A method, apparatus, electronic device, and storage medium for access control of a business system.

Abstract

This disclosure provides a method, apparatus, electronic device, and storage medium for managing access permissions in a business system. The method includes: receiving an access request from a client to the business system; obtaining multi-dimensional authentication information corresponding to the access request; performing first-level permission authentication on the access request based on the multi-dimensional authentication information to obtain first permission information corresponding to the access request; obtaining at least one of time authorization information, space authorization information, behavior authorization information, and business status information corresponding to the client; performing second-level permission authentication on the access request to obtain second permission information corresponding to the access request; determining target permission information corresponding to the access request based on the first permission information and the second permission information; and responding to the access request based on the target permission information. Through two levels of permission authentication, the security of access to the business system is improved, further enhancing the network security of the business system.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a method, apparatus, electronic device, and storage medium for managing access permissions of a business system. Background Technology

[0002] With the continuous development of computer and network technologies, online businesses are booming, and the resulting security issues are becoming increasingly serious.

[0003] In the process of implementing this disclosure, it was found that the prior art has at least the following technical problems: in the access control scenario of business systems, the authorization authentication method for access requests is too simple, which poses a network security risk. Summary of the Invention

[0004] This disclosure provides a method, apparatus, electronic device, and storage medium for managing access permissions in a business system, in order to improve the network security of the business system.

[0005] According to one aspect of this disclosure, a method for managing access permissions in a business system is provided, comprising:

[0006] Receive client access request to business system, obtain multi-dimensional authentication information corresponding to the access request, the multi-dimensional authentication information includes authentication information corresponding to at least one dimension of user dimension, resource dimension, environment dimension and business status dimension;

[0007] Based on the multi-dimensional authentication information, the access request is subjected to first-level permission authentication to obtain the first permission information corresponding to the access request;

[0008] The access request is authenticated using at least one of the time authorization information, space authorization information, behavior authorization information, and business status information corresponding to the client, thereby obtaining the second permission information corresponding to the access request.

[0009] Based on the first permission information and the second permission information, the target permission information corresponding to the access request is determined, and the access request is responded to based on the target permission information.

[0010] Optionally, the first permission information includes allow and deny; the second permission information includes allow and deny; when either the first permission information or the second permission information is deny, the target permission information is deny; when both the first permission information and the second permission information are allow, the target permission information is allow.

[0011] Specifically, at least one of the time authorization information, space authorization information, and behavior authorization information corresponding to the client is obtained to perform second-level permission authentication on the access request, thereby obtaining the second permission information corresponding to the access request, including:

[0012] Perform at least one of the following information matching operations: if any matching result is a non-match, the second permission information is denied; if all matching results are matches, the second permission information is permitted:

[0013] The access time of the access request is matched with the time authorization information corresponding to the client to obtain a time matching result; the location information corresponding to the access request is matched with the spatial authorization information corresponding to the client to obtain a spatial matching result; the access operation corresponding to the access request is matched with the behavior authorization information corresponding to the client to obtain a behavior matching result; and the current business status of the business system is matched with the accessibility status information of the business system to obtain a business status matching result.

[0014] Optionally, the first permission information is a basic permission value, the second permission information is an adjustment permission value, the target permission information is a target permission value, and the target permission value is determined based on the basic permission value and the adjustment permission value.

[0015] The step of responding to the access request based on the target permission information includes: determining the data access range and operation access range corresponding to the client according to the target permission value; and responding to the access request according to the data access range and operation access range.

[0016] Optionally, the data access range and the operation access range are positively correlated with the target permission value; the security level of business data within the data access range is positively correlated with the target permission value; and the sensitivity of operation behaviors within the operation access range is positively correlated with the target permission value.

[0017] Optionally, the method for determining the basic permission value includes: mapping the multi-dimensional authentication information to an authentication value based on the mapping relationship between multi-dimensional authentication information and values; and performing fusion processing on the authentication values ​​corresponding to the multi-dimensional authentication information based on the fusion authentication calculation model of multi-dimensional authentication information to obtain the basic permission value.

[0018] Optionally, the adjustment permission value is determined based on at least one of the following: processing the access time of the access request and the time authorization information corresponding to the client based on a time adjustment function to obtain a first adjustment permission value; processing the location information corresponding to the access request and the spatial authorization information corresponding to the client based on a spatial adjustment function to obtain a second adjustment permission value; processing the client's historical operation behavior and the client's corresponding behavior authorization information based on a behavior adjustment function to obtain a third adjustment permission value; and processing the business status of the business system based on a business status adjustment function to obtain a fourth adjustment permission value.

[0019] Optionally, the response method to the access request includes at least one of the following: executing the access request and returning the request result corresponding to the access request; rejecting the access request; or providing secondary permission verification to the client.

[0020] According to another aspect of this disclosure, an access control device for a business system is provided, comprising:

[0021] The request receiving module receives access requests from clients to the business system.

[0022] The information acquisition module is used to acquire multi-dimensional authentication information corresponding to the access request. The multi-dimensional authentication information includes authentication information corresponding to at least one dimension: user dimension, resource dimension, environment dimension, and business status dimension.

[0023] The first permission information determination module is used to perform first-level permission authentication on the access request based on the multi-dimensional authentication information to obtain the first permission information corresponding to the access request.

[0024] The second permission information determination module is used to obtain at least one of the time authorization information, space authorization information, behavior authorization information and business status information corresponding to the client to perform second-level permission authentication on the access request, and obtain the second permission information corresponding to the access request;

[0025] The access request response module is used to determine the target permission information corresponding to the access request based on the first permission information and the second permission information, and to respond to the access request based on the target permission information.

[0026] According to another aspect of this disclosure, an electronic device is provided, the electronic device comprising:

[0027] At least one processor; and

[0028] A memory communicatively connected to the at least one processor; wherein,

[0029] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to execute the access control method of the business system described in any embodiment of this disclosure.

[0030] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores computer instructions for causing a processor to execute and implement the access control method of the business system described in any embodiment of this disclosure.

[0031] The technical solution of this disclosure improves multi-level permission management by performing two levels of permission authentication on access requests and determining the target permission information corresponding to the access request based on the permission information obtained from the two levels of authentication. Specifically, in the first-level permission authentication process, multi-dimensional authentication information is obtained to improve the comprehensiveness and diversity of authentication information, thereby enhancing the accuracy of permission authentication. In the second-level permission authentication process, dynamic permission management is performed on the access request using at least one of time-based authorization information, space-based authorization information, behavioral authorization information, and business status information, improving the accuracy of dynamic permission authentication. Through these two levels of permission authentication, the security of access to the business system is improved, further enhancing the network security of the business system.

[0032] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart of an access control method for a business system provided in this embodiment of the disclosure;

[0035] Figure 2 This is a flowchart of an access control method for a business system provided in this embodiment of the disclosure;

[0036] Figure 3 This is a schematic diagram of the structure of an access control device for a business system provided in an embodiment of this disclosure;

[0037] Figure 4This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0038] To enable those skilled in the art to better understand the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present disclosure.

[0039] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0040] The acquisition, storage, and / or processing of data in the technical solutions involved in this application comply with the relevant provisions of national laws and regulations. It should be noted that certain software, components, models, and other existing solutions in the industry may be mentioned in the embodiments of this application. These should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solutions of this application, but does not mean that the applicant has used or necessarily used such solutions.

[0041] A business system can be understood as a system that conducts business activities and provides services through an internet platform, and may include information exchange, service provision, and commercial transactions via the network. For example, a business system may be an online business system, and the online business performed by this online business system may include, but is not limited to, online transaction business based on e-commerce platforms, online financial business, online multimedia content service business, online sharing business, online social business, online medical business, and online government affairs business. A business system may also be an enterprise business system used to perform internal enterprise business. Clients can interact with the business system by sending access requests to it. To improve the network security of the business system, this disclosure provides an access permission management method for the business system, which manages the access requests sent by clients. See also... Figure 1 , Figure 1This is a flowchart illustrating an access control method for a business system according to an embodiment of this disclosure. This embodiment is applicable to situations where multi-level access control is implemented for access requests initiated by clients to a business system. This method can be executed by an access control device of the business system, which can be implemented in hardware and / or software and can be configured in a computer device or server. Figure 1 As shown, the method includes:

[0042] S110. Receive a client's access request to the business system, and obtain multi-dimensional authentication information corresponding to the access request. The multi-dimensional authentication information includes authentication information corresponding to at least one of the following dimensions: user dimension, resource dimension, environment dimension, and business status dimension.

[0043] S120. Perform first-level permission authentication on the access request based on the multi-dimensional authentication information to obtain the first permission information corresponding to the access request.

[0044] S130. Obtain at least one of the time authorization information, space authorization information, behavior authorization information and business status information corresponding to the client to perform second-level permission authentication on the access request, and obtain the second permission information corresponding to the access request.

[0045] S140. Determine the target permission information corresponding to the access request based on the first permission information and the second permission information, and respond to the access request based on the target permission information.

[0046] In this embodiment, the client sends access requests to the business system according to operational needs. Different business systems may correspond to different types of access requests. These access requests may include, but are not limited to, data operation requests, function operation requests, and system control requests. For example, data operation requests may include, but are not limited to, data read requests, data write requests, data modification requests, data deletion requests, and data export requests. Function operation requests may include, but are not limited to, UI function requests, API call requests, and batch task processing requests. System control requests may include, but are not limited to, infrastructure management requests, permission management requests, and log access requests. The specific type of access request is not limited here.

[0047] By acquiring multi-dimensional authentication information corresponding to the access request, multi-dimensional permission authentication is performed on the access request. The dimensions of the authentication information include at least one of the following: user dimension, resource dimension, environment dimension, and business status dimension. User-dimensional authentication information can be understood as static and dynamic attribute information representing the access subject. Static attribute information in user-dimensional authentication information includes, but is not limited to, identity identifier, department / job level, and security level. Dynamic attribute information in user-dimensional authentication information includes, but is not limited to, login frequency within a historical time period, historical violation count, current active session count, and behavior credibility score. Resource-dimensional authentication information can be understood as the sensitivity and business characteristics of the accessed object, and may include, but is not limited to, resource type (e.g., database, API endpoint, or file), data sensitivity level (e.g., public, internal, and confidential), business-critical data (e.g., values ​​between 0 and 1), business domain, and most recently modified timestamp. Authentication information in the environmental dimension can be understood as information representing the context in which the access occurred. This includes, but is not limited to, time characteristics, spatial characteristics, device characteristics, and environmental anomaly characteristics. Time characteristics may include, for example, holidays / working hours or the time interval since the last access. Spatial characteristics may include physical space characteristics (e.g., geographic location information) and network space information (e.g., intranet, 4G, or VPN). Device characteristics may include device type and device security status. Environmental anomaly characteristics may include network attack warnings. Authentication information with environmental anomaly characteristics can be understood as the current operational status information of the business system, including but not limited to, business cycle stage, system load status, process approval status, and risk event markers. It is understood that the content and quantity of authentication information in each dimension may differ across different business systems, and can be determined based on the access control requirements of the business system.

[0048] This disclosure discloses several embodiments in which pre-set permission verification rules are implemented. These rules may include verification sub-rules corresponding to user, resource, environment, and business status dimensions. The authentication information for each dimension is verified using these sub-rules. The first permission information includes allow and deny. If the authentication information for each dimension is successfully verified, the first permission information is determined to be allowed. If the authentication information for at least one dimension fails to be verified, the first permission information is determined to be denied.

[0049] In some embodiments of this disclosure, a hybrid access control model is pre-built. This hybrid access control model may be constructed using role-based access control (RBAC) and attribute-based access control (ABAC). The hybrid access control model can be used to authenticate the aforementioned multi-dimensional authentication information to obtain the first access information.

[0050] Based on the first level of permission authentication of the access request by multi-dimensional authentication information to obtain the first permission information, the access request is dynamically authenticated by at least one of the client's time authorization information, space authorization information, behavior authorization information and business status information, i.e., the second level of permission authentication, to obtain the second permission information. The target permission information is determined by the first permission information and the second permission information together, so as to realize multi-level permission management of access requests, improve the accuracy of permission management and the security of business systems.

[0051] For different business systems, or for different business types corresponding to access requests, the information required for second-level permission authentication is determined from the time authorization information, space authorization information, behavior authorization information, and business status information corresponding to the client. Second-level permission authentication is performed based on the information required for second-level permission authentication. The information required for second-level permission authentication can be at least one of the time authorization information, space authorization information, behavior authorization information, and business status information corresponding to the client.

[0052] Optionally, at least one of the following information matching operations may be performed, wherein if any matching result is a mismatch, the second permission information is denied, and if all matching results are matches, the second permission information is permitted: matching the access time of the access request with the time authorization information corresponding to the client to obtain a time matching result; matching the location information corresponding to the access request with the spatial authorization information corresponding to the client to obtain a spatial matching result; matching the access operation corresponding to the access request with the behavior authorization information corresponding to the client to obtain a behavior matching result; and matching the current business status of the business system with the accessibility status information of the business system to obtain a business status matching result.

[0053] The time authorization information corresponding to a client can be understood as the time range within which the client has access permissions. This time authorization information can be set or adjusted as needed. For example, the time authorization information for a temporary client can be (t1, t2), where t1 can be the start time of the permission and t2 can be the end time of the permission. For example, when a user is on vacation, the time authorization information for the user client can be (-, t3)(t4, -), indicating that t3 can be the end time of the permission and t4 is the time when the permission is restarted. For example, the time authorization information (-, -) for the user client indicates that the client's permissions are unrestricted in the time dimension.

[0054] The access time of the access request is matched with the time authorization information of the client. If the access time of the access request is within the time authorization information of the client, the matching result is determined to be a match. If the access time of the access request is outside the time authorization information of the client, the matching result is determined to be a mismatch.

[0055] The client's space authorization information can be understood as the scope of space the client has access to. This space authorization information can be set or adjusted as needed. For example, the client's space authorization information could be the client user's work scope, such as the work scope of the client user's company. The access request sent by the client carries the client's location information, i.e., the location information corresponding to the access request. This location information is matched against the client's space authorization information. If the location information corresponding to the access request is within the work scope corresponding to the space authorization information, the match is considered a match; if the location information corresponding to the access request is outside the work scope corresponding to the space authorization information, the match is considered a mismatch.

[0056] The client's corresponding action authorization information can be understood as a set of actions that the client is authorized to perform. Different clients may correspond to different sets of actions. The actions included in the set may include, but are not limited to, at least one of the following: query, modify, upload, download, and delete. The access operation corresponding to the access request is matched against the set of actions that the client is authorized to perform. If the access operation corresponding to the access request is within the set of actions that the client is authorized to perform, the match is considered a match; otherwise, the match is considered a mismatch.

[0057] The business status information corresponding to the client can be understood as the business status of the business system granting access permissions to the client. For example, business status information may include "Under Development," "Updating," or "Application." In the "Under Development" and "Updating" states, the business system does not grant access permissions to the client; in the "Application" state, the business system grants access permissions to the client. The system determines the current business status of the business system when the access request is sent. If the current business status is "Application," the matching result is determined to be a match; if the current business status is "Under Development" or "Updating," the matching result is determined to be a mismatch. It is understood that the status information of different business systems can be different and can be set according to the needs of the business system.

[0058] In some embodiments of this disclosure, the first right information and the second permission information respectively include allow and deny; when either the first permission information or the second permission information is denied, the target permission information is denied; when both the first permission information and the second permission information are allowed, the target permission information is allowed.

[0059] In some embodiments of this disclosure, if the first permission information is allowed, step S130 is executed; if the second permission information is allowed, the target permission information is determined to be allowed; if the second permission information is denied, the target permission information is determined to be denied. If the first permission information is denied, step S130 is not required, and the target permission information is determined to be denied.

[0060] When the target permission information is "allow", the response to the access request is to execute the access request and return the corresponding request result; when the target permission information is "deny", the response to the access request is to deny the access request.

[0061] The technical solution of this embodiment performs two levels of permission authentication processing on the access request, and determines the target permission information corresponding to the access request based on the permission information obtained from the two levels of authentication, thereby improving multi-level permission management. Specifically, in the first-level permission authentication process, multi-dimensional authentication information is obtained to improve the comprehensiveness and diversity of authentication information, thus improving the accuracy of permission authentication. In the second-level permission authentication process, dynamic permission management is performed on the access request using at least one of time-based authorization information, space-based authorization information, behavioral authorization information, and business status information, improving the accuracy of dynamic permission authentication. Through these two levels of permission authentication, the security of access to the business system is improved, further enhancing the network security of the business system.

[0062] Figure 2This is a flowchart of an access permission management method for a business system provided in this disclosure embodiment. Based on the above embodiment, it provides another method for determining target permission information. Figure 2 As shown, the method includes:

[0063] S210. Receive a client's access request to the business system, and obtain multi-dimensional authentication information corresponding to the access request. The multi-dimensional authentication information includes authentication information corresponding to at least one dimension: user dimension, resource dimension, environment dimension, and business status dimension.

[0064] S220. Based on the multi-dimensional authentication information, perform first-level permission authentication on the access request to obtain the basic permission value corresponding to the access request.

[0065] S230. Obtain at least one of the time authorization information, space authorization information, behavior authorization information and business status information corresponding to the client to perform second-level permission authentication on the access request, and obtain the adjustment permission value corresponding to the access request.

[0066] S240. Determine the target permission value corresponding to the access request based on the basic permission value and the adjustment permission value, and respond to the access request based on the target permission value.

[0067] In this embodiment of the disclosure, the first permission information, the second permission information, and the target permission information are all in numerical form. The size of the numerical value represents the size of the permission, and the larger the numerical value, the greater the access permission corresponding to the access request.

[0068] Optionally, the determination of the basic permission value includes: mapping the multi-dimensional authentication information to an authentication value based on the mapping relationship between multi-dimensional authentication information and values; and performing fusion processing on the authentication values ​​corresponding to the multi-dimensional authentication information based on the fusion authentication calculation model of multi-dimensional authentication information to obtain the basic permission value.

[0069] A pre-defined mapping relationship between the information content and numerical value of each item in the multi-dimensional authentication information is established. This means that different information contents of the same authentication information can correspond to different numerical values. For each piece of information in the multi-dimensional authentication information corresponding to an access request, the corresponding authentication value is determined according to the aforementioned mapping relationship, resulting in individual authentication values ​​for each item in the multi-dimensional authentication information. These authentication values ​​are then input into the multi-dimensional authentication information fusion authentication calculation model for calculation, yielding the basic permission value. The multi-dimensional authentication information fusion authentication calculation model can, for example, be a weighted calculation model of the corresponding authentication values ​​for each item in the multi-dimensional authentication information.

[0070] For example, the calculation method for basic permission values ​​can be expressed by the following formula:

[0071] P base = w1·U+w2·R+w3·E+w4·B

[0072] Where U represents the authentication data vector corresponding to the authentication information at the user level, U = (U1, U2, ..., U...) n R represents the authentication data vector corresponding to the authentication information in the resource dimension, R = (R1, R2, ..., U). n E represents the authentication data vector corresponding to the authentication information in the environmental dimension, E = (E1, E2, ..., E...). n B represents the authentication data vector corresponding to the authentication information in the business status dimension, B = (B1, B2, ..., B...). n w1, w2, w3, and w4 are the weights corresponding to the user dimension, resource dimension, environment dimension, and business status dimension, respectively.

[0073] Optionally, the adjustment permission value is determined based on at least one of the following:

[0074] The access time of the access request and the time authorization information corresponding to the client are processed based on the time adjustment function to obtain the first adjustment permission value;

[0075] The location information corresponding to the access request and the space authorization information corresponding to the client are processed based on the space adjustment function to obtain the second adjustment permission value;

[0076] The client's historical operation behavior and corresponding behavior authorization information are processed based on the behavior adjustment function to obtain the third adjustment permission value;

[0077] The business status of the business system is processed based on the business status adjustment function to obtain the fourth adjustment permission value.

[0078] Optionally, the time adjustment function can be expressed by the following formula: Where λ1 is the time decay coefficient, t0 is the time length corresponding to the time authorization information, and t is the authorized time length corresponding to the access time of the access request. According to this time adjustment function, it can be seen that within the authorized time, the value of the first adjustment permission gradually decays with time.

[0079] Optionally, the time adjustment function can also be a piecewise function, which can be expressed by the following formula:

[0080] Among them, P1 is greater than P2, and P2 can be zero.

[0081] Optionally, the method for determining the second adjustment permission value includes: obtaining the distance between the location information corresponding to the access request and the spatial authorization information corresponding to the client, inputting the distance into the spatial adjustment function to obtain the second adjustment permission value. The spatial adjustment function can be a mapping function between the second adjustment permission value and the aforementioned distance, and the second adjustment permission value is negatively correlated with the distance.

[0082] For example, the spatial adjustment function can be expressed by the following formula: P adjust_2 =e -λ2·d Where λ² is the spatial attenuation coefficient, and d represents the distance between the location information corresponding to the access request and the reference location information in the spatial authorization information corresponding to the client. l is the location information corresponding to the access request, and l0 is the reference location information in the spatial authorization information corresponding to the client, which can be the center location information of the spatial authorization information. This distance can be calculated using the Euclidean distance method, where l and l0 are both coordinate values.

[0083] For example, the spatial adjustment function can also be expressed by the following formula:

[0084] Where L represents the space authorization information corresponding to the client, P3 is greater than P4, and P4 can be zero.

[0085] Optionally, the method for determining the value of the third adjustment permission includes: obtaining the client's historical operation behavior within a preset historical time period, determining the operation risk score of the historical operation behavior based on the corresponding behavior authorization information of the client, and obtaining the value of the third adjustment permission based on the operation risk score and behavior decay coefficient of the historical operation behavior. The higher the operation risk score, the higher the security risk of the historical operation behavior, and the smaller the value of the third adjustment permission.

[0086] If the historical operation belongs to the authorized operation in the corresponding behavior authorization information of the client, the operation risk score is zero. If the historical operation does not belong to the authorized operation in the corresponding behavior authorization information of the client, the operation risk score is greater than zero. The operation risk score of the historical operation is determined according to the sensitivity of the historical operation. The higher the sensitivity of the historical operation, the higher the operation risk score of the historical operation. The operation risk score of the historical operation can be a value between 0 and 1.

[0087] For example, specifically, the operational risk score is input into the behavioral regulation function to obtain the third regulation authority value, whereby the behavioral regulation function can be characterized by the following formula:

[0088] Where S represents the operational risk score, and λ3 represents the behavior attenuation coefficient.

[0089] Optionally, the method for determining the value of the fourth adjustment permission includes: obtaining the current business status of the business system when the access request is sent, and processing the current business status of the business system and the set of business statuses that the business system has granted access permissions to the client through the business status adjustment function to obtain the value of the fourth adjustment permission.

[0090] For example, the spatial adjustment function can also be expressed by the following formula:

[0091] Where M is the set of business states that the business system grants access permissions to the client, and m is the current business state of the business system when the access request is sent; P5 is greater than P6, and P6 can be zero.

[0092] In some embodiments of this disclosure, any one of the first, second, third, and fourth adjustment permission values ​​can be determined as the adjustment permission value. For example, when the client is a temporary permission client, the first adjustment permission value can be used as the adjustment permission value, and the adjustment permission value automatically decays according to the permission's contract period until the target permission value triggers automatic permission revocation. During the permission's contract period, as the data comprehensiveness of the business system or project progress continuously improves, the security of business system data or project data is enhanced by automatically adjusting the adjustment permission value.

[0093] In some embodiments of this disclosure, the adjustment authority value can be obtained by weighted calculation based on at least two of the first adjustment authority value, the second adjustment authority value, the third adjustment authority value, and the fourth adjustment authority value. In some embodiments of this disclosure, the adjustment authority value can be determined based on the product of at least two of the first adjustment authority value, the second adjustment authority value, the third adjustment authority value, and the fourth adjustment authority value.

[0094] In some embodiments of this disclosure, the target permission value is determined based on the base permission value and the adjustment permission value; alternatively, the target permission value can be obtained based on the product of the base permission value and the adjustment permission value. For example, the target permission value can be achieved using the following formula: P final =P base ×P adjust , where P adjust To adjust the permission values.

[0095] Optionally, the target permission value can be obtained based on the tensor product of the base permission value and the adjustment permission value. For example, the target permission value can be achieved by the following formula: Among them, P adjust To adjust the permission values.

[0096] Based on the above embodiments, responding to the access request based on the target permission information includes: determining the data access range and operation access range corresponding to the client according to the target permission value; and responding to the access request according to the data access range and operation access range.

[0097] The data access range corresponding to the client can be understood as the range of data that the client has access to, and the operation access range corresponding to the client can be understood as the set of access operations that the client has access to. Both the data access range and the operation access range are positively correlated with the target permission value; the larger the target permission value, the larger the data access range and the more operation types are included in the operation access range.

[0098] Optionally, a pre-defined correspondence between target permission information and data access scope and operation access scope can be established, and the data access scope and operation access scope corresponding to the target permission information can be determined based on the above correspondence.

[0099] The business system includes a large amount of data, and different data have different security levels. For example, data security levels can include public, internal, and confidential. The security level of business data within the data access scope is positively correlated with the target permission value. That is, the larger the target permission value, the larger the amount of data included in the data access scope corresponding to that target permission value, and the higher the data security level. For example, when the target permission value is 0.5, the data access scope corresponding to the target permission value is the data range with a security level of public; when the target permission value is 0.8, the data access scope corresponding to the target permission value is the data range with a security level of public and internal; when the target permission value is 1, the data access scope corresponding to the target permission value is the data range with a security level of public, internal, and confidential.

[0100] Client access to the business system involves multiple operations, each with varying sensitivity. For example, the sensitivity of operations such as delete, download, and view decreases sequentially. The sensitivity of the operations within the access range is positively correlated with the target permission value. In other words, the higher the target permission value, the more types of access operations are included in the access range corresponding to that value, and the higher the sensitivity of the access operations. For instance, when the target permission value is 0.5, the access range includes viewing; when the target permission value is 0.8, the access range includes viewing and downloading; and when the target permission value is 1, the access range includes viewing, downloading, and deleting.

[0101] Optionally, responding to the access request based on the data access scope and operation access scope includes: determining whether the access object of the access request belongs to the data access scope corresponding to the client, and whether the access operation of the access request belongs to the operation access scope; if the access object of the access request belongs to the data access scope corresponding to the client, and the access operation of the access request belongs to the operation access scope, then the access request is executed, and the request result corresponding to the access request is fed back; if the access object of the access request does not belong to the data access scope corresponding to the client, and the access operation of the access request does not belong to the operation access scope, then the access request is rejected, or secondary permission verification is provided to the client.

[0102] The technical solution of this embodiment obtains a basic permission value through first-level permission processing, an adjustment permission value through second-level permission processing, and a target permission value through the basic permission value and the adjustment permission value. The target permission value is used to characterize the extent of the client's access permissions to the business system. By responding to the client's access request with the target permission value, numerical management of access permissions to the business system is achieved, improving the accuracy of permission management and enhancing the network security of the business system.

[0103] Figure 3 This is a schematic diagram of the structure of an access control device for a business system provided in an embodiment of this disclosure. Figure 3 As shown, the device includes: a request receiving module 310, an information acquisition module 320, a first permission information determination module 330, a second permission information determination module 340, and an access request response module 350. Wherein:

[0104] The request receiving module 310 receives access requests from clients to the business system.

[0105] The information acquisition module 320 is used to acquire multi-dimensional authentication information corresponding to the access request. The multi-dimensional authentication information includes authentication information corresponding to at least one dimension: user dimension, resource dimension, environment dimension, and business status dimension.

[0106] The first permission information determination module 330 is used to perform first-level permission authentication on the access request based on the multi-dimensional authentication information to obtain the first permission information corresponding to the access request.

[0107] The second permission information determination module 340 is used to obtain at least one of the time authorization information, space authorization information, behavior authorization information and business status information corresponding to the client to perform second-level permission authentication on the access request, and obtain the second permission information corresponding to the access request;

[0108] The access request response module 350 is used to determine the target permission information corresponding to the access request based on the first permission information and the second permission information, and to respond to the access request based on the target permission information.

[0109] The technical solution of this embodiment performs two levels of permission authentication processing on the access request, and determines the target permission information corresponding to the access request based on the permission information obtained from the two levels of authentication, thereby improving multi-level permission management. Specifically, in the first-level permission authentication process, multi-dimensional authentication information is obtained to improve the comprehensiveness and diversity of authentication information, thus improving the accuracy of permission authentication. In the second-level permission authentication process, dynamic permission management is performed on the access request using at least one of time-based authorization information, space-based authorization information, behavioral authorization information, and business status information, improving the accuracy of dynamic permission authentication. Through these two levels of permission authentication, the security of access to the business system is improved, further enhancing the network security of the business system.

[0110] Based on the above embodiments, optionally, the first permission information includes allow and deny; the second permission information includes allow and deny; when either the first permission information or the second permission information is deny, the target permission information is deny; when both the first permission information and the second permission information are allow, the target permission information is allow.

[0111] The second permission information determination module 340 is used to: perform at least one of the following information matching operations, wherein the second permission information is denied when any matching result is a mismatch, and the second permission information is allowed when all matching results are matches: matching the access time of the access request with the time authorization information corresponding to the client to obtain a time matching result; matching the location information corresponding to the access request with the space authorization information corresponding to the client to obtain a space matching result; matching the access operation corresponding to the access request with the behavior authorization information corresponding to the client to obtain a behavior matching result; and matching the current business status of the business system with the accessibility status information of the business system to obtain a business status matching result.

[0112] Based on the above embodiments, optionally, the first permission information is a basic permission value, the second permission information is an adjustment permission value, the target permission information is a target permission value, and the target permission value is determined based on the basic permission value and the adjustment permission value;

[0113] Optionally, the access request response module 350 is used to: determine the data access range and operation access range corresponding to the client based on the target permission value; and respond to the access request based on the data access range and operation access range.

[0114] Optionally, the data access range and the operation access range are positively correlated with the target permission value; the security level of business data within the data access range is positively correlated with the target permission value; and the sensitivity of operation behaviors within the operation access range is positively correlated with the target permission value.

[0115] Optionally, the first permission information determination module 330 is used to: map the multi-dimensional authentication information to authentication values ​​based on the mapping relationship between multi-dimensional authentication information and values; and perform fusion processing on the authentication values ​​corresponding to the multi-dimensional authentication information based on the fusion authentication calculation model of multi-dimensional authentication information to obtain the basic permission values.

[0116] Optionally, the second permission information determination module 340 is used to perform at least one of the following: processing the access time of the access request and the time authorization information corresponding to the client based on a time adjustment function to obtain a first adjustment permission value; processing the location information corresponding to the access request and the spatial authorization information corresponding to the client based on a spatial adjustment function to obtain a second adjustment permission value; processing the historical operation behavior of the client and the behavior authorization information corresponding to the client based on a behavior adjustment function to obtain a third adjustment permission value; and processing the business status of the business system based on a business status adjustment function to obtain a fourth adjustment permission value.

[0117] Optionally, the access request response module 350 performs one of the following actions: executes the access request and returns the request result corresponding to the access request; rejects the access request; or provides secondary permission verification to the client.

[0118] The access permission management device for a business system provided in this disclosure can execute the access permission management method for a business system provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of executing the method.

[0119] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0120] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0121] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0122] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as access control methods for business systems.

[0123] In some embodiments, the access control method of the business system may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via read-only memory (ROM) 12 and / or communication unit 19. When the computer program is loaded into random access memory (RAM) 13 and executed by processor 11, one or more steps of the access control method of the business system described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the access control method of the business system by any other suitable means (e.g., by means of firmware).

[0124] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0125] Computer programs used to implement the access control methods of the business systems disclosed herein can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0126] This disclosure also provides a computer-readable storage medium storing computer instructions for causing a processor to execute an access control method for a business system, the method comprising:

[0127] The system receives a client's access request to the business system, obtains multi-dimensional authentication information corresponding to the access request, including authentication information corresponding to at least one dimension: user dimension, resource dimension, environment dimension, and business status dimension; performs first-level permission authentication on the access request based on the multi-dimensional authentication information to obtain first-level permission information corresponding to the access request; obtains at least one of the client's time authorization information, space authorization information, behavior authorization information, and business status information to perform second-level permission authentication on the access request to obtain second-level permission information corresponding to the access request; determines target permission information corresponding to the access request based on the first-level permission information and the second-level permission information, and responds to the access request based on the target permission information.

[0128] In the context of this disclosure, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0129] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0130] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0131] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0132] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0133] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method of managing access rights of a business system, characterized by, Comprise: Receiving an access request of a client to a business system, obtaining multi-dimensional authentication information corresponding to the access request, the multi-dimensional authentication information comprising authentication information corresponding to user dimension, resource dimension, environment dimension and business state dimension, different information contents of the same item of authentication information in the multi-dimensional authentication information corresponding to different numerical values; Based on the multi-dimensional authentication information, the access request is subjected to first-level permission authentication, and first permission information corresponding to the access request is obtained; At least one of the time authorization information, the space authorization information, the behavior authorization information and the business state information corresponding to the client is obtained to perform second-level permission authentication on the access request, and second permission information corresponding to the access request is obtained; Based on the first permission information and the second permission information, target permission information corresponding to the access request is determined, and the access request is responded based on the target permission information; The first permission information is a basic permission value, and the second permission information is an adjusted permission value; the target permission information is a target permission value; The target permission value is determined based on the basic permission value and the adjusted permission value; Wherein, the response to the access request based on the target permission information comprises: According to the target permission value, the data access range and the operation access range corresponding to the client are determined; According to the data access range and the operation access range, the access request is responded.

2. The method of claim 1, wherein, The data access range and the operation access range are positively correlated with the target permission value respectively; the security level of the business data in the data access range is positively correlated with the target permission value; the sensitivity of the operation behavior in the operation access range is positively correlated with the target permission value.

3. The method of claim 1, wherein, The determination method of the basic permission value comprises: Based on the mapping relationship between multi-dimensional authentication information and numerical value, the multi-dimensional authentication information is mapped into authentication value; Based on the fusion authentication calculation model of multi-dimensional authentication information, the authentication value corresponding to the multi-dimensional authentication information is fused to obtain the basic permission value.

4. The method of claim 1, wherein, The adjusted permission value is determined based on at least one of the following: Based on the time adjustment function, the access time of the access request and the time authorization information corresponding to the client are processed to obtain a first adjusted permission value; Based on the space adjustment function, the position information corresponding to the access request and the space authorization information corresponding to the client are processed to obtain a second adjusted permission value; Based on the behavior adjustment function, the historical operation behavior of the client and the behavior authorization information corresponding to the client are processed to obtain a third adjusted permission value; Based on the business state adjustment function, the business state of the business system is processed to obtain a fourth adjusted permission value.

5. The method of claim 1, wherein, The response mode of the access request comprises at least one of the following: Execute the access request and feedback the request result corresponding to the access request; Reject the access request; Provide secondary permission verification for the client.

6. An access authority management apparatus of a business system, characterized by comprising: Comprise: Request receiving module, receiving an access request of a client to a business system; The information acquisition module is configured to acquire multi-dimensional authentication information corresponding to the access request, the multi-dimensional authentication information including authentication information corresponding to a user dimension, a resource dimension, an environment dimension, and a business state dimension, different information contents of a same item of authentication information in the multi-dimensional authentication information corresponding to different numerical values; The first permission information determination module is configured to perform first-level permission authentication on the access request based on the multi-dimensional authentication information, to obtain first permission information corresponding to the access request; The second permission information determination module is configured to perform second-level permission authentication on the access request by acquiring at least one of time authorization information, space authorization information, behavior authorization information, and business state information corresponding to the client, to obtain second permission information corresponding to the access request; The access request response module is configured to determine target permission information corresponding to the access request based on the first permission information and the second permission information, and to respond to the access request based on the target permission information; The first permission information is a basic permission numerical value, and the second permission information is an adjusted permission numerical value; the target permission information is a target permission numerical value; The target permission numerical value is determined based on the basic permission numerical value and the adjusted permission numerical value; The access request response module is configured to determine a data access range and an operation access range corresponding to the client according to the target permission numerical value, and to respond to the access request according to the data access range and the operation access range.

7. An electronic device, comprising: The electronic device includes: at least one processor; and a memory connected with the at least one processor in communication; wherein The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the access permission management method of the business system according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to implement the access permission management method of the business system according to any one of claims 1-5 when executed.

Images