Internet of Things industry authority data processing method

Abstract

The invention discloses an Internet of Things industry authority data processing method, which is realized by means of a CPU (Central Processing Unit), a matched special storage unit with a task set and a data processing module, and comprises the following steps: S1, establishing a database, S2, constructing an authorization analysis model and S3, performing data processing by utilizing the authorization analysis model. Wherein the step S2 is further divided into S2-1, authorization data analysis, S2-2, person and person group relational data analysis, S2-3, point and point group relational data analysis and S2-4, an authorization analysis model is obtained through AR data analysis or point and equipment relational data analysis; according to the method, the authorization data analysis model with the finest granularity is constructed, unified authority downloading and unified authorization data query of authority management in the cross-service field are achieved, repeated operation of cross-service authority management is avoided, and the authority management working efficiency of the Internet of Things industry is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of authority management and relates to an Internet of Things industry authority data processing method. Background Art

[0002] Permission management generally refers to the fact that users can access and can only access the resources they are authorized to access according to the security rules or security policies set by the system. At present, the more mature models in the field of permission management mainly include the DAC model and the RBAC model.

[0003] In the IoT system, permission management is an important and labor-intensive task, which usually involves the download of multiple device permissions in various businesses. However, in theory, data should not be managed across businesses, so in the IoT system, authorization is almost always performed in the business field of each application. However, in the authorization process, it is found that many application scenarios are similar. For example, in the access control business, a certain person will be granted access control permissions for a certain door point, in the consumption business, a certain person will be granted consumption permissions for a certain consumption point, and in the visitor business, a certain visitor will be granted permissions to a certain access area, and so on.

[0004] Therefore, it is very necessary to build a unified authorization analysis model across business areas, both in terms of management and efficiency. Summary of the invention

[0005] In order to improve the efficiency of authorization management in the Internet of Things system, the present invention constructs a most fine-grained authorization analysis model, which can realize unified permission data processing across business fields in the Internet of Things system.

[0006] The technical solution of the present invention is a method for processing permission data in the Internet of Things industry, which is implemented by means of a CPU, a dedicated storage unit with a task set, and a data processing module. The key lies in that the method comprises the following steps:

[0007] S1. Establish a database: collect business data of the Internet of Things industry and reclassify it into human data, human group data, point data, point group data, human-human group relationship data, point-point group relationship data, point-device relationship data, and authorization data, and build corresponding data sets;

[0008] S2. Build an authorization analysis model: Analyze the above data set and break it down into detailed permission data in the dimensions of [person+point+device], including:

[0009] S2-1. Authorization data analysis: The authorization data is decomposed into data in the dimension of [person+point+authorization] and data in the dimensions of [person group+point+authorization] and [person+point group+authorization]. The data in the dimension of [person+point+authorization] is recorded as AR data, and the data in the dimensions of [person group+point+authorization] and [person+point group+authorization] are recorded as AGR data.

[0010] S2-2. Person-to-person group relationship data analysis: Find all corresponding AGR data based on the person group, and then convert the AGR data into AR data by combining the person-to-person group relationship data;

[0011] S2-3, point and point group relationship data analysis: find all corresponding AGR data according to the point group, and then combine the point and point group relationship data to convert the AGR data into AR data;

[0012] S2-4. Obtaining authorized analysis model through AR data analysis or point and device relationship data analysis:

[0013] The above AR data analysis combines point and device relationship data to decompose AR data into refined granularity permission data in the dimensions of [people + devices + points], recorded as FD data;

[0014] The above-mentioned point and device relationship data analysis combines AR data and decomposes the point and device relationship data into refined granularity permission data in the dimensions of [person+device+point], recorded as FD data;

[0015] S3. Data processing using the authorization analysis model:

[0016] It is divided into three situations: adding data, modifying data, and deleting relational data. The specific data processing process is as follows:

[0017] When adding new relational data, the corresponding AR data is added and marked as valid, and the corresponding FD data is generated and marked as authorized; the newly added relational data is grouped into person data, point data, person group data and point group data, and is not analyzed but only saved in the unit storage unit;

[0018] When modifying relational data, the corresponding AR data is added and marked as valid, and the corresponding FD data is generated and marked as authorized;

[0019] When deleting relationship data, the corresponding AR data is marked as invalid, and the corresponding FD data is marked as unauthorized; the corresponding relationship data between people and people groups, points and point groups are deleted without analysis.

[0020] Specifically, the business data of the Internet of Things industry mentioned above is divided into access control business data, consumption business data, visitor business data, elevator control business data and other business data according to the business attributes of the Internet of Things industry.

[0021] More specifically, the above-mentioned other business data are authorization-related business data that cannot be classified into the five categories of data: access control business data, consumer business data, visitor business data, and elevator control business data in the Internet of Things industry, including conference room reservation authorization and door lock authorization.

[0022] Furthermore, the above authorization data is divided into authorization data of a person and a point, authorization data of a person group and a point, authorization data of a person and a point group, and authorization data of a person group and a point group.

[0023] Furthermore, the above-mentioned human data includes personnel name, work number and credential data.

[0024] Finally, the refined granular permission data of [person+device+point] in steps S2-4 is further decomposed into the final permission data of [credentials+device+point] dimension.

[0025] The beneficial effect of the present invention is that the present invention uniformly abstracts the data of multiple business fields involved in the Internet of Things industry or the Internet of Things system, regroups the cross-domain business data into eight categories of data sets, and constructs a database. Then, the present invention continues to uniformly analyze and process the data sets, disassembles all authorizations to obtain refined granular data, that is, permission data (FD data) in the [person + point + device] dimension. Further, it is further disassembled into final permission data in the [credentials + point + device] dimension based on [person + credentials]. FD data or final permission data is the direct data source for the final permission download and authorization data query, realizing unified permission download and authorization data query across business fields.

[0026] The present invention can realize the merging of multiple authorizations and automatic association when data is added, modified or deleted, avoiding repeated operations of cross-business permission management, and improving the efficiency of permission management in the Internet of Things industry. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 The overall logic diagram for each business data in the IoT industry is analyzed through unified permissions, downloaded in a unified manner, and finally downloaded to the device or pushed to a third-party system.

[0028] Figure 2 A logical diagram of the data processing process.

[0029] Figure 3 Schematic diagram of the database establishment process.

[0030] Figure 4 This is an explanation of the authorization time for merging multiple authorizations. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] Example

[0033] In this embodiment, the Internet of Things industry authority data processing method of the present invention is explained.

[0034] The permission data processing method of this embodiment needs to be implemented with the help of a CPU, a dedicated storage unit with a task set, and a data processing module. For each business data in the Internet of Things industry, unified permission analysis is performed, and then unified download is performed, and finally downloaded to the device or pushed to a third-party system to complete the permission management. The overall logic diagram is shown in the attached Figure 1 .

[0035] The data processing process starts from the business data and breaks down all authorizations into detailed granularity, that is, the permission data of the [person+point+device] dimension, and further breaks it down into the final permission data of the [credential+point+device] dimension. For the overall data processing process, please refer to the attached Figure 2 .

[0036] The specific steps of the data processing process are:

[0037] S1. Establish database:

[0038] According to the business attributes of the Internet of Things industry, the authorization-related business data are divided into access control business data, consumer business data, visitor business data, elevator control business data and other business data, and the above business data are collected; in this embodiment, other business data are authorization-related business data in the Internet of Things industry that cannot be classified into the five categories of access control business data, consumer business data, visitor business data, and elevator control business data, such as conference room reservation authorization, door lock authorization, etc.

[0039] The collected business data is reorganized and divided into person data, person group data, point data, point group data, person-person group relationship data, point-point group relationship data, point-device relationship data, and authorization data to construct corresponding data sets; among which, the authorization data can be further divided into authorization data of people and points, authorization data of people groups and points, authorization data of people and point groups, and authorization data of people groups and point groups.

[0040] Attached Figure 3 It illustrates the various business data collection methods and which category of abstract data definition each belongs to.

[0041] S2. Build an authorization analysis model: Starting from business data, all business data is broken down into final permission data in the dimensions of [people + points + devices], which are specifically divided into:

[0042] S2-1. Authorization data analysis:

[0043] Decompose the authorization data into data in the dimensions of [person+point+authorization], [person group+point+authorization], and [person+point group+authorization];

[0044] Among them, the data in the [person+point+authorization] dimension is recorded as AR data, and the data in the [person group+point+authorization] and [person+point group+authorization] dimensions are recorded as AGR data.

[0045] S2-2. Data analysis of relationships between people and groups:

[0046] Find all the corresponding AGR data according to the person group, and then convert the AGR data into AR data by combining the person-person group relationship data. The decomposition formula is formula 1:

[0047] f(people group + point, people group + people) = people + point Formula 1.

[0048] S2-3. Analysis of point and point group relationship data: Find all corresponding AGR data according to the point group, and then combine the point and point group relationship data to convert the AGR data into AR data. The decomposition formula is Formula 2.

[0049] f(person + point group, point group + point) = person + point Formula 2.

[0050] S2-4. Obtaining authorized analysis model through AR data analysis or point and device relationship data analysis:

[0051] The above AR data analysis combines point and device relationship data to decompose AR data into refined granularity permission data in the dimensions of [people + devices + points], recorded as FD data;

[0052] The above-mentioned point and device relationship data analysis combines AR data to decompose the point and device relationship data into refined granularity permission data in the [person + device + point] dimension, recorded as FD data.

[0053] Because human data includes personnel name, work number and credential data, among which the credential data can specifically be an access card or biometric information, such as facial recognition, fingerprint recognition, etc.

[0054] The refined granular permission data of [person+device+point] in step S2-4 can also be further decomposed into the final permission data of [credential+device+point] dimension. The decomposition formula is formula 3:

[0055] f(person+point, point+device, person+credential)=device+credential Formula 3.

[0056] S3. Data processing using the authorization analysis model:

[0057] It needs to be divided into three situations: adding data, modifying data, and deleting relational data. The specific data processing process is:

[0058] When adding new relational data, the corresponding AR data is added and marked as valid, and the corresponding FD data is generated and marked as authorized; the newly added relational data is grouped into person data, point data, person group data and point group data, and is not analyzed but only saved in the unit storage unit;

[0059] When modifying relational data, such as modifying an employee's name, work number, credentials, etc., the corresponding AR data is added and marked as valid, and the corresponding FD data is generated and marked as authorized;

[0060] When deleting relationship data, the corresponding AR data is marked as invalid, and the corresponding FD data is marked as unauthorized; the corresponding relationship data between people and people groups, points and point groups are deleted without analysis.

[0061] By using the authorization analysis model constructed in this embodiment, the final permission download and authorization data query can be performed, that is, the FD data is the direct data source for permission download.

[0062] Different devices support different download methods and data contents. Some devices require a one-time download of all permissions, some require a single download by person, and some require a single download by credentials, etc. Permission data can be downloaded in a variety of ways, namely, a unified single download method, a batch download method for the same person and device, a full coverage download method, or a download method for third-party docking push method.

[0063] The single download method includes single download by person or single download by credentials;

[0064] The full coverage download methods include full coverage download by [person + device] or full coverage download by device;

[0065] The download methods for the third-party push method include pushing to the third party according to [person+point] or pushing to the third party according to [person+device+point].

[0066] The present invention can also realize the merging of multiple authorization times, as shown in the attached Figure 4 As shown, if there are multiple authorizations of [person+point] or [person group+point] or [person+point group] or [person group+point group], the authorization time can be merged.

[0067] At the same time, after the present invention authorizes the human group, when a person is added or removed from the human group, the permissions of the person are automatically generated, downloaded or deleted; after the point group is authorized, when a new point is added or a point is removed from the point group, the permissions involved in the point are automatically generated, downloaded or deleted; after the point is authorized, when a device associated with the point is added or removed, permissions for the newly added device are automatically generated and downloaded, and permissions for the removed device are automatically deleted.

[0068] Application Examples

[0069] Assume that a factory has applied the Internet of Things system, and the human resources department adds 10 new employees, that is, 10 pieces of personal data are added to the people group data. Using the authorization analysis model constructed by the present invention, the business data of the enterprise has been disassembled into refined granularity permission data of the [people + equipment + point] dimension. While adding people data to the people group data, the corresponding changes in the permission data of the [people + equipment + point] dimension are realized, without the need to analyze and authorize the newly added personnel one by one. For example, three pieces of equipment in the production department of the enterprise are damaged and need to be replaced. The original equipment data is deleted in the point data, and the new equipment data is added, and the corresponding changes in the permission data of the [people + equipment + point] dimension are realized at the same time.

Claims

1. A method for processing permission data in the Internet of Things industry, implemented by means of a CPU, a dedicated storage unit with a task set, and a data processing module, characterized in that: The steps include: S1. Establish a database: collect business data of the Internet of Things industry and reclassify it into human data, human group data, point data, point group data, human-human group relationship data, point-point group relationship data, point-device relationship data, and authorization data, and build corresponding data sets; S2. Build an authorization analysis model: Analyze the data set and break it down into detailed permission data in the dimensions of [person+point+device], including: S2-1. Authorization data analysis: the authorization data is decomposed into data of [person+point+authorization] dimension and data of [person group+point+authorization] and [person+point group+authorization] dimensions; wherein the data of [person+point+authorization] dimension is recorded as AR data, and the data of [person group+point+authorization] and [person+point group+authorization] dimensions are recorded as AGR data; S2-2, Person-to-person group relationship data analysis: Find all corresponding AGR data according to the person group, and then combine the person-to-person group relationship data to convert the AGR data into AR data; S2-3, point and point group relationship data analysis: find all corresponding AGR data according to the point group, and then combine the point and point group relationship data to convert the AGR data into AR data; S2-4. Obtaining authorized analysis model through AR data analysis or point and device relationship data analysis: The AR data analysis is to combine the point and device relationship data, and decompose the AR data into refined granularity permission data of [person+device+point] dimensions, recorded as FD data; The point and device relationship data analysis is to combine AR data and decompose the point and device relationship data into refined granularity permission data of [person+device+point] dimensions, recorded as FD data; S3. Data processing using the authorization analysis model: It is divided into three situations: adding data, modifying data, and deleting relational data. The specific data processing process is as follows: When adding new relational data, the corresponding AR data is added and marked as valid, and the corresponding FD data is generated and marked as authorized; the newly added relational data is grouped into person data, point data, person group data and point group data, and is not analyzed but only saved in the unit storage unit; When modifying relational data, the corresponding AR data is added and marked as valid, and the corresponding FD data is generated and marked as authorized; When deleting relationship data, the corresponding AR data is marked as invalid, and the corresponding FD data is marked as unauthorized; the corresponding relationship data between people and people groups, points and point groups are deleted without analysis.

2. According to claim 1, a method for processing Internet of Things industry authority data is characterized in that: The business data of the Internet of Things industry is divided into access control business data, consumption business data, visitor business data, elevator control business data and other business data according to the business attributes of the Internet of Things industry.

3. The method for processing Internet of Things industry authority data according to claim 2, characterized in that: The other business data mentioned are authorization-related business data in the Internet of Things industry that cannot be classified into the five categories of access control business data, consumer business data, visitor business data, and elevator control business data, including conference room reservation authorization and door lock authorization.

4. The method for processing Internet of Things industry authority data according to claim 1, characterized in that: The authorization data is divided into authorization data of a person and a point, authorization data of a person group and a point, authorization data of a person and a point group, and authorization data of a person group and a point group.

5. The method for processing Internet of Things industry authority data according to claim 1, characterized in that: The human data includes personnel name, work number and credential data.

6. A method for processing Internet of Things industry authority data according to claim 5, characterized in that: The refined granular permission data of [person+device+point] in steps S2-4 is further decomposed into the final permission data of [credential+device+point] dimension.

Images