailed description, reference is made to the accompanying drawings, which form a part of the detailed description and are shown by illustrative specific embodiments in which the present invention can be put into practice. To this end, directional terms, such as "top", "bottom", "left", "right", "up", "down", etc., are used with reference to the orientation of the figures described. Because the parts of the embodiments can be positioned in several different orientations, directional terms are used for the purpose of illustration and are by no means limiting. It should be understood that other embodiments may be utilized or logical changes may be made without departing from the scope of the present invention. Therefore, the following detailed description should not be adopted in a limiting sense, and the scope of the present invention is defined by the appended claims.

[0060] Figure 1 An exemplary system architecture 100 is shown to which the universal scene control method based on many-to-one user permissions or the universal scene control system based on many-to-one user permissions according to the embodiments of the present invention can be applied.

[0061] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0062] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0063] The terminal devices 101 , 102 , and 103 may be various electronic devices with communication functions, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0064] The server 105 may be a server providing various services, such as a background information processing server that processes the verification request information sent by the terminal devices 101, 102, and 103. The background information processing server may analyze the received verification request information and obtain a processing result.

[0065] It should be noted that the universal scene control method based on many-to-one user rights provided in the embodiment of the present invention is generally executed by the server 105, and accordingly, the universal scene control system based on many-to-one user rights is generally set in the server 105. In addition, the universal scene control method based on many-to-one user rights provided in the embodiment of the present invention is generally executed by the terminal devices 101, 102, and 103, and accordingly, the universal scene control system based on many-to-one user rights is generally set in the terminal devices 101, 102, and 103.

[0066] It should be noted that the server can be hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or it can be implemented as a single server. When the server is software, it can be implemented as multiple software or software modules (for example, used to provide distributed services), or it can be implemented as a single software or multiple software modules, which is not specifically limited here.

[0067] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided as required. In the case where the processed data does not need to be obtained remotely, the above device architecture may not include a network, but only a server or a terminal device.

[0068] The current product structure includes:

[0069] 1. User management: This is the component that manages the basic information and identity authentication of users in the management system. It includes functions such as user account, password management, user registration, and login. The user management component provides the basis for user identity authentication and authorization.

[0070] 2. Role Management: Role management is the component that defines and maintains different roles and their permissions. These roles can represent different user types or user groups in the system, and each role can have different levels of permissions. The role management module allows administrators to create, edit, and delete roles, and assign corresponding permissions.

[0071] 3. Permission management: Permission management is a component that defines and manages permissions for various operations and functions in the system. Through permission management, specific permissions can be assigned to specific roles or user groups. This component usually includes functions such as permission definition, permission allocation, and permission verification.

[0072] 4. User role association: This component is used to establish the association between users and roles. By assigning one or more roles to a user, a many-to-one user permission model can be implemented. This component usually includes functions such as role assignment, role removal, and role association query.

[0073] 5. Access control: Access control is the component that actually implements permission control. It is responsible for deciding whether users can perform specific actions or access specific resources based on their roles and permissions. Access control components are usually tightly integrated with the core functions of the system, ensuring that only users with the necessary permissions can perform relevant operations.

[0074] Existing working principle:

[0075] 1. User Authentication: When a user accesses a system, they first need to authenticate themselves. This can be done with a username and password, a token, or other authentication mechanism. The system verifies the user's identity and determines the role they belong to.

[0076] 2. Role assignment: In the many-to-one user permissions model, multiple users will be assigned to the same role. Administrators or system operators can associate users with roles through the role management interface. In this way, these users share the same role and permissions.

[0077] 3. Permission authorization: Administrators can define different permissions and assign these permissions to corresponding roles. These permissions can cover various operations and resource access in the system. By assigning appropriate permissions to roles, the system can ensure that only users with corresponding permissions can perform related operations.

[0078] 4. Access control: Access control is to limit the user's access to system functions and resources based on the user's role and permissions. When a user uses the system, the system will determine whether the user has the permission to perform a specific operation or access a specific resource based on the user's role and permissions. If the user does not have the required permissions, the system will block or deny the operation or access request.

[0079] 5. Dynamic permission management: In addition to static role and permission allocation, there may also be dynamic permission management requirements. For example, users need to obtain additional temporary permissions at runtime or under specific conditions. In this case, the system needs to provide a mechanism that allows administrators to dynamically grant or revoke specific permissions for users.

[0080] Deficiencies of existing technology:

[0081] 1. Complexity: The implementation of multi-user permissions usually involves the management and association of multiple concepts such as users, roles, permissions, etc. This complexity may make system design and development more difficult, and may require additional workload and complex logic to ensure correct permission control.

[0082] 2. Granularity management: In some cases, the granularity requirements for user permissions may be very detailed and need to be broken down to specific operations or resource levels. Such requirements may make permission management very complex and prone to errors or omissions.

[0083] 3. Security vulnerabilities: Permission management itself is a key point in system security. If permissions are incorrectly assigned or bypassed, it may lead to unauthorized users accessing sensitive data or performing dangerous operations. Therefore, the security and vulnerabilities of the system need to be carefully considered when implementing multi-user permissions.

[0084] 4. Flexibility and scalability: For large-scale and complex systems, user roles and permissions may change dynamically. Therefore, the permission management mechanism needs to be flexible and scalable enough to cope with such changes and be able to dynamically adjust user permissions.

[0085] 5. Management complexity: Administrators need to manage a large number of users, roles, and permissions, and perform operations such as role assignment, permission authorization, and user association. This may lead to increased management complexity, including the workload of user maintenance, permission review, and role management.

[0086] Therefore, the technical solution of the present invention adopts a design to solve the shortcomings of the prior art by reducing complexity, granularity management, security vulnerabilities, flexibility and scalability, and management complexity.

[0087] In a first aspect, an embodiment of the present invention discloses a universal scene control method based on many-to-one user permissions, such as Figure 2 and Figure 3 As shown, the method comprises the following steps:

[0088] S1. In response to the establishment of a relatively complete authority management system required;

[0089] Specifically, the permission management system includes functions such as user identity authentication, permission allocation and permission verification. Users need to be authenticated when logging in, and the corresponding permissions are allocated according to their roles or identities.

[0090] S2. Define and classify the various scenarios that need to be controlled as needed, define corresponding permission requirements for each classification type, and formulate corresponding permission management strategies based on the definitions of each scenario;

[0091] Specifically, define and classify the various scenarios that need to be controlled. For example, you can divide the scenarios into different categories such as file access, system configuration, and data operations, and define corresponding permission requirements for each category. The permission management strategy includes determining which users or user groups have access to a certain scenario, as well as the specific behaviors that are allowed or denied in a specific scenario.

[0092] S3. Collect user behavior data in different scenarios and analyze them to obtain analytical data;

[0093] Specifically, by analyzing the data, we can understand the user's behavior patterns and habits in different scenarios and use them as a basis for weighing decision-making.

[0094] S4. Based on the collected behavioral data and the obtained analytical data, design and train a decision model to predict whether to allow the user to perform a specific operation based on the user's identity and permission information; and

[0095] Specifically, in this embodiment, a machine learning algorithm, such as logistic regression, decision tree, random forest, etc., can be used to train a model for prediction.

[0096] S5. After verifying and optimizing the trained decision model, integrate it into the permission management system and deploy it. When the user requests to perform an operation in a certain scenario, the system will call the model for prediction and decide whether to allow the user to perform the operation based on the prediction result.

[0097] Specifically, continuously monitor and collect user behavior data, and update and optimize the model based on actual conditions to adapt to the ever-changing environment and needs.

[0098] Further, combined with Figure 4 The detailed process is as follows:

[0099] 1) Feature extraction: Adjust and expand according to specific scenarios and needs. After feature extraction, you can use machine learning, data mining, or rule engines to train models or formulate rules to convert user permission data into feature vector representation.

[0100] 2) Algorithm formula:

[0101] ① Input: feature vector x, label y (allow or reject);

[0102] ②Parameters: weight vector w, bias b;

[0103] ③Model prediction formula: z = w'x + b, where w' represents the transpose of w;

[0104] ④Activation function: Use the sigmoid function to convert z into a probability value p;

[0105] p=sigmoid(z)=1 / (1+exp(-z)).

[0106] 3) Loss function: The cross entropy loss function is used to measure the difference between the predicted result and the true label.

[0107] Cross entropy loss function:

[0108] L(w,b)=-[y*log(p)+(1-y)*log(1-p)]

[0109] Where y represents the true label.

[0110] 4) Model training: Use gradient descent to optimize parameters w and b to minimize the loss function.

[0111] ①Parameter update rules:

[0112]

[0113]

[0114] Where α represents the learning rate, Represents the partial derivative of the loss function L with respect to a certain parameter or variable, represents the partial derivative of the loss function L with respect to the bias term b, Represents the partial derivative of the loss function L with respect to the weight w.

[0115] ②Parameter gradient calculation:

[0116]

[0117]

[0118] 5) Model prediction: predict the new feature vector and make a decision based on the output probability p of the model. For example, set a threshold. If the output probability p is greater than the threshold, it is allowed, otherwise it is rejected.

[0119] During training, the focus is to minimize the loss function by adjusting the parameters w and b. Parameters can be updated using optimization algorithms such as batch gradient descent, stochastic gradient descent, or mini-batch gradient descent.

[0120] The technical solution of the present invention aims at the deficiencies of the prior art by reducing complexity, granular management, security vulnerabilities, flexibility and scalability, and management complexity. In order to reduce complexity, a table of shared provinces, cities and districts is used to determine authority for control, and granular management is reduced to a certain extent and optimized. There is no need for the front-end to transmit values, and the back-end determines whether there is authority based on the basic information of the user, thereby ensuring security. The solution can be applied to various regions, and one-click deployment is achieved without modifying the configuration and maintaining the configuration user full selection table. It solves the problem that administrators need to manage a large number of users, roles and permissions, and perform operations such as role allocation, permission authorization and user association. This solution frees your hands and there is no need to pay too much attention to the allocation of full selection, thereby reducing manpower and material resources.

[0121] In a second aspect, the embodiment of the present invention also discloses a universal scene control system based on many-to-one user permissions, such as Figure 5As shown, it includes: a permission management module 51, a scenario module 52, a data analysis module 53, a model training module 54 and a deployment module 55.

[0122] In a specific embodiment, the permission management module 51 is configured to establish the required relatively complete permission management system; the scenario module 52 is configured to define and classify the various scenarios that need to be controlled as needed, and define corresponding permission requirements for each classification type, and formulate corresponding permission management policies according to the definitions of each scenario; the data analysis module 53 is configured to collect user behavior data in different scenarios, and analyze and obtain analysis data; the model training module 54 is configured to design and train a decision model based on the collected behavior data and the obtained analysis data to predict whether the user is allowed to perform a specific operation based on the user identity and permission information; the deployment module 55 is configured to verify and optimize the trained decision model, integrate it into the permission management system and deploy it. When the user requests to perform an operation in a certain scenario, the system will call the model for prediction, and decide whether to allow the user to perform the operation based on the prediction result.

[0123] Reference below Figure 6 , which shows an electronic device (eg Figure 1 A schematic diagram of the structure of a computer device 600 (a server or terminal device as shown). Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0124] like Figure 6 As shown, the computer device 600 includes a central processing unit (CPU) 601 and a graphics processing unit (GPU) 602, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 603 or a program loaded from a storage part 609 to a random access memory (RAM) 604. In the RAM 604, various programs and data required for the operation of the device 600 are also stored. The CPU 601, GPU 602, ROM 603 and RAM 604 are connected to each other through a bus 605. An input / output (I / O) interface 606 is also connected to the bus 605.

[0125] The following components are connected to the I / O interface 606: an input section 607 including a keyboard, a mouse, etc.; an output section 608 including a display such as a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 609 including a hard disk, etc.; and a communication section 610 including a network interface card such as a LAN card, a modem, etc. The communication section 610 performs communication processing via a network such as the Internet. A drive 611 may also be connected to the I / O interface 606 as needed. A removable medium 612, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 611 as needed so that a computer program read therefrom is installed into the storage section 609 as needed.

[0126] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 610, and / or installed from the removable medium 612. When the computer program is executed by the central processing unit (CPU) 601 and the graphics processing unit (GPU) 602, the above-mentioned functions defined in the method of the present invention are executed.

[0127] It should be noted that the computer-readable medium described in the present invention may be a computer-readable signal medium or a computer-readable medium or any combination of the above two. The computer-readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, apparatus or device, or any combination of the above. More specific examples of computer-readable media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution device, apparatus or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium may also be any computer-readable medium other than a computer-readable medium that can send, propagate or transmit a program for use by or in conjunction with an instruction execution device, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0128] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0129] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the device, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based device that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0130] The modules involved in the embodiments of the present invention may be implemented in software or hardware, and the modules described may also be arranged in a processor.

[0131] As another aspect, the present invention also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or it may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by the electronic device, the electronic device: responds to the establishment of a relatively complete permission management system required; defines and classifies each scenario to be controlled as required, and defines corresponding permission requirements for each classification type, and formulates corresponding permission management strategies according to the definition of each scenario; collects user behavior data in different scenarios, and analyzes to obtain analysis data; based on the collected behavior data and the obtained analysis data, designs and trains a decision model for predicting whether the user is allowed to perform a specific operation based on the user identity and permission information; and integrates the trained decision model into the permission management system after verification and optimization and deploys it, and when the user requests to perform an operation in a certain scenario, the system will call the model for prediction, and decide whether to allow the user to perform the operation based on the prediction result.

[0132] The above description is only a preferred embodiment of the present invention and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present invention is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A universal scene control method based on many-to-one user authority, characterized in that: The method comprises the following steps: In response to the establishment of a relatively complete authority management system required; Define and classify the various scenarios that need to be controlled as needed, define corresponding permission requirements for each classification type, and formulate corresponding permission management strategies based on the definitions of each scenario; Collect user behavior data in different scenarios and analyze them to obtain analytical data; Based on the collected behavioral data and the obtained analytical data, design and train decision models to predict whether to allow users to perform specific operations based on user identity and permission information; as well as The trained decision model is verified and optimized, then integrated into the permission management system and deployed. When a user requests to perform an operation in a certain scenario, the system will call the model for prediction and decide whether to allow the user to perform the operation based on the prediction results.

2. The universal scene control method based on many-to-one user authority according to claim 1 is characterized in that: The training of the decision model includes: Data collection: adjust and expand the user behavior data to be extracted according to specific scenarios and needs, obtain the data set required for training, and divide the data set into a training set and a validation set; Feature extraction: adjust and expand the features to be extracted according to specific scenarios and requirements. After feature extraction, use machine learning, data mining, or rule engine technology to train models or formulate rules to convert user permission data into feature vector representation; Model training, inputting the obtained feature vectors and label data information in the training set into the machine learning algorithm for model training to obtain the original prediction model; Model testing: using the validation set to test the original prediction model to obtain a target prediction model.

3. The universal scene control method based on many-to-one user authority according to claim 2 is characterized in that: Machine learning algorithms include logistic regression, decision trees, or random forests.

4. The universal scene control method based on many-to-one user authority according to claim 3 is characterized in that: The model prediction formula is as follows: z=w'x+b Among them, x represents the feature vector as input, w represents the weight vector, w' represents the transpose of w, and b represents the bias.

5. The universal scene control method based on many-to-one user authority according to claim 4 is characterized in that: Also includes: Use the activation function sigmoid to convert z into a probability value p; the activation function sigmoid is expressed as follows: p=sigmoid(z)=1 / (1+exp(-z)) When predicting a new feature vector during the model prediction process, a decision is made based on the output probability p of the model, and a threshold is set. If p is greater than the threshold, it is allowed, otherwise it is rejected.

6. The universal scene control method based on many-to-one user authority according to claim 5 is characterized in that: Also includes: The cross entropy loss function is used to measure the difference between the predicted result and the true label. The cross entropy loss function is expressed as follows: L(w,b)=-[y*log(p)+(1-y)*log(1-p)] Among them, y represents the true label permission or rejection, that is, whether the user performs the operation.

7. The universal scene control method based on many-to-one user authority according to claim 6 is characterized in that: Also includes: During the model training process, the gradient descent method is used to optimize the parameters w and b to minimize the loss function; The parameter update rule is expressed as follows: The parameter gradient calculation formula is as follows: Where α represents the learning rate, Represents the partial derivative of the loss function L with respect to a certain parameter or variable, represents the partial derivative of the loss function L with respect to the bias term b, Represents the partial derivative of the loss function L with respect to the weight w; During the training process, the focus is on minimizing the loss function by adjusting the parameters w and b. The methods for updating the parameters include batch gradient descent, stochastic gradient descent, or mini-batch gradient descent optimization algorithms.

8. A universal scene control system based on many-to-one user authority, characterized in that: include: The authority management module is configured to establish a relatively complete authority management system required; The scenario module is configured to define and classify the various scenarios that need to be controlled as needed, define the corresponding permission requirements for each classification type, and formulate corresponding permission management strategies based on the definition of each scenario; A data analysis module is configured to collect user behavior data in different scenarios and analyze it to obtain analysis data; A model training module, configured to design and train a decision model based on the collected behavior data and the obtained analysis data to predict whether to allow the user to perform a specific operation according to the user identity and permission information; The deployment module is configured to verify and optimize the trained decision model, integrate it into the permission management system and deploy it. When a user requests to perform an operation in a certain scenario, the system will call the model for prediction and decide whether to allow the user to perform the operation based on the prediction results.

9. An electronic device, comprising: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images