Authority control method, system and equipment for fine-grained multi-dimensional configuration and medium

Abstract

The invention provides a fine-grained multi-dimensional configuration permission control method and system, electronic equipment and a storage medium, and aims to solve the problem that permission division cannot meet fine-grained permission control requirements, the method comprises the following steps: on the basis of an RBAC model, adding organization elements, and adding an organization structure hierarchical relationship, the relationship between the organization structure and the content of each part in the model is obtained; a dynamic role allocation and role inheritance mechanism is introduced, the inheritance relation between roles is specified when the roles are defined, so that the child-class roles can inherit the permission set of the parent-class roles, and permission expansion is carried out; performing permission configuration, performing cross organization on the function permission and the data permission, then distributing the function permission and the data permission to corresponding organization roles, ensuring that each organization role has the basic permission, and expanding private permissions for the organization roles according to different business requirements; the organization roles are distributed to the users, so that authority distribution of the users is realized. According to the invention, validity and timeliness of authority management can be ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of network and information security technologies, and specifically relates to a fine-grained multi-dimensional configuration-based permission control method, a fine-grained multi-dimensional configuration-based permission control system, an electronic device, and a computer-readable storage medium. Background Art

[0002] In the context of the continuous development of modern information technology, permission control plays a crucial role in various systems and platforms and is one of the core technologies in the field of information security. Especially in large enterprise-level applications, with the complication of business logic and the explosion of data volume, the importance of permission control becomes even more prominent.

[0003] RBAC (Role-Based Access Control) is role-based access control

[0004] model, which is an access control mechanism widely used in information technology (IT) security. In the RBAC model, users are associated with roles, and roles are associated with permissions. A user can have multiple roles, and a role can be shared by multiple users. Permissions are associated with roles. When a certain role is granted a certain permission, all users associated with that role have that permission. This design makes permission management more efficient and flexible because administrators only need to manage the correspondence between roles and permissions, rather than setting permissions for each user individually.

[0005] However, the traditional RBAC model gradually exposes some problems in practical applications. First, with the development and change of business, the number of roles is often too large, resulting in complex and inflexible authorization management. Second, the division of functional permissions and data permissions in the RBAC model is often relatively rough and cannot meet the requirements of fine-grained permission control. This may lead to users being able to access or operate data and functions beyond their scope of responsibility, thus triggering security risks such as data leakage or misoperation. Summary of the Invention

[0006] In order to at least solve the problems in the prior art that the permission division cannot meet the requirements of fine-grained permission control, is not flexible enough in dealing with the dynamic adjustment of role permissions, and cannot quickly adapt to the changes in organizational structure and business logic. The present disclosure provides a fine-grained multi-dimensional configuration-based permission control method, a fine-grained multi-dimensional configuration-based permission control system, an electronic device, and a computer-readable storage medium; through a multi-dimensional configuration method, the flexibility of permission management is enhanced, and the access permissions of users to data and functions can be controlled more precisely; it can also adapt to the development and change of business in real time to ensure the effectiveness and timeliness of permission management.

[0007] In a first aspect, the present disclosure provides a fine-grained multi-dimensional configured permission control method, the method comprising:

[0008] Based on the RBAC model, add organizational elements, and incorporate the organizational structure hierarchy, as well as the relationships between the organizational structure and various parts of the RBAC model;

[0009] Introduce a dynamic role assignment and role inheritance mechanism, specify the inheritance relationship between roles when defining roles, enabling sub-class roles to automatically inherit the permission set of the parent class role and be able to expand permissions on the basis of inheritance;

[0010] Perform permission configuration, cross-organize functional permissions and data permissions and assign them to corresponding organizational roles, ensuring that each organizational role has the basic permissions required for it to perform its duties, and expand private permissions for it according to different business needs;

[0011] After performing permission configuration on the organizational roles, achieve permission assignment to users by assigning the organizational roles to users.

[0012] Further, the method further comprises:

[0013] Perform division of functional permissions: Identify functional modules in the system, including order management, user management, report management, and determine the operation permissions under each functional module;

[0014] Perform division of data permissions: Divide the data scope according to business rules or organizational structure, including department data, project data, and personal data.

[0015] Further, the method further comprises:

[0016] When performing permission configuration, through NLP (Natural Language Processing) and the Apriori machine learning algorithm, achieve intelligent parsing of permission rules and generation of recommended permission configurations, so as to perform permission configuration for organizational roles in various business scenarios according to the generated recommended permission configurations.

[0017] Further, the achieving of intelligent parsing of permission rules and generation of recommended permission configurations through NLP and the Apriori machine learning algorithm includes:

[0018] Dataset collection and collation: Collect operation permissions, historical permission configuration data, and business scenario description texts in different business scenarios;

[0019] Text processing and feature extraction: Perform word segmentation on the collected business scenario description texts, perform part-of-speech tagging on the results of word segmentation, and extract keywords according to part-of-speech tagging and business requirements;

[0020] Data conversion and association construction: Convert historical permission configuration data into a transaction format suitable for processing by the Apriori algorithm, and associate the keywords extracted from the business scenario description text with the corresponding permission configuration transactions to obtain a transaction dataset;

[0021] Apriori algorithm calculation: Calculate frequent item sets based on the transaction dataset. For the found frequent item sets, set a minimum confidence threshold, calculate the confidence, and generate association rules;

[0022] Recommendation permission configuration generation: Output the generated association rules, and generate recommended permission configurations according to the business scenario and the association rules.

[0023] Further, the calculating of the frequent item sets, for the found frequent item sets, setting a minimum confidence threshold, calculating the confidence, and generating the association rules includes

[0024] Define a minimum support threshold, and realize the filtering effect of item sets by retaining the item sets that meet the minimum support threshold;

[0025] Use the Apriori algorithm to scan the transaction dataset and calculate the support of each item set;

[0026] Start from a single permission item, gradually combine it into a set of multiple permission items, and at the same time use the Apriori property for pruning to remove the item sets that do not meet the minimum support threshold. Through continuous iteration, calculate frequent item sets of different lengths;

[0027] For the found frequent item sets, set a minimum confidence threshold, and generate association rules by calculating the confidence;

[0028] Filter out the association rules that meet the minimum confidence threshold to show the potential relationships between permissions, business scenarios, and organizational roles.

[0029] Further, the method further includes:

[0030] Evaluate the generated recommended permission configurations;

[0031] According to the evaluation results, adjust the parameters in the text processing steps to improve the accuracy of text processing and the effectiveness of feature extraction; and,

[0032] Optimize the parameters of the Apriori algorithm and re-run the algorithm to generate new recommended permission configurations.

[0033] Further, the method further includes:

[0034] Conduct functional permission division: Identify the functional modules in the system, including order management, user management, and report management, and determine the operation permissions under each functional module;

[0035] Conduct data permission division: Divide the data scope according to business rules or organizational structure, including department data, project data, and personal data.

[0036] In a second aspect, the present disclosure provides a fine-grained multi-dimensional configuration permission control system, which includes:

[0037] An organizational element addition module, which is set to add organizational elements on the basis of the RBAC model, add the organizational structure hierarchical relationship, and the relationship between the organizational structure and each part of the RBAC model;

[0038] An introduction module, which is set to introduce a dynamic role assignment and role inheritance mechanism, specify the inheritance relationship between roles when defining roles, so that the subclass roles can automatically inherit the permission set of the parent class roles, and can expand permissions on the basis of inheritance;

[0039] A permission configuration module, which is set to perform permission configuration, cross-organize functional permissions and data permissions and assign them to corresponding organizational roles, ensure that each organizational role has the basic permissions required for it to perform its duties, and expand private permissions for it according to different business needs;

[0040] An assignment module, which is set to assign permissions to organizational roles and then assign organizational roles to users to achieve permission assignment for users.

[0041] Furthermore, the permission configuration module is also set to;

[0042] When performing permission configuration, through NLP and Apriori machine learning algorithms, realize the intelligent parsing of permission rules and the generation of recommended permission configurations, and configure permissions for organizational roles in each business scenario according to the generated recommended permission configurations.

[0043] Furthermore, the permission configuration module is specifically set to:

[0044] Dataset collection and collation: Collect operation permissions, historical permission configuration data, and business scenario description texts under different business scenarios;

[0045] Text processing and feature extraction: Perform word segmentation on the collected business scenario description texts, perform part-of-speech tagging on the results of word segmentation, and extract keywords according to part-of-speech tagging and business requirements;

[0046] Data Conversion and Association Construction: Convert historical permission configuration data into a transaction format suitable for processing by the Apriori algorithm, and associate the keywords extracted from the business scenario description text with the corresponding permission configuration transactions to obtain a transaction dataset;

[0047] Apriori Algorithm Calculation: Calculate frequent item sets based on the transaction dataset. For the found frequent item sets, set a minimum confidence threshold, calculate the confidence, and generate association rules;

[0048] Recommended Permission Configuration Generation: Output the generated association rules, and generate recommended permission configurations according to the business scenario and the association rules.

[0049] In a third aspect, the present disclosure provides an electronic device, including a memory and a processor. A computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the fine-grained multi-dimensional configuration permission control method as described in any one of the first aspects.

[0050] In a fourth aspect, the present disclosure provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the fine-grained multi-dimensional configuration permission control method as described in any one of the first aspects is implemented.

[0051] Beneficial Effects:

[0052] The fine-grained multi-dimensional configuration permission control method, fine-grained multi-dimensional configuration permission control system, electronic device and storage medium provided by the present disclosure; by introducing a dynamic role assignment and role inheritance mechanism, the number of roles is effectively reduced, the authorization management process is simplified, and at the same time, the flexibility and scalability of role management are improved to adapt to the rapid development and changes of enterprise business. On the basis of functional permissions and data permissions, the permission granularity is further refined to ensure that users can only access or operate data and functions closely related to their responsibilities, thereby effectively preventing security risks such as data leakage and misoperation. The subclass role automatically inherits the public permissions of the parent class and can expand private permissions to meet specific needs to simplify permission management. Cross-departmental and personnel flow situations can be flexibly handled by adjusting the role inheritance relationship. Description of the Drawings

[0053] Figure 1 It is a schematic flowchart of a fine-grained multi-dimensional configuration permission control method provided by Embodiment 1 of the present disclosure;

[0054] Figure 2 It is a schematic diagram of an OS-RBAC model architecture provided by an embodiment of the present disclosure;

[0055] Figure 3A schematic diagram of a tree - shaped organizational structure and corresponding role levels provided by an embodiment of the present disclosure;

[0056] Figure 4 A schematic diagram of a fine - grained permission control mechanism provided by an embodiment of the present disclosure;

[0057] Figure 5 A schematic diagram of an intelligent rule recommendation and generation process provided by an embodiment of the present disclosure;

[0058] Figure 6 A schematic diagram of an Apriori algorithm process provided by an embodiment of the present disclosure;

[0059] Figure 7 A schematic diagram of the overall process of a fine - grained multi - dimensional configuration permission control method provided by the second embodiment of the present disclosure;

[0060] Figure 8 An architecture diagram of a fine - grained multi - dimensional configuration permission control system provided by the third embodiment of the present disclosure;

[0061] Figure 9 An architecture diagram of an electronic device provided by the fourth embodiment of the present disclosure. Detailed implementation manners

[0062] To enable those skilled in the art to better understand the technical solutions of the present disclosure, the present disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are only for explaining the present invention, rather than limiting the present invention.

[0063] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above - mentioned drawings are used to distinguish similar objects, and do not necessarily need to describe a specific order or sequence; and, without conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other arbitrarily.

[0064] Among them, the terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments, rather than aiming to limit the present disclosure. The singular forms of "a", "the", and "said" used in the embodiments of the present disclosure and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0065] In subsequent descriptions, the suffixes such as "module", "component", or "unit" used to represent elements are only for the convenience of the description of the present disclosure, and have no specific meaning in themselves. Therefore, "module", "component", or "unit" can be used interchangeably.

[0066] The following first briefly introduces the relevant concepts or technologies that may be involved in the embodiments of the present application:

[0067] Natural Language Processing (NLP) technology, as a key branch in the field of artificial intelligence, focuses on endowing computers with the ability to parse, understand, and generate human language. Its core lies in the skillful application of geometric and statistical methods to process natural language. By means of probability-based algorithms, natural language is converted into an analyzable format. For example, with the jieba word segmentation tool, Chinese text can be efficiently segmented into words, splitting continuous sentences into meaningful lexical units, laying a foundation for subsequent analysis. HanLP, on the other hand, provides rich functions. In the information extraction process, for instance, it can perform syntactic analysis on the text to determine the sentence structure and the grammatical relationships between words, while also conducting semantic analysis to deeply explore the inherent meaning of the text, thus enabling the accurate extraction of structured information from the text.

[0068] The Apriori algorithm is the first association rule mining algorithm and one of the most classical algorithms. It uses an iterative method of level-wise search to find the relationships among item sets in a database to form rules. The core idea of the Apriori algorithm is to mine frequent item sets through two stages: candidate set generation and downward closure detection of episodes. It first finds all frequent sets, where the frequency of these item sets is at least as high as the predefined minimum support. Then, strong association rules are generated from the frequent sets, and these rules must satisfy the minimum support and minimum confidence. The Apriori algorithm adopts an iterative method of level-wise search and gradually generates and evaluates candidate item sets through joining (similar to matrix operations) and pruning (removing unnecessary intermediate results), thereby effectively finding frequent item sets and association rules in the data.

[0069] The Role-Based Access Control (RBAC) model mainly distributes permissions through three core factors: users, roles, and resources, that is, one or more roles are assigned to users, and different roles can access or operate different resources. This method effectively separates users from resources, improving the flexibility and security of permission management. However, some problems have gradually emerged in the practical application of the traditional RBAC model. First, with the development and changes of business, the number of roles often becomes too large, resulting in complex and inflexible authorization management. Second, the RBAC model is often rather rough in the division of functional permissions and data permissions and cannot meet the requirements of fine-grained permission control. This may lead to users being able to access or operate data and functions beyond their scope of duties, thereby triggering security risks such as data leakage or misoperations.

[0070] To overcome the above deficiencies of the traditional RBAC model, the industry has begun to explore more advanced permission control methods. Through retrieval, it is found that although some solutions attempt to introduce some new elements to optimize permission management, there are still deficiencies in fine-grained control, intelligent configuration, and coping with changes in complex business scenarios. For example, some solutions are not flexible enough when dealing with the dynamic adjustment of role permissions and cannot quickly adapt to changes in organizational structure and business logic; during the permission configuration process, there is a lack of effective means to lower the technical threshold, making it difficult for non-technical personnel to participate and resulting in low efficiency.

[0071] The following uses specific embodiments to elaborate in detail on the technical solutions of the present disclosure and how the technical solutions of the present disclosure solve the technical problems existing in the prior art. It can be understood that in the embodiments of the present application, the execution subject can execute some or all of the steps in the embodiments of the present application. These steps or operations are only examples, and the embodiments of the present application can also execute other operations or various deformations of the operations. In addition, each step can be executed in a different order presented in the embodiments of the present application, and it is possible that not all the operations in the embodiments of the present application need to be executed. Moreover, the following several specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0072] Figure 1 It is a schematic flowchart of a permission control method with fine-grained multi-dimensional configuration provided in Embodiment 1 of the present disclosure, as Figure 1 shown, the method includes:

[0073] Step S101: On the basis of the RBAC model, add organizational elements, and add the hierarchical relationship of the organizational structure, as well as the relationship between the organizational structure and each part of the RBAC model;

[0074] Step S102: Introduce a dynamic role assignment and role inheritance mechanism, specify the inheritance relationship between roles when defining roles, so that the subclass roles can automatically inherit the permission set of the parent class roles and can expand permissions on the basis of inheritance;

[0075] Step S103: Perform permission configuration, cross-organize functional permissions and data permissions and assign them to the corresponding organizational roles, ensure that each organizational role has the basic permissions required for it to perform its duties, and expand private permissions for it according to different business needs;

[0076] Step S104: After performing permission configuration on the organizational roles, assign the organizational roles to users to achieve permission assignment for users.

[0077] The core points of the fine-grained multi-dimensional configuration permission control method provided by the embodiments of the present disclosure mainly lie in: the effectiveness of permission management and the efficiency of permission configuration. First of all, the effectiveness of permission management is the key to ensuring data security and business flexibility, which requires the system to introduce more detailed and multi-dimensional rule configurations, enabling the system to flexibly define and expand permission rules according to multiple dimensions such as different business scenarios, user roles, and data attributes. Secondly, the efficiency of permission configuration is the key to reducing the burden on staff and improving work efficiency. During the permission configuration process, staff need to face complex rule systems and multi-dimensional considerations, which often make the configuration work time-consuming and error-prone.

[0078] Based on this, this method introduces a new permission configuration idea, introducing more detailed and multi-dimensional rule configurations, enabling the system to adapt to different business scenarios. On the basis of functional permissions and data permissions, the permission granularity is further refined to ensure that users can only access or operate data and functions closely related to their responsibilities. At the same time, considering the personnel scheduling problem between departments and organizations, this method also simplifies the permission change configuration by automatically inheriting the parent class permissions (public) of the subclass role to meet specific needs. This multi-dimensional configuration method not only greatly enhances the flexibility of permission management but also enables the system to more precisely control users' access permissions to data and functions, thus effectively avoiding the risks of permission abuse and data leakage.

[0079] Specifically, the embodiments of the present disclosure have made certain improvements on the traditional role-based access control (RBAC) model, called the OS-RBAC (Organization-Based Role-Based Access Control) model, as As shown. In this model, the organization usually presents a tree structure, which is a hierarchical management mode. It contains a root node (usually representing the highest management level or the core department), from which multiple branch nodes (representing each level of management or sub-departments) extend downwards. Each branch node can be further divided into smaller branches until reaching the leaf nodes at the end (representing specific execution positions or individuals). Based on the depth (hierarchy) of the tree structure, role hierarchy relationships are added to each layer, that is, the lower the layer, the lower its role hierarchy. At the same time, as an extended version of RBAC, the OS-RBAC model covers all the functions of RBAC, such as role hierarchy relationships and separation of duties. In addition, it further adds the organizational structure hierarchy relationship and the relationship between the organizational structure and each part of the RBAC model. The organizational structure refers to the hierarchical relationship within an organization. The organizational structure hierarchy relationship is used to limit the scope of users, roles, and permissions to ensure that the permission assignment conforms to the actual needs of the organization. The organizational structure is closely integrated with each part of the RBAC model (users, roles, permissions). Users belong to a certain organizational structure, and user permissions are restricted by the organizational structure; roles are bound to the organizational structure, and each role must be associated with one or more organizational structures; role permissions are restricted by the organizational structure, and the scope of role permissions cannot exceed the permission scope of its affiliated organization; the scope of permissions is restricted by the organizational structure: the scope of action of permissions cannot exceed the resource scope of its affiliated organization. There is a difference between the organizational structure hierarchy and the role hierarchy. The role hierarchy focuses on the permission relationship between roles, while the organizational structure hierarchy starts from the organizational perspective to ensure that user permissions are within a reasonable range of their respective organizations;

[0080] OS-RBAC introduces the hierarchical relationship of the organizational structure, restricting user permissions within the scope of their affiliated organizations. The organizational structure describes the hierarchical relationship of the organization, such as departments, teams, subsidiaries, etc. Each user belongs to one or more organizational structures, and the permission assignment is restricted by the organizational structure. User A belongs to the "Finance Department" and can only access resources related to the Finance Department. User B belongs to the "Technical Department" and can only access resources related to the Technical Department. Roles can be bound to the organizational structure to ensure that role permissions are effective within the organization. For example: The role of "Finance Manager" can only be assigned to users in the "Finance Department".

[0081] As Figure 2 shown, by adding an organizational element to the original three elements of users, roles, and resources, a multi-dimensional role assignment system is formed. With the organic combination of the organizational structure and roles, when the system administrator assigns permissions, they only need to consider the position and position of employees within the organization, greatly simplifying the work process. This multi-dimensional management method makes permission management more flexible and can quickly adapt to the development and changes of enterprise business.

[0082] The embodiments of the present disclosure also perform fine-grained rule configuration and extension, including:

[0083] 1. Inheritance and extension of role permissions:

[0084] In the role - based access control method, roles are usually regarded as entities with a fixed set of permissions, which provide users in the system with permissions to access specific resources. However, this embodiment improves on this traditional framework and allows developers to flexibly specify the inheritance relationship between roles when defining roles. This inheritance mechanism greatly simplifies the complexity of permission management because sub - class roles can automatically inherit the permission set of the parent - class role, which is called "common permissions". This design makes permission management more modular, avoids duplicate definition of the same permissions, and also makes the update and maintenance of permissions easier. Through role inheritance, the embodiments of the present disclosure can ensure the consistency of permission allocation throughout the system and reduce the security risks caused by incorrect permission configuration.

[0085] In addition, the embodiments of the present disclosure not only support permission inheritance between roles but also allow permission extension based on inheritance. Sub - class roles can add some specific permissions, called "private permissions", on the basis of inheriting the permissions of the parent - class role. This design enables sub - class roles to meet the requirements of specific business scenarios without unnecessary modification of the parent - class role. This flexible permission extension mechanism enables this method to well adapt to the actual needs of different business scenarios. Moreover, for complex situations such as cross - department and personnel mobility, the system administrator can directly remove the existing organizational roles of personnel and inherit the basic permissions of the superior personnel role and add the private permissions of the new department for them, thus realizing rapid adjustment of permissions. This design enables this method to well cope with the challenges of changes in enterprise organizational structure and personnel mobility.

[0086] 2. Fine - grained permission control

[0087] Generally, permission control mainly includes two parts: function permissions and data permissions. Among them, function permissions define the operations that users can perform on the application system, covering operations such as directories, menus, and buttons; data permissions, on the other hand, limit the data sets that users can view and operate on when running functions. The role-based access control model is often relatively rough in the division of function permissions and data permissions and cannot meet the requirements of fine-grained permission control. This may lead to users being able to access or operate data and functions beyond their scope of responsibility, thereby triggering security risks such as data leakage or misoperations. The embodiments of the present disclosure adopt a method of interleaving and combining function permissions and data permissions to achieve extremely refined management of user access and operation permissions. This fine-grained permission control mechanism has significant advantages compared with the traditional coarse-grained permission management method. Specifically, function permissions mainly control what operations users can perform, such as viewing, editing, deleting, etc., while data permissions determine which specific data users can access. After dividing these two types of permissions according to different dimensions and then combining them, the "new element" constructed in step one - the organizational role is then embedded in it, as Figure 3 shown. The method convention only allows authorizing organizational roles and then assigning organizational roles to users, and does not allow directly assigning permissions to users. This fine-grained permission control mechanism not only ensures that each user can only access the data and functions within their scope of responsibility, thus avoiding the disorderly flow of information and potential leakage risks, but also effectively prevents problems such as data corruption or loss caused by misoperations.

[0088] To more clearly explain how fine-grained permission control binds function permissions and data permissions, the following describes it by taking a specific business scenario in the existing system as an example. The main steps are as follows: (1) Division of function permissions: First, identify the function modules in the system, such as order management, user management, report management, etc. Second, determine the operation permissions under each function module, such as query, add, modify, delete, etc. (2) Division of data permissions: Divide the data scope according to business rules or organizational structures, such as department data, project data, personal data, etc. (3) Definition of organizational roles: Embed the "new element" constructed in step one above - the organizational role, and define different organizational roles according to the organizational structure and role hierarchy in step one above, where each organizational role should clearly define its scope of responsibility and required permissions. (4) Permission assignment: Cross-organize function permissions and data permissions and assign them to the corresponding organizational roles, ensuring that each organizational role has the minimum permissions (basic permissions) required to perform its duties, and expand private permissions for it according to different business needs. (5) Permission configuration: Finally, the administrator configures the permission control rules in the system background to ensure that each user can only access and operate the data and functions they are authorized to, and during the configuration process, carefully check the correctness of the permission division and organizational role assignment.

[0089] Embodiments of the present disclosure effectively reduce the number of roles, simplify the authorization management process, and improve the flexibility and scalability of role management by introducing dynamic role assignment and role inheritance mechanisms to adapt to the rapid development and changes of enterprise business. Based on functional permissions and data permissions, the permission granularity is further refined to ensure that users can only access or operate data and functions closely related to their responsibilities, thereby effectively preventing security risks such as data leakage and misoperation. The permission management is simplified by automatically inheriting the common permissions of the parent class for subclass roles and allowing the extension of private permissions to meet specific requirements. This enables flexible responses to cross-departmental and personnel mobility situations by adjusting role inheritance relationships.

[0090] Furthermore, the method further includes:

[0091] When performing permission configuration, through NLP and Apriori machine learning algorithms, intelligent parsing of permission rules and generation of recommended permission configurations are achieved to configure permissions for organizational roles in various business scenarios based on the generated recommended permission configurations.

[0092] Existing permission control systems generally have the problems of complex and frequent configuration rules. Especially when facing the same business scenario, repeated configurations are often required, which greatly reduces the efficiency of permission management, increases the system management cost, and is also prone to introducing security risks due to human operation errors. To effectively overcome the above problems, embodiments of the present disclosure, based on introducing new permission configuration ideas and combined with the assistance of artificial intelligence algorithms, achieve intelligent parsing and recommended configuration of permission rules through artificial intelligence technologies such as natural language processing (NLP) and machine learning algorithms. The permission requirement text is parsed by NLP to extract key information, and then the Apriori algorithm is used to mine the association rules between permissions to generate recommended permission configurations. Specifically, by extracting historical permission configurations and business scenario information, the collected relevant data information is segmented, extracted, and understood, and through relevant algorithms such as machine learning, key information such as user access behavior, business requirements, and data attributes is automatically analyzed, and then permission rules are intelligently generated to provide certain rule references for permission configuration staff. This intelligent configuration method not only reduces the complexity and workload of manual permission configuration but also enables the system to adapt to the development and changes of business in real time, ensuring the effectiveness and timeliness of permission management.

[0093] By introducing new permission configuration ideas and the assistance of artificial intelligence algorithms, it is possible to effectively respond to the rapid development and changes of enterprise business, further improve the efficiency and accuracy of permission configuration, and reduce the error rate; make the permission configuration work easier and more accurate. It can also lower the technical threshold, enabling non-technical personnel to easily participate in permission management.

[0094] Furthermore, the intelligent parsing of permission rules and the generation of recommended permission configurations are realized through NLP and the Apriori machine learning algorithm, including:

[0095] Dataset collection and collation: Collect operation permissions, historical permission configuration data, and business scenario description texts under different business scenarios;

[0096] Text processing and feature extraction: Perform word segmentation on the collected business scenario description texts, perform part-of-speech tagging on the results of word segmentation, and extract keywords according to part-of-speech tagging and business requirements;

[0097] Data conversion and association construction: Convert historical permission configuration data into a transaction format suitable for the Apriori algorithm, and associate the keywords extracted from the business scenario description texts with the corresponding permission configuration transactions to obtain a transaction dataset;

[0098] Apriori algorithm calculation: Calculate frequent item sets based on the transaction dataset. For the found frequent item sets, set a minimum confidence threshold, calculate the confidence, and generate association rules;

[0099] Generation of recommended permission configurations: Output the generated association rules, and generate recommended permission configurations according to business scenarios and association rules.

[0100] The intelligent rule configuration of the embodiments of the present disclosure allows users to customize business logics on the general permission framework and save these customized logics as templates. This function enables users to quickly and flexibly configure permission rules according to specific business requirements, thereby reducing the complexity and time cost of permission management. In addition, predefined permission templates are provided for common scenarios and dimensions. Users can apply or modify these templates with one click according to actual needs, further simplifying the permission configuration process.

[0101] When a new business scenario emerges, through artificial intelligence technologies such as natural language processing (NLP) and machine learning algorithms, intelligent parsing and recommended configuration of permission rules can be achieved. First, historical permission configuration data is collected and preprocessed through NLP technology. The Apriori algorithm in machine learning is used to analyze the historical permission configuration data. The Apriori algorithm scans the data set, generates candidate item sets, prunes, and iterates repeatedly to mine frequent item sets and association rules, and generates corresponding recommended permission configurations. When non-technical personnel configure permissions for a new business scenario, they can directly enter a natural language expression in the dialog box. Next, the NLP technology is used to process the text of this business scenario (word segmentation, keyword extraction, etc.), and then rules matching these keywords are searched in the generated association rules. These suggestions can not only help developers configure and optimize permission rules faster, but also reduce permission conflicts and improve the accuracy and efficiency of permission allocation. Specifically, as Figure 4 shown, the intelligent rule recommendation and generation process includes the following links:

[0102] (1) Dataset collection and collation:

[0103] (1) Business scenario collection

[0104] An enterprise has multiple departments, each with different job responsibilities and business processes. The system records the operation permissions of employees in different business scenarios. For example: Employees in Department A need permissions such as viewing customer information, product information, creating sales orders, and submitting contract approvals when negotiating cooperation with customers. Employees in Department B need permissions such as accessing market research reports, editing event planning documents, and applying for event budgets when planning events. Employees in Department C need permissions such as obtaining project requirement documents, modifying code, submitting test applications, and viewing test reports when developing projects.

[0105] (2) Dataset collection

[0106] Collect historical permission configuration data from the enterprise's permission management database. Each record contains information such as the employee's department, position, and operation permissions. For example: Employee {Zhang San}, organizational role {Sales representative in the sales department}, permissions {View customer information, create sales orders, submit contract approvals}. Employee {Li Si}, organizational role {Marketing specialist in the marketing department}, permissions {Access market research reports, edit event planning documents, apply for event budgets}. Employee {Wang Wu}, organizational role {Software engineer in the R & D department}, permissions {Obtain project requirement documents, modify code, submit test applications}.

[0107] Collect business scenario description texts, which can be from employees' operation logs, remarks in project documents, department business process descriptions, etc. For example: "Sales representative Zhang San negotiates cooperation with customer ABC Company and needs to view the customer's past order records to formulate a cooperation plan." "Marketing specialist Li Si plans a new product promotion activity and refers to the competitor analysis section in the market research report." "Software engineer Wang Wu fixes bugs in Project X and modifies relevant code modules."

[0108] (2) Text Processing and Feature Extraction

[0109] (1) Jieba Word Segmentation

[0110] Perform word segmentation on the collected business scenario description texts. For example, for the sentence "Sales representative Zhang San negotiates cooperation with customer ABC Company and needs to view the customer's past order records to formulate a cooperation plan.", after Jieba word segmentation and removing stop words (such as commonly used words like "and", "to", etc. that are not very helpful for semantic analysis), a more meaningful sequence of words can be obtained: "Sales representative", "Zhang San", "Customer", "ABC", "Company", "Negotiate", "Cooperation", "View", "Customer", "Past", "Order record", "Formulate", "Cooperation plan".

[0111] (2) HanLP Part-of-Speech Tagging

[0112] Perform part-of-speech tagging on the word-segmented results. For example: "Sales representative / NN" (noun), "Zhang San / NR" (person name), "Customer / NN" (noun), "ABC / NN" (noun), "Company / NN" (noun), "Negotiate / VV" (verb), "Cooperation / NN" (noun), "View / VV" (verb), "Customer / NN" (noun), "Past / AD" (adjective), "Order record / NN" (noun), "Formulate / VV" (verb), "Cooperation plan / NN" (noun). Perform named entity recognition to identify entities such as "Zhang San" (employee name), "ABC Company" (customer name), etc., further enriching the semantic information of the text.

[0113] (3) Keyword Extraction

[0114] Extract keywords according to part-of-speech tagging and business requirements. For example, in the above sales scenario, keywords can include "Sales representative", "Customer", "Negotiate cooperation", "View order record", etc., and these keywords will be used for subsequent correlation analysis with permission configuration data.

[0115] (3) Data Conversion and Association Construction

[0116] Convert the historical permission configuration data into a transaction format suitable for processing by the Apriori algorithm. Taking the permissions of employee Zhang San as an example, group his permissions to view customer information, create sales orders, and submit contract approvals into a transaction {view customer information, create sales orders, submit contract approvals}.

[0117] Associate the keywords extracted from the business scenario description text with the corresponding permission configuration transactions. For example, if the two keywords "sales representative" and "view order records" are extracted in a certain business scenario, and the employee permission transaction corresponding to this scenario is {view customer information, create sales orders, submit contract approvals}, then the keywords can be added to the transaction to get {view customer information, create sales orders, submit contract approvals, sales representative, view order records}.

[0118] (4) Apriori algorithm calculation

[0119] The Apriori algorithm is a classic algorithm for mining frequent item sets and association rules in a dataset, which can discover the frequent co-occurrence relationships between data items. It is based on the prior principle that all non-empty subsets of a frequent item set must also be frequent, and finds frequent item sets through a layer-by-layer search method. The main steps of the algorithm include scanning the dataset to calculate support, generating candidate item sets, pruning using the prior property, and generating association rules, which are widely used in scenarios for analyzing associated data. The specific process is as Figure 5 shown.

[0120] The calculation process described in the above figure is summarized as follows: (1) Scan all the data to generate candidate item set 1; (2) According to the minimum support, generate the set L of frequent 1-item sets from the set of candidate item set 1; (3) When the candidate item set is greater than 1, repeat steps (4), (5), and (6); (4) Perform join and pruning operations on the frequent item sets to generate the next candidate item set set; (5) According to the minimum support, generate the set of frequent (n + 1)-item sets from the next candidate item set set n; (6) If the frequent item set ≠ Ф, then n = n + 1, jump to step (4); otherwise, proceed; (7) Generate strong association rules from the frequent item sets according to the minimum confidence, and the program ends.

[0121] (5) Recommended permission configuration generation

[0122] Output the association rules output by the fourth link to form recommendations for permissions. When a new business scenario appears, for example, when an employee in the marketing department plans to carry out an online marketing activity, the permission configurator can directly enter "The marketing specialist plans to carry out an online marketing activity and needs to formulate a promotion strategy." in the dialog box. Next, use NLP technology to process the text of this business scenario (word segmentation, keyword extraction, etc.) to obtain keywords such as "marketing specialist", "online marketing activity", and "formulate a promotion strategy". Search for rules that match these keywords in the already generated association rules. For example, it may be possible to find association rules such as "marketing specialist -> access market research reports", "analyze target customer group data -> view customer analysis reports", etc. Then the recommended permissions may include "access market research reports" and "view customer analysis reports". Combine these recommended permissions to form a recommended permission configuration for the current business scenario and employee role. For example, the recommended permission configuration for the marketing specialist in this online marketing activity is: {query market research reports, query customer analysis reports}.

[0123] Further, for the found frequent item sets, set a minimum confidence threshold, calculate the confidence, and generate association rules, including

[0124] [[ID=:6]]Define a minimum support threshold, and achieve the filtering effect of item sets by retaining the item sets that meet the minimum support threshold;

[0125] Use the Apriori algorithm to scan the transaction data set and calculate the support of each item set;

[0126] Start from a single permission item, gradually combine them into a set of multiple permission items, and at the same time use the Apriori property for pruning to remove the item sets that do not meet the minimum support threshold. Through continuous iteration, calculate frequent item sets of different lengths;

[0127] For the found frequent item sets, set a minimum confidence threshold, and generate association rules by calculating the confidence;

[0128] Screen out the association rules that meet the minimum confidence threshold to show the potential relationship between permissions, business scenarios, and organizational roles.

[0129] Taking a specific business scenario as an example, the main process of the Apriori algorithm includes:

[0130] (1) Calculate frequent item sets

[0131] The more items that often appear together, the stronger the relationship between them. The commonly used evaluation criteria for frequent item sets are support, confidence, and lift. Support is the proportion of the number of occurrences of several associated data in the dataset to the total dataset. For three data X, Y, and Z whose association is to be analyzed, the corresponding support formula is as follows:

[0132]

[0133] Confidence reflects the probability that another data appears after one data appears, or the conditional probability of the data. If we have two data X and Y whose association is to be analyzed, the confidence formula of X for Y is as follows:

[0134]

[0135] For three data X, Y, and Z, the confidence formula of Y and Z for X is:

[0136]

[0137] Lift represents the ratio of the possibility of containing Y under the condition of containing X to the possibility of containing Y in the item set without this condition. This indicator, like confidence, is used to measure the reliability of the rule and can be regarded as a complementary indicator of confidence. That is, on the basis of the possibility P(Y) of Y appearing by itself, the degree of improvement of the "appearance rate" P(Y|X) of Y by the appearance of X, and its formula is:

[0138]

[0139] Generally speaking, data with high support does not necessarily form a frequent item set, but data with too low support definitely does not form a frequent item set. In addition, support is for item sets. Therefore, a minimum support threshold (such as 0.3) can be defined to retain only the item sets that meet the minimum support, playing a role in filtering item sets. Use the Apriori algorithm to scan the transaction dataset and calculate the support of each item set. For example, if "view customer information" appears in multiple sales-related transactions and its occurrence ratio reaches or exceeds 0.3, then "view customer information" is part of a frequent item set.

[0140] By continuous iteration, frequent item sets of different lengths are calculated. For example, starting from a single permission item, gradually combine them into a set of multiple permission items, such as {view customer information, create sales order}, {view customer information, create sales order, submit contract for approval}, etc. At the same time, use the Apriori property for pruning to remove item sets that do not meet the minimum support, reducing the calculation amount.

[0141] (2) Generate association rules

[0142] For the found frequent item sets, set a minimum confidence threshold (such as 0.6), calculate the confidence, and generate association rules. For example, if the frequent item set is {sales representative, view customer profile}, and in the transactions containing "sales representative", most of them also contain "view customer profile" at the same time, then the association rule "sales representative -> view customer profile" (with the confidence meeting the threshold requirement) can be generated. Filter out the association rules that meet the minimum confidence threshold, and these rules show the potential relationships between permissions, business scenarios, and organizational roles.

[0143] Furthermore, the method further includes:

[0144] Evaluate the generated recommended permission configuration;

[0145] According to the evaluation results, adjust the parameters in the text processing steps to improve the accuracy of text processing and the effectiveness of feature extraction; and,

[0146] Optimize the parameters of the Apriori algorithm and re-run the algorithm to generate a new recommended permission configuration.

[0147] Evaluating and optimizing the process of generating the recommended permission configuration according to the actual situation can make the recommended permission configuration more in line with the actual needs, ensuring the accuracy, efficiency, and practicality of the recommended results. Specifically, according to the evaluation results, adjust the parameters in the text processing steps, such as the custom dictionary of jieba segmentation (add specific business terms), stop word list, part-of-speech tagging and named entity recognition model parameters of HanLP, etc., to improve the accuracy of text processing and the effectiveness of feature extraction. Optimize the parameters of the Apriori algorithm, such as the minimum support and minimum confidence threshold. If the recommended results are too broad (including many irrelevant permissions), the threshold can be appropriately increased; if the recommended results are too conservative (missing some important permissions), the threshold can be appropriately decreased, and re-run the algorithm to generate a new recommended permission configuration.

[0148] The embodiments of the present disclosure introduce more detailed and multi-dimensional rule configurations, enabling the system to adapt to different business scenarios. On this basis, based on functional permissions and data permissions, the permission granularity is further refined to ensure that users can only access or operate data and functions closely related to their responsibilities. At the same time, considering the personnel scheduling problem between departments and organizations, this method also simplifies the permission change configuration by automatically inheriting the permissions (public) of the parent class by the subclass role to meet specific needs. This multi-dimensional configuration method not only greatly enhances the flexibility of permission management, but also enables the system to more precisely control users' access permissions to data and functions, thereby effectively avoiding the risks of permission abuse and data leakage; by introducing new permission configuration ideas and combining the assistance of artificial intelligence algorithms, it provides strong configuration support for staff, not only reducing the technical threshold, enabling non-technical personnel to easily participate in permission management, but also improving the configuration efficiency and accuracy, making the permission configuration work easier and more accurate.

[0149] To more clearly describe the technical solutions of the present disclosure, Embodiment 2 of the present disclosure also proposes a permission control method with fine-grained multi-dimensional rule configuration, as Figure 6 shown. This method mainly includes three steps: 1. Introduce multi-dimensional permission rules; 2. Fine-grained rule configuration and extension; 3. Intelligent rule recommendation and generation:

[0150] First of all, the embodiments of the present disclosure break through the limitations of traditional permission management methods and introduce more detailed and multi-dimensional rule configurations, enabling the system to adapt to different business scenarios. Based on functional permissions and data permissions, the permission granularity is further refined to ensure that users can only access or operate data and functions closely related to their responsibilities. At the same time, considering the personnel scheduling problem between departments and organizations, this method also simplifies the permission change configuration by automatically inheriting the permissions (public) of the parent class by the subclass role to meet specific needs. This multi-dimensional configuration method not only greatly enhances the flexibility of permission management, but also enables the system to more precisely control users' access permissions to data and functions, thereby effectively avoiding the risks of permission abuse and data leakage. Subsequently, historical permission configurations and business scenario information are extracted, the collected relevant data information is segmented, extracted, and understood, and through relevant algorithms such as machine learning, key information such as users' access behaviors, business requirements, and data attributes is automatically analyzed, and then permission rules are intelligently generated to provide certain rule references for permission configuration staff. This intelligent configuration method not only reduces the complexity and workload of manual permission configuration, but also enables the system to adapt to the development and changes of the business in real time, ensuring the effectiveness and timeliness of permission management. The detailed description of each step is as follows:

[0151] Step 1: Introduce multi-dimensional permission rules

[0152] The traditional Role-Based Access Control (RBAC) model mainly distributes permissions based on three factors: users, roles, and resources. Specifically, a system role is assigned to a user, and different system roles can access or operate different resources. By establishing a role system and separating users from resources, the implementation of permission distribution is ensured. However, the traditional RBAC model has problems such as an excessive number of roles, complex authorization management, and lack of flexibility in practical applications. It cannot well adapt to complex and ever-changing demand changes and always requires frequent changes to permission configurations and addition of new roles. Considering that the formulation of roles is usually closely related to the organizational structure, therefore, this embodiment introduces a new element, adding an organizational element to the original three elements of users, roles, and resources, forming a multi-dimensional role distribution system. This multi-dimensional management method makes permission management more flexible and can quickly adapt to the development and changes of enterprise business.

[0153] By making certain improvements to the traditional Role-Based Access Control (RBAC) model, it is called the OS-RBAC model, as Figure 7 shown. In this model, the organization usually presents a tree structure, which is a hierarchical management mode, including a root node (usually representing the highest management level or the core department), and multiple branch nodes (representing all levels of management or sub-departments) extend downward from this. Each branch node can be further divided into smaller branches until reaching the leaf nodes at the end (representing specific execution positions or individuals). Based on the depth (level) of the tree structure, role hierarchy relationships are added to each level, that is, the lower the level, the lower its role hierarchy, as Figure 2 shown. By means of the organic combination of the organizational structure and roles, when the system administrator assigns permissions, only the position and job of the employee within the organization need to be considered, greatly simplifying the work process.

[0154] At the same time, as an extended version of RBAC, the OS-RBAC model covers all the functions of RBAC, such as role hierarchy relationships and separation of duties. In addition, it further adds organizational structure hierarchy relationships and the relationships between the organizational structure and various parts of the RBAC model. There are differences between the organizational structure hierarchy and the role hierarchy. The role hierarchy focuses on the permission relationships between roles, while the organizational structure hierarchy starts from the organizational perspective to ensure that the user permissions are within a reasonable range of the organization where the user is located.

[0155] Step 2: Fine-grained rule configuration and extension

[0156] Inheritance and extension of role permissions

[0157] In role-based access control methods, roles are usually regarded as entities with a fixed set of permissions, which provide users in the system with the permissions to access specific resources. However, this embodiment makes changes to this traditional framework, allowing developers to flexibly specify the inheritance relationship between roles when defining roles. This inheritance mechanism greatly simplifies the complexity of permission management because subclass roles can automatically inherit the permission set of the parent class role, which is called "common permissions". This design makes permission management more modular, avoids duplicate definition of the same permissions, and also makes the update and maintenance of permissions easier. Through role inheritance, it can be ensured that the permission allocation in the entire system remains consistent, reducing the security risks caused by incorrect permission configuration.

[0158] In addition, this method not only supports permission inheritance between roles but also allows permission extension on the basis of inheritance. Subclass roles can add some specific permissions on the basis of inheriting the permissions of the parent class role, which are called "private permissions". This design enables subclass roles to meet the requirements of specific business scenarios without unnecessary modification of the parent class role. This flexible permission extension mechanism enables this method to well adapt to the actual needs of different business scenarios. In addition, for complex situations such as cross-department and personnel mobility, the system administrator can directly remove the existing organizational role of the person and inherit the basic permissions of the superior personnel role and add the private permissions of the new department for them, so as to achieve rapid adjustment of permissions. This design enables this method to well cope with the challenges of enterprise organizational structure changes and personnel mobility.

[0159] Fine-grained permission control

[0160] The role-based access control model is often relatively rough in the division of functional permissions and data permissions and cannot meet the requirements of fine-grained permission control. This may lead to users being able to access or operate data and functions beyond their scope of responsibility, thereby triggering security risks such as data leakage or misoperation. This embodiment adopts the method of interleaving and combining functional permissions and data permissions to achieve extremely refined management of user access and operation permissions. This fine-grained permission control mechanism has significant advantages compared with the traditional coarse-grained permission management method. Specifically, functional permissions mainly control what operations users can perform, such as viewing, editing, deleting, etc., while data permissions determine which specific data users can access. After dividing these two types of permissions according to different dimensions and then combining them, then embed the "new element" constructed in step one - the organizational role into it, such as Figure 3As shown in the figure. The method convention only allows authorization of organizational roles and then assigns organizational roles to users, and does not allow direct assignment of permissions to users. This fine-grained permission control mechanism not only ensures that each user can only access the data and functions within their scope of responsibilities, thus avoiding the disorderly flow of information and potential leakage risks, but also effectively prevents problems such as data corruption or loss caused by misoperations.

[0161] To more clearly explain how fine-grained permission control binds functional permissions and data permissions, taking a specific business scenario in the existing system as an example, the main steps are as follows: (1) For the division of functional permissions: First, identify the functional modules in the system, such as order management, user management, report management, etc. Second, determine the operation permissions under each functional module, such as query, add, modify, delete, etc. (2) For the division of data permissions: Divide the data scope according to business rules or organizational structure, such as department data, project data, personal data, etc. (3) Organizational role definition: Embed the "new element" - organizational role constructed in step one above, and define different organizational roles according to the organizational structure and role hierarchy in step one above, where each organizational role should clearly define its scope of responsibilities and required permissions. (4) Permission assignment: Cross-organize functional permissions and data permissions and assign them to the corresponding organizational roles to ensure that each organizational role has the minimum permissions (basic permissions) required to perform its duties, and expand private permissions for it according to different business needs. (5) Permission configuration: Finally, the administrator configures the permission control rules in the system background to ensure that each user can only access and operate the data and functions they are authorized to, and during the configuration process, carefully check the correctness of permission division and organizational role assignment.

[0162] Step 3: Intelligent rule recommendation

[0163] Existing permission control systems generally have the problems of complex and frequent configuration rules. Especially when facing the same business scenario, it is often necessary to perform multiple repeated configurations, which greatly reduces the efficiency of permission management, increases the system management cost, and is also prone to introducing security risks due to human operation errors. To effectively overcome the above problems, the embodiments of the present disclosure use artificial intelligence technologies such as natural language processing (NLP) and machine learning algorithms to achieve intelligent parsing and recommended configuration of permission rules, lower the technical threshold, enable non-technical personnel to easily participate in permission management, and improve the configuration efficiency and accuracy at the same time. Specifically, it mainly includes the following 6 links, as Figure 4 shown, including:

[0164] (1) Dataset collection and collation:

[0165] (1) Business scenario collection

[0166] The enterprise has multiple departments, each with different job responsibilities and business processes. The system records the operation permissions of employees in different business scenarios. For example: Employees in Department A need permissions such as viewing customer information, product information, creating sales orders, and submitting contract approvals when negotiating cooperation with customers. Employees in Department B need permissions such as accessing market research reports, editing event planning documents, and applying for event budgets when planning events. Employees in Department C need permissions such as obtaining project requirement documents, modifying code, submitting test applications, and viewing test reports when developing projects.

[0167] (2) Dataset collection

[0168] Collect historical permission configuration data from the enterprise's permission management database. Each record contains information such as the employee's department, position, and operation permissions. For example: Employee {Zhang San}, organizational role {Sales representative in the Sales Department}, permissions {View customer information, Create sales orders, Submit contract approvals}. Employee {Li Si}, organizational role {Marketing specialist in the Marketing Department}, permissions {Access market research reports, Edit event planning documents, Apply for event budgets}. Employee {Wang Wu}, organizational role {Software engineer in the R & D Department}, permissions {Obtain project requirement documents, Modify code, Submit test applications}.

[0169] Collect business scenario description texts. These texts can come from employees' operation logs, remarks in project documents, department business process descriptions, etc. For example: "Sales representative Zhang San negotiates cooperation with customer ABC Company and needs to view the customer's past order records to formulate a cooperation plan." "Marketing specialist Li Si plans a new product promotion event and refers to the competitor analysis section in the market research report." "Software engineer Wang Wu fixes bugs in Project X and modifies relevant code modules."

[0170] (2) Text processing and feature extraction

[0171] (1) Jieba word segmentation

[0172] Perform word segmentation on the collected business scenario description texts. For example, for the sentence "Sales representative Zhang San negotiates cooperation with customer ABC Company and needs to view the customer's past order records to formulate a cooperation plan.", after Jieba word segmentation and removing stop words (such as commonly used words like "and", "to" that are not very helpful for semantic analysis), a more meaningful sequence of words can be obtained: "Sales representative", "Zhang San", "Customer", "ABC", "Company", "Negotiate", "Cooperation", "View", "Customer", "Past", "Order records", "Formulate", "Cooperation plan".

[0173] (2) Part-of-speech tagging with HanLP

[0174] Perform part-of-speech tagging on the tokenized results. For example: "sales representative / NN" (noun), "Zhang San / NR" (person's name), "customer / NN" (noun), "ABC / NN" (noun), "company / NN" (noun), "negotiate / VV" (verb), "cooperate / NN" (noun), "check / VV" (verb), "customer / NN" (noun), "past / AD" (adjective), "order record / NN" (noun), "formulate / VV" (verb), "cooperation plan / NN" (noun). Perform named entity recognition to identify entities such as "Zhang San" (employee name) and "ABC Company" (customer name), further enriching the semantic information of the text.

[0175] (3) Keyword extraction

[0176] Extract keywords based on part-of-speech tagging and business requirements. For example, in the above sales scenario, keywords can include "sales representative", "customer", "negotiate cooperation", "check order record", etc. These keywords will be used for subsequent correlation analysis with permission configuration data.

[0177] (III) Data conversion and association construction

[0178] Convert historical permission configuration data into a transaction format suitable for processing by the Apriori algorithm. Taking the permissions of employee Zhang San as an example, group his permissions to view customer information, create sales orders, and submit contract approvals into a transaction {view customer information, create sales orders, submit contract approvals}.

[0179] Associate the keywords extracted from the business scenario description text with the corresponding permission configuration transactions. For example, if the two keywords "sales representative" and "check order record" are extracted in a certain business scenario, and the employee permission transaction corresponding to this scenario is {view customer information, create sales orders, submit contract approvals}, then the keywords can be added to the transaction to get {view customer information, create sales orders, submit contract approvals, sales representative, check order record}.

[0180] Apriori algorithm calculation

[0181] The Apriori algorithm is a classic algorithm for mining frequent item sets and association rules in a dataset, which can discover the frequent co-occurrence relationships between data items. It is based on the prior principle that all non-empty subsets of a frequent item set must also be frequent, and finds frequent item sets through a layer-by-layer search method. The main steps of the algorithm include scanning the dataset to calculate support, generating candidate item sets, pruning using the prior property, and generating association rules, which are widely used in scenarios for analyzing associated data. The specific process is as Figure 5 shown.

[0182] The calculation process described above is summarized as follows: (1) Scan all the data to generate candidate itemset 1; (2) Generate the set of frequent 1-itemsets L from the set of candidate itemset 1 according to the minimum support; (3) When the candidate itemset is greater than 1, repeat steps (4), (5), and (6); (4) Perform the join and pruning operations on the frequent itemsets to generate the next candidate itemset set; (5) Generate the set of (n + 1)-frequent itemsets from the next candidate itemset set n according to the minimum support; (6) If the frequent itemset ≠ Ф, then n = n + 1, jump to step (4); otherwise, proceed; (7) Generate strong association rules from the frequent itemsets according to the minimum confidence, and the program ends.

[0183] Taking a specific business scenario as an example, the main process of the Apriori algorithm is described as follows:

[0184] (1) Calculate frequent itemsets

[0185] The more items that often appear together, the stronger the relationship between them. The commonly used evaluation criteria for frequent itemsets are support, confidence, and lift. Support is the proportion of the number of occurrences of several associated data in the dataset to the total dataset. For three data X, Y, and Z whose association is to be analyzed, the corresponding support formula is as follows:

[0186]

[0187] Confidence reflects the probability that another data appears after one data appears, or the conditional probability of the data. If we have two data X and Y whose association is to be analyzed, the confidence formula of X for Y is as follows:

[0188]

[0189] For three data X, Y, and Z, the confidence formula of Y and Z for X is:

[0190]

[0191] Lift represents the ratio of the possibility of containing Y under the condition of containing X to the possibility of containing Y in the itemset without this condition. This indicator, like confidence, is used to measure the reliability of the rule and can be regarded as a complementary indicator of confidence. That is, on the basis of the possibility P(Y) of Y itself appearing, the degree of improvement of the "appearance rate" P(Y|X) of Y by the appearance of X, and its formula is:

[0192]

[0193] Generally speaking, data with high support does not necessarily form a frequent itemset, but data with too low support definitely does not form a frequent itemset. Additionally, support is defined for item sets. Therefore, a minimum support threshold (0.3) can be defined to retain only the item sets that meet the minimum support, serving as a filtering function for item sets. The Apriori algorithm is used to scan the transaction dataset to calculate the support of each item set. For example, if "View customer information" appears in multiple sales-related transactions and its occurrence ratio reaches or exceeds 0.3, then "View customer information" is part of a frequent itemset.

[0194] Through continuous iteration, frequent item sets of different lengths are calculated. For example, starting from a single permission item, it is gradually combined into a set of multiple permission items, such as {"View customer information", "Create sales order"}, {"View customer information", "Create sales order", "Submit contract for approval"}, etc. At the same time, pruning is performed using the Apriori property to remove item sets that do not meet the minimum support, reducing the computational effort.

[0195] (2) Generate association rules

[0196] For the found frequent item sets, a minimum confidence threshold (0.6) is set to calculate the confidence and generate association rules. For example, if the frequent item set is {"Sales representative", "View customer information"}, and in transactions containing "Sales representative", most of them also contain "View customer information" at the same time, then the association rule "Sales representative -> View customer information" (with confidence meeting the threshold requirement) can be generated. Association rules that meet the minimum confidence threshold are filtered out, and these rules show the potential relationships between permissions, business scenarios, and organizational roles.

[0197] (5) Generation of recommended permission configuration

[0198] Output the association rules output by the fourth step to form recommendations for permissions. When a new business scenario appears, for example, when an employee in the marketing department plans to carry out an online marketing activity, the permission configurator can directly enter "The marketing specialist plans to carry out an online marketing activity and needs to formulate a promotion strategy." in the dialog box. Next, use NLP technology to process the text of this business scenario (word segmentation, keyword extraction, etc.) to obtain keywords such as "marketing specialist", "online marketing activity", and "formulate a promotion strategy". Search for the rules that match these keywords in the generated association rules. For example, the association rules "marketing specialist -> access market research reports" and "analyze target customer group data -> view customer analysis reports" may be found. Then the recommended permissions may include "access market research reports" and "view customer analysis reports". Combine these recommended permissions to form a recommended permission configuration for the current business scenario and employee role. For example, recommend the permission configuration for the marketing specialist in this online marketing activity as: {query market research reports, query customer analysis reports}.

[0199] (VI) Evaluation and Optimization

[0200] According to the evaluation results, adjust the parameters in the text processing steps, such as the custom dictionary of jieba word segmentation (add specific business terms), stop word list, the part-of-speech tagging and named entity recognition model parameters of HanLP, etc., to improve the accuracy of text processing and the effectiveness of feature extraction. Optimize the parameters of the Apriori algorithm, such as the minimum support and minimum confidence thresholds. If the recommended results are too broad (including many irrelevant permissions), the threshold can be appropriately increased; if the recommended results are too conservative (missing some important permissions), the threshold can be appropriately decreased, and the algorithm is re-run to generate a new recommended permission configuration.

[0201] Embodiment 3 of the present disclosure also provides a fine-grained multi-dimensional configured permission control system, as Figure 6 shown, the system includes:

[0202] The organization element addition module 11 is configured to add organization elements on the basis of the RBAC model, add the organizational structure hierarchy relationship, and the relationship between the organizational structure and each part of the RBAC model;

[0203] The introduction module 12 is configured to introduce a dynamic role assignment and role inheritance mechanism, specify the inheritance relationship between roles when defining roles, so that the subclass roles can automatically inherit the permission set of the parent class roles, and can expand permissions on the basis of inheritance;

[0204] The permission configuration module 13 is set to perform permission configuration, cross-organize functional permissions and data permissions and assign them to corresponding organizational roles, ensuring that each organizational role has the basic permissions required for its duties, and extending private permissions for it according to different business needs;

[0205] The assignment module 14 is set to, after performing permission configuration on organizational roles, assign organizational roles to users to achieve permission assignment for users.

[0206] Furthermore, the permission configuration module 13 is also set to;

[0207] When performing permission configuration, through NLP and Apriori machine learning algorithms, intelligent parsing of permission rules and generation of recommended permission configurations are achieved, so as to perform permission configuration for organizational roles in each business scenario according to the generated recommended permission configurations.

[0208] Furthermore, the permission configuration module 13 is specifically set as:

[0209] Dataset collection and collation: Collect operation permissions, historical permission configuration data, and business scenario description texts in different business scenarios;

[0210] Text processing and feature extraction: Perform word segmentation on the collected business scenario description texts, perform part-of-speech tagging on the results of word segmentation, and extract keywords according to part-of-speech tagging and business requirements;

[0211] Data conversion and association construction: Convert historical permission configuration data into a transaction format suitable for Apriori algorithm processing, and associate the keywords extracted from the business scenario description texts with the corresponding permission configuration transactions to obtain a transaction dataset;

[0212] Apriori algorithm calculation: Calculate frequent item sets according to the transaction dataset. For the found frequent item sets, set a minimum confidence threshold, calculate the confidence, and generate association rules;

[0213] Generation of recommended permission configurations: Output the generated association rules, and generate recommended permission configurations according to business scenarios and association rules.

[0214] Furthermore, the calculation of frequent item sets, for the found frequent item sets, setting a minimum confidence threshold, calculating the confidence, and generating association rules include

[0215] Define a minimum support threshold, and achieve the filtering effect of item sets by retaining item sets that meet the minimum support threshold;

[0216] Use the Apriori algorithm to scan the transaction dataset and calculate the support of each item set;

[0217] Starting from a single permission item, gradually combine them into a set of multiple permission items, and at the same time use the Apriori property for pruning to remove item sets that do not meet the minimum support threshold. Through continuous iteration, calculate frequent item sets of different lengths;

[0218] For the found frequent item sets, set a minimum confidence threshold, and generate association rules by calculating the confidence;

[0219] Filter out the association rules that meet the minimum confidence threshold to show the potential relationships between permissions, business scenarios, and organizational roles.

[0220] Furthermore, the system further includes an evaluation module 15:

[0221] The evaluation module 15 is configured to evaluate the generated recommended permission configuration;

[0222] According to the evaluation results, adjust the parameters in the text processing steps to improve the accuracy of text processing and the effectiveness of feature extraction; and,

[0223] Optimize the parameters of the Apriori algorithm and re-run the algorithm to generate a new recommended permission configuration.

[0224] The fine-grained multi-dimensional configuration permission control system of the embodiments of the present disclosure is used to implement the fine-grained multi-dimensional configuration permission control method in Embodiment 1 and Embodiment 2 of the method. Therefore, the description is relatively simple. For specific details, please refer to the relevant descriptions in the previous method embodiments, which will not be elaborated here.

[0225] In addition, as Figure 8 Figure 9 shown, Embodiment 4 of the present disclosure further provides an electronic device, including a memory 100 and a processor 200. A computer program is stored in the memory 100. When the processor 200 runs the computer program stored in the memory 100, the processor 200 executes the above various possible methods.

[0226] Among them, the memory 100 is connected to the processor 200. The memory 100 can adopt flash memory, read-only memory, or other memories, and the processor 200 can adopt a central processing unit or a single-chip microcomputer.

[0227] In addition, the embodiments of the present disclosure further provide a computer-readable storage medium, on which a computer program is stored, and the computer program is executed by the processor to perform the above various possible methods.

[0228] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, computer program modules, or other data. The computer-readable storage medium includes, but is not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), digital versatile disc (DVD, Digital Video Disc) or other optical disc storage, magnetic cassette, tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0229] It can be understood that the above embodiments are merely exemplary embodiments adopted to illustrate the principles of the present disclosure. However, the present disclosure is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present disclosure, and these modifications and improvements are also regarded as the protection scope of the present disclosure.

Claims

1. A fine-grained multi-dimensional configuration-based permission control method, characterized in that The method includes: Based on the Role-Based Access Control (RBAC) model, add organizational elements, incorporate the hierarchical relationship of the organizational structure, and the relationships between the organizational structure and various parts of the RBAC model; Introduce the dynamic role assignment and role inheritance mechanisms. When defining roles, specify the inheritance relationship between roles, enabling subclass roles to automatically inherit the permission set of the parent class role and be able to expand permissions on this basis; Conduct permission configuration. Cross-organize functional permissions and data permissions and assign them to corresponding organizational roles to ensure that each organizational role has the basic permissions required to perform its duties, and expand private permissions for it according to different business needs; After performing permission configuration on organizational roles, achieve the permission assignment to users by assigning organizational roles to users.

2. The method according to claim 1, characterized in that, The method further includes: When conducting permission configuration, through Natural Language Processing (NLP) and the Apriori machine learning algorithm, achieve the intelligent parsing of permission rules and the generation of recommended permission configurations, so as to configure permissions for organizational roles in various business scenarios according to the generated recommended permission configurations.

3. The method according to claim 2, characterized in that The realization of the intelligent parsing of permission rules and the generation of recommended permission configurations through NLP and the Apriori machine learning algorithm includes: Dataset collection and collation: Collect operation permissions, historical permission configuration data, and business scenario description texts in different business scenarios; Text processing and feature extraction: Perform word segmentation on the collected business scenario description texts, conduct part-of-speech tagging on the results of word segmentation, and extract keywords according to part-of-speech tagging and business requirements; Data conversion and association construction: Convert historical permission configuration data into a transaction format suitable for processing by the Apriori algorithm, and associate the keywords extracted from the business scenario description texts with the corresponding permission configuration transactions to obtain a transaction dataset; Apriori algorithm calculation: Calculate frequent item sets based on the transaction dataset. For the found frequent item sets, set a minimum confidence threshold, calculate the confidence, and generate association rules; Generation of recommended permission configurations: Output the generated association rules, and generate recommended permission configurations according to business scenarios and association rules.

4. The method according to claim 3, wherein The calculation of frequent item sets, for the found frequent item sets, setting a minimum confidence threshold, calculating the confidence, and generating association rules includes Define a minimum support threshold, and achieve the filtering effect of item sets by retaining the item sets that meet the minimum support threshold; Use the Apriori algorithm to scan the transaction dataset and calculate the support of each item set; Start from a single permission item and gradually combine it into a set of multiple permission items. At the same time, use the Apriori property for pruning to remove the item sets that do not meet the minimum support threshold. Through continuous iteration, calculate frequent item sets of different lengths; For the found frequent item sets, set a minimum confidence threshold, and generate association rules by calculating the confidence; Filter out the association rules that meet the minimum confidence threshold to show the potential relationships between permissions, business scenarios, and organizational roles.

5. The method according to claim 3, characterized in that, The method further includes: Evaluate the generated recommended permission configurations; Adjust the parameters in the text processing steps according to the evaluation results to improve the accuracy of text processing and the effectiveness of feature extraction; and, Optimize the parameters of the Apriori algorithm and re-run the algorithm to generate a new recommended permission configuration.

6. A fine-grained multi-dimensional configuration permission control system, characterized in that, The system includes: An organizational element addition module, which is set to add organizational elements on the basis of the RBAC model, add the hierarchical relationship of the organizational structure, and the relationship between the organizational structure and each part of the RBAC model; An introduction module, which is set to introduce a dynamic role assignment and role inheritance mechanism, specify the inheritance relationship between roles when defining roles, so that the subclass roles can automatically inherit the permission set of the parent class roles, and can expand permissions on the basis of inheritance; A permission configuration module, which is set to perform permission configuration, cross-organize functional permissions and data permissions and assign them to corresponding organizational roles, ensure that each organizational role has the basic permissions required for its duties, and expand private permissions for it according to different business needs; An assignment module, which is set to, after performing permission configuration on organizational roles, assign organizational roles to users to achieve permission assignment for users.

7. The system according to claim 6, wherein The permission configuration module is also set to; When performing permission configuration, through NLP and Apriori machine learning algorithms, realize the intelligent parsing of permission rules and the generation of recommended permission configurations, so as to perform permission configuration for organizational roles in each business scenario according to the generated recommended permission configurations.

8. The system according to claim 7, wherein The permission configuration module is specifically set to: Dataset collection and collation: Collect operation permissions, historical permission configuration data, and business scenario description texts in different business scenarios; Text processing and feature extraction: Perform word segmentation on the collected business scenario description texts, perform part-of-speech tagging on the segmented results, and extract keywords according to the part-of-speech tagging and business requirements; Data conversion and association construction: Convert historical permission configuration data into a transaction format suitable for processing by the Apriori algorithm, associate the keywords extracted from the business scenario description texts with the corresponding permission configuration transactions to obtain a transaction dataset; Apriori algorithm calculation: Calculate frequent item sets according to the transaction dataset, set a minimum confidence threshold for the found frequent item sets, calculate the confidence, and generate association rules; Recommended permission configuration generation: Output the generated association rules, and generate recommended permission configurations according to the business scenarios and association rules.

9. An electronic device, characterized in that, It includes a memory and a processor. A computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the fine-grained multi-dimensional configuration permission control method according to any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium. When the computer program is executed by the processor, the fine-grained multi-dimensional configuration permission control method according to any one of claims 1-5 is realized.

Images