Data automation governance method and system based on big model

Abstract

This invention relates to the field of big data management technology, specifically to a data automation governance method and system based on a large model. This method categorizes data sensitivity and employee access levels based on different data types within departments and employee attribute characteristics within an enterprise. It then analyzes the business relevance between different departments within the enterprise, and, combined with the corresponding cross-departmental employee access levels and sensitivity levels, determines permission adjustment coefficients to adjust employee levels for cross-departmental business operations, thereby achieving access control. Based on data access and sensitivity within departments, this invention establishes cross-departmental data access permission policies for employees through business relevance between different departments, improving the security and efficiency of enterprise-wide data access permission management.

Description

Technical Field

[0001] This invention relates to the field of big data management technology, specifically to a data automation governance method and system based on large models. Background Technology

[0002] As enterprises grow, the amount of data they handle increases exponentially. Furthermore, related data permissions need to be dynamically adjusted in response to changes in business operations, organizational structure, and compliance requirements. At the same time, enterprise data access control strategies need to be dynamically generated based on factors such as data content and user roles, resulting in extremely complex rules and high difficulty for manual processing. Therefore, building a large-scale model-based automated data processing method based on "data access control strategies" and "data security strategies" is an inevitable choice.

[0003] Currently, enterprise data access control typically uses RBAC / ABAC permission models, defining different access permissions based on the target's role or attributes. However, if an enterprise has multiple departments, and employees need to access data across departments, involving multiple departments and data types, the model may need to define too many attributes and roles for detailed access control. This complexity in configuration and management can lead to permission conflicts, poor scalability, and consequently affect the stability and manageability of the enterprise. Summary of the Invention

[0004] To address the technical problems in the prior art, the present invention aims to provide a data automation governance method and system based on a large model, the specific technical solution of which is as follows:

[0005] This invention provides an automated data governance method based on large models, the method comprising:

[0006] Retrieve the indexes of each data type and employees at each job level within each department of the enterprise database;

[0007] Based on the confidentiality and access status of each data type, obtain the sensitivity index for each data type; based on each employee's professional level, obtain the access index for each employee according to the redundancy of historical access and allowed access data type indexes; synchronously classify and mark the sensitivity index of data types and the access index of employees in each department to obtain the sensitivity level of data types and the access level of employees in each department.

[0008] In each cross-departmental business, the degree of association between each pair of departments is obtained based on the access association; based on the deviation distribution between the access level of each employee in each department and the sensitivity level in each other department in the cross-departmental business, the permission adjustment coefficient of each employee to each other department is obtained in combination with the degree of association.

[0009] The access level of each employee in each department is adjusted according to the permission adjustment coefficient to obtain the employee's access permission level to other departments; access control is carried out based on the permission level of employees between departments and the sensitivity level of data types.

[0010] Furthermore, the method for obtaining the sensitive indicators includes:

[0011] For any data type in any department, obtain the confidentiality assessment score of that data type; combine the confidentiality assessment score of that data type with its lifecycle length to obtain the static sensitivity of that data type.

[0012] Calculate the average daily access frequency of this data type within a preset time period, where the preset time period is longer than one week;

[0013] The product of the daily average access frequency of this data type (which is negatively correlated with the static sensitivity) and the value is used as the sensitivity index for this data type.

[0014] Furthermore, the method for obtaining the access metrics includes:

[0015] For any employee in any department, obtain the index combination of data types involved in the employee's historical access during a preset time period, and use it as the employee's historical access set; use the index combination of data types that the employee is allowed to access at the employee's job level, and use it as the employee's allowed access set.

[0016] Calculate the intersection-union ratio of the employee's historical access set and the allowed access set, and use it as the reasonableness of the employee's behavior;

[0017] Based on the reasonableness of the employee's behavior and their professional level, obtain the employee's access metrics.

[0018] Furthermore, the process of synchronously classifying and marking the sensitivity indicators of data types and the access indicators of employees in each department to obtain the sensitivity level of data types and the access level of employees in each department includes:

[0019] For any department, sort all data types in the department in descending order of sensitivity index to obtain the sensitivity sequence of the department; sort all employees in the department in descending order of access index to obtain the access sequence of the department.

[0020] Calculate the difference in sensitivity index between every two adjacent data types in the sensitivity sequence, and take the data type with the largest sensitivity index among the two data types with the largest difference in sensitivity index as the partition type; take the data type with a sensitivity index less than the partition type as a subsequence, and take the remaining data types as another subsequence;

[0021] For each subsequence, iteratively determine the partitioning type and partition it until the preset number of iterations is reached to obtain all subsequences; arrange all subsequences in descending order of the mean of the sensitivity index to obtain the sensitivity level sequence; and use the index of each data type in the sensitivity level sequence as the sensitivity level of each data type.

[0022] Based on the sensitivity level, the access sequence is divided to obtain the employee's access level.

[0023] Furthermore, the step of dividing the access sequence based on the sensitivity level to obtain the employee's access level includes:

[0024] Calculate the difference in access metrics between any two adjacent employees in the access sequence. Select the employee with the largest access metric among the two employees with the largest difference in access metrics as the dividing employee. Select employees with access metrics less than the dividing employee as one subsequence and the remaining employees as another subsequence.

[0025] For each subsequence, iteratively determine the partitioning type and partition it until the preset number of iterations is reached to obtain all subsequences; arrange all subsequences in descending order of the mean of the access index to obtain the access level sequence; and use the sequence number of each employee in the access level sequence as the access level of each employee.

[0026] Furthermore, the method for obtaining the correlation degree includes:

[0027] For any two departments in any cross-departmental business, obtain the average daily access frequency of each department to the other department; combine the average daily access frequency of the two departments to obtain the mutual access index of the two departments.

[0028] Obtain the business time periods of the two departments in the cross-departmental business; use the intersection duration of the business time periods of the two departments as the time synchronization degree of the two departments;

[0029] By combining the mutual visit indicators and time synchronization of the two departments, the correlation between the two departments can be obtained.

[0030] Furthermore, the method for obtaining the permission adjustment coefficient includes:

[0031] For any department in any cross-departmental business, each other department in the cross-departmental business except for that department is successively regarded as the analysis department; obtain the minimum sensitivity level of the data type accessed by that department in the analysis department data, as the requirement sensitivity level; calculate the difference between the requirement sensitivity level and the access level of each employee in that department, and obtain the permission level difference of each employee in that department.

[0032] When the permission level difference is negative, the ratio of the normalized value of the employee's permission level difference to the correlation degree is used as the employee's permission adjustment coefficient for the analysis department. The permission adjustment coefficient is negative. When the permission level difference is zero, the permission adjustment coefficient is set to the preset adjustment coefficient.

[0033] When the permission level difference is positive, the product of the normalized value of the employee's permission level difference and the correlation degree is calculated as the demand degree. The sum of the normalized value of the employee's permission level difference and the demand degree is used to obtain the employee's permission adjustment coefficient for the analysis department.

[0034] Furthermore, the method for obtaining the permission level includes:

[0035] For any employee in any department, the product of the employee's access level and the employee's permission adjustment coefficient for each other department is used as the employee's adjustment degree for each other department.

[0036] The difference between the employee's access level and the employee's control level over each other department is rounded down to obtain the employee's authority level over each other department.

[0037] Furthermore, the access control based on employee permission levels and data type sensitivity levels between departments includes:

[0038] In cross-departmental business operations, when employees of one department access data types from other departments, an unauthorized access warning is issued if the employee's permission level for the other department is lower than the sensitivity level of the data type.

[0039] The present invention also provides a data automation governance system based on a large model, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the data automation governance method based on a large model as described above.

[0040] The present invention has the following beneficial effects:

[0041] This invention categorizes data sensitivity and employee access levels based on different data types within departments and employee attribute characteristics within current enterprise data. Then, it establishes corresponding cross-departmental data access permission policies based on the business relevance between different departments. This means adjusting cross-departmental approval permissions to address potential unauthorized data access needs by employees in different departments, and adjusting and deploying employee access permissions across departments for cross-departmental business transactions. This establishes a comprehensive access control strategy for data access across different departments within the enterprise. Based on internal departmental data access and data sensitivity, this invention establishes cross-departmental data access permission policies for employees through business relevance between different departments, improving the security and efficiency of internal enterprise data access permission management. Attached Figure Description

[0042] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 A flowchart of an automated data governance method based on a large model provided in one embodiment of the present invention;

[0044] Figure 2 This is a schematic diagram of a departmental data directory distribution provided in one embodiment of the present invention. Detailed Implementation

[0045] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a data automation governance method and system based on a large model proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0046] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0047] The following description, in conjunction with the accompanying drawings, details the specific scheme of the data automation governance method and system based on a large model provided by this invention.

[0048] Please see Figure 1The diagram illustrates a flowchart of an automated data governance method based on a large model, according to an embodiment of the present invention. The method includes the following steps:

[0049] S1: Retrieve the indexes of each data type under each department in the enterprise database and the employees at each job level.

[0050] For large enterprises, which typically have multiple departments, structuring and organizing data from these departments is a core task of data management and governance. Large enterprises generally have multiple internal databases. By horizontally partitioning the overall enterprise database, they can divide a single database into multiple independent nodes or distributed databases, thereby allocating corresponding storage space to each department. For different departmental databases, due to differences in data types and functions, please refer to [link / reference needed]. Figure 2 This illustrates a schematic diagram of a departmental data directory distribution provided by an embodiment of the present invention.

[0051] Based on the directory partitioning results, different types of data are stored using existing file management systems such as SharePoint, Google Drive, or Dropbox. Access logs for different data types and their corresponding business relationships are obtained, facilitating subsequent cross-departmental business analysis. To analyze the access permissions of different departments, this embodiment of the invention indexes and marks the data types of different departments. For each department, a corresponding index mechanism is established using hash indexing and query caching methods, with data type items as index keys. This allows different employees to easily mark data access and attribute permissions. It should be noted that data indexing is a well-known technique among those skilled in the art and will not be elaborated upon here.

[0052] For large enterprises with multiple departments and employees at different job levels, due to differences in data sensitivity, in order to ensure that "the right person can access the right data", the enterprise needs to establish corresponding access restrictions for different employees and data. Therefore, in this embodiment of the invention, internal job levels are determined for employees in different departments to divide the scope of allowed access permissions.

[0053] S2: Based on the confidentiality and access status of each data type, obtain the sensitivity index for each data type; based on each employee's professional level, and according to the repetition of historical access and allowed access data type indexes, obtain the access index for each employee; synchronously classify and mark the sensitivity index of data types and the access index of employees in each department to obtain the sensitivity level of data types and the access level of employees in each department.

[0054] Because data access control involves high system complexity when accessing data across departments, affecting access efficiency and data security, we first analyze different types of data and employee access attribute characteristics to classify data sensitivity and employee access levels, so as to facilitate subsequent analysis of access permissions for business-related data between different departments.

[0055] Firstly, sensitivity is quantified by considering both static storage and dynamic access of data types, allowing sensitivity assessments to better align with the actual business value of the data. For internal data in any department, some data may be confidential documents, intended for internal use only, while other data needs to be made public. Therefore, the sensitivity of confidential data is higher, while the sensitivity of less important data that can be made public is lower.

[0056] Therefore, considering both confidentiality and access status, sensitivity indicators are obtained for each data type. Preferably, in this embodiment of the invention, the method for obtaining sensitivity indicators includes:

[0057] For any data type in any department, obtain the confidentiality assessment score of that data type. In a specific embodiment of the present invention, the density of all types of data in the department is assessed based on a trained AI model, such as GPT, BERT or T5. The model will generate a corresponding confidentiality label coefficient as a confidentiality assessment score based on the consequences of data leakage, capturing the inherent sensitive attributes of the data content. The higher the confidentiality assessment score, the more likely the data type is to be confidential.

[0058] Furthermore, by combining the confidentiality assessment score and lifecycle length of the data type, the static sensitivity of the data type is obtained. Here, the lifecycle reflects the long-term value of the data. For example, core technical documents have a long lifecycle, and the impact of leakage is more lasting. The lifecycle is the total time from data creation to destruction. In this embodiment of the invention, the product of the confidentiality assessment score and the lifecycle length of the data type is normalized to obtain the static sensitivity of the data type. When both the confidentiality assessment score and the lifecycle length are larger, the data type is more likely to be related to the company's core technology and strategic planning, and the impact of leakage will be more serious. Therefore, the corresponding sensitivity is greater.

[0059] It should be noted that normalization is a technique well known to those skilled in the art. The choice of normalization can be linear normalization or standard normalization, etc., and the specific normalization method is not limited here.

[0060] In this embodiment of the invention, the lifecycle data can be measured in years, representing the time period from the generation of the data type to its expiration. For example, financial data is retained for 7 years, and operational data is retained for 1 year. It should be noted that the lifecycle is explicitly defined by the enterprise's data governance policy or automatically matched through data type. For example, the default lifecycle for contract data is 3 years, and no specific limitation is made here.

[0061] Based on the current dynamic access status of the data type and considering the potential fluctuations in sensitivity at the current stage, the average daily access frequency of the data type within a preset time period is calculated. The preset time period is longer than one week. In this embodiment of the invention, the preset time period can be selected as one month. The total number of accesses within the preset time period is divided by the number of days to obtain the average daily access frequency. The average daily access frequency reflects the current actual public demand for the data type. The more frequent the access, the more it needs to be shared, and the more its sensitive attributes are weakened.

[0062] Therefore, the product of the daily average access frequency of this data type, which is negatively correlated, and the static sensitivity is used as the sensitivity index for this data type. It should be noted that negative correlation mapping is a technique well-known to those skilled in the art; for example, inverse proportional or negative exponential forms can be used, which will not be elaborated or limited here.

[0063] At this point, sensitivity assessments have been completed for all data types within the department. Data access is generally conducted by department employees, but employees at different job levels have different levels of access permissions. To ensure that employee access permissions match the sensitivity of the data, it is necessary to assess the access status of different employees within the department simultaneously.

[0064] Generally, for employees within a department, those with higher access privileges can access more sensitive data. However, an employee's job title only determines the level of their data access privileges. Relying solely on job title, such as granting managers access to all data, ignores the actual needs and behavioral changes of employees in business operations. This leads to the creation of numerous requests for access, resulting in either excessive privileges without actual needs or insufficient privileges despite having the necessary requirements.

[0065] Therefore, the method combines the overlap between permitted access and actual access as reflected in business needs, as well as a comprehensive assessment of professional levels. Preferably, in this embodiment of the invention, the method for obtaining access metrics includes:

[0066] For any employee in any department, obtain the index combinations of data types accessed by that employee during a preset time period, which constitute the employee's historical access set, obtained based on the employee's access status at the current business stage. Then, obtain the index combinations of data types that are allowed to be accessed at the employee's job level, which constitute the employee's allowed access set. The allowed access set consists of the index datasets that the employee needs to access to complete their job duties.

[0067] As an example, the data types that a sales employee is allowed to access include: Customer Information Table (index C001), Sales Performance Table (index S002), and Regional Market Data (index M003), with a allowed access set {C001, S002, M003}. The data types that have actually been accessed during a preset period may include: Customer Information Table (index C001) and Product Inventory Table (index K004), with a historical access set {C001, K004}.

[0068] Therefore, we further calculate the intersection-union ratio (IUR) of the employee's historical access set and allowed access set as the reasonableness of the employee's behavior. The larger the IUR, the higher the overlap between the required data and the historical data access situation, indicating that the employee's access is more standardized and the access permission level is more reliable.

[0069] Finally, by combining the employee's behavior rationality and job level, the employee's access index is obtained. In this embodiment of the invention, the product of the employee's behavior rationality and job level is used as the employee's access index. The degree of data access permission of the employee is weighted by the job level with behavior rationality as the weight.

[0070] After determining the data type sensitivity and employee access permissions within each department, to facilitate subsequent cross-departmental analysis, a unified classification was implemented for different data across different departments. The corresponding hierarchical relationships were redefined, and a consistent classification was carried out for each department to achieve the deployment of data access permission policies within each department.

[0071] Preferably, in this embodiment of the invention, the method for determining the sensitivity level of data types and the access level of employees in each department includes:

[0072] First, for any department, sort all data types in the department in descending order of sensitivity index to obtain the sensitivity sequence of the department. Then, sort all employees in the department in descending order of access index to obtain the access sequence of the department.

[0073] Further, sensitivity levels are determined based on the sensitive sequence segmentation. The difference in sensitivity indices between each pair of adjacent data types in the sensitive sequence is calculated. The data type with the largest sensitivity index among the two data types with the largest difference in sensitivity indices is taken as the segmentation type. Data types with sensitivity indices smaller than the segmentation type are taken as one subsequence, and the remaining data types are taken as another subsequence. A single segmentation is performed based on the maximum and minimum differences in the indices between adjacent elements.

[0074] Considering the departmental situation, each subsequence can be iteratively divided to determine the division type until the number of iterations reaches the preset number of divisions to obtain all subsequences. In a specific embodiment of the present invention, the preset number of divisions is 2, that is, the sensitive sequence is divided into four subsequences after 2 iterations.

[0075] Then, all subsequences are arranged from largest to smallest according to the mean of the sensitivity index, resulting in a sensitivity level sequence. The higher the overall sensitivity index in each subsequence, the more sensitive the data and the higher the level of confidentiality. The index of each data type in the sensitivity level sequence is used as the sensitivity level of that data type; that is, the smaller the index, the greater the sensitivity. As an example, when the final number of subsequences is 4, the sensitivity levels from 1 to 4 can represent the sensitivity levels as confidential, sensitive, internal, and public, respectively.

[0076] Similarly, based on the sensitivity level, the access sequence is divided to obtain the employee's access level. In this embodiment of the invention, the difference in access indicators between every two adjacent employees in the access sequence is calculated. The employee with the largest access indicator among the two employees with the largest difference in access indicators is selected as the dividing employee. Employees with access indicators less than the dividing employee are divided into one subsequence, and the remaining employees are divided into another subsequence. A single division is performed based on the maximum or minimum difference in indicator values ​​between adjacent elements.

[0077] For each subsequence, the partitioning type is determined iteratively and divided until the preset number of partitions is reached, resulting in all subsequences. Employee access level partitioning is synchronized with sensitivity partitioning. All subsequences are arranged in descending order of the mean of the access index, resulting in an access level sequence. The higher the access index of each subsequence, the higher the employee's access privileges. The sequence number of each employee in the access level sequence is used as their access level; that is, the smaller the sequence number, the higher the employee's access privileges. As an example, when the final number of subsequences is 4, access levels 1 to 4 can respectively represent the access control levels of General Manager, Senior Management, Middle Management, and General Manager.

[0078] This completes the initial deployment of access permissions for sensitive data within the department.

[0079] S3: In each cross-departmental business, obtain the degree of association between each pair of departments based on the access association; based on the deviation distribution between the access level of each employee in each department and the sensitivity level in each other department in the cross-departmental business, combine the degree of association to obtain the permission adjustment coefficient of each employee to each other department.

[0080] Because different departments are not independent but have various interconnected and collaborative business processes, cross-departmental data access by employees is inevitable. However, since there are no corresponding access rules for cross-departmental data access by different employees, access policies have certain limitations and are prone to data security issues. Therefore, based on the interrelationships between different departments due to their business processes, this paper analyzes the differences in business relationships between departments and any other department, and automatically adjusts employee permissions through cross-departmental business relationships. Employees in departments with strong interrelationships are granted relatively higher access permissions to facilitate efficient business execution.

[0081] Preferably, in this embodiment of the invention, the method for obtaining the correlation degree includes:

[0082] First, for any two departments in any cross-departmental business, obtain the average daily access frequency of each department to the other department. Combine the average daily access frequencies of the two departments to obtain the mutual access index of the two departments. In this embodiment of the invention, the product of the average daily access frequencies of the two departments is used as the mutual access index of the two departments. The larger the mutual access index, the greater the correlation between the two departments in this business.

[0083] Then, the business periods of the two departments in this cross-departmental business are obtained, and the intersection length of the business periods of the two departments is used as the time synchronization degree of the two departments. The time synchronization degree reflects the length of overlap of the time windows when the two departments perform the same business. As an example, if the business period of department A is from March 1st to March 10th, and the business period of department B is from March 5th to March 15th, then the time synchronization degree is 5 days, or 120 hours. Generally, multiple related departments have dependencies in performing the same business, that is, business work is usually carried out in succession. The synchronization degree between departments with strong business correlation should be lower.

[0084] Therefore, the correlation between the two departments is obtained by combining the mutual visit index and the time synchronization degree. In this embodiment of the invention, the product of the time synchronization degree after negative correlation mapping and the mutual visit index is normalized to obtain the correlation between the two departments.

[0085] For any given department, the greater its correlation with other departments in cross-departmental business, the greater its access rights to data from those other departments, and vice versa. However, access permissions for cross-departmental data access need to be limited. Since different employees have different access levels, they still need to follow the corresponding permission rules when accessing cross-departmental data.

[0086] Different business operations require access to data types with varying sensitivities. For employees, there are situations where the access level is greater than, less than, or equal to the sensitivity level. To ensure the smooth and efficient operation of the business, permissions are adjusted based on the departmental relationships within the business.

[0087] In this embodiment of the invention, the method for obtaining the permission adjustment coefficient includes:

[0088] For any department within a cross-departmental business, treat each other department in that cross-departmental business as an analysis department and analyze each of them sequentially. Obtain the minimum sensitivity level of the data type accessed by that department in the analysis department's data; this is the required sensitivity level, which is also the highest sensitivity level that needs to be accessed.

[0089] Then, the difference between the demand sensitivity level and the access level of each employee in the department is calculated to obtain the permission level difference for each employee in the department. When the permission level difference is positive, it means that the employee's access level is lower than the data sensitivity level, and the employee's access level needs to be appropriately increased to facilitate data access. Conversely, when the permission level difference is negative, it means that the employee's access level is higher than the data sensitivity level, and the employee's access level to the analysis department needs to be appropriately decreased to prevent excessive access. When the permission level difference is 0, the two levels are equal and no adjustment is needed.

[0090] Furthermore, when the permission level difference is negative, the ratio of the normalized value of the employee's permission level difference to the correlation is used as the employee's permission adjustment coefficient for the analysis department. The permission adjustment coefficient is negative. When the permission level difference is larger and the correlation is smaller, it indicates that the employee may be over-accessing the analysis department's data with the access level. Therefore, the employee's access permission is appropriately suppressed in combination with the correlation. The smaller the correlation, the higher the degree of suppression, that is, the larger the negative permission adjustment coefficient.

[0091] Furthermore, when the difference in permission levels is zero, the permission adjustment coefficient is set to a preset adjustment coefficient. In this embodiment of the invention, the preset adjustment coefficient is set to zero, and no adjustment is required at this time.

[0092] Furthermore, when the permission level difference is positive, the product of the normalized value of the employee's permission level difference and the correlation degree is calculated as the demand degree. The sum of the normalized value of the employee's permission level difference and the demand degree yields the employee's permission adjustment coefficient for the analytics department. The larger the permission level difference, the more likely the employee is to be restricted when accessing the analytics department before reaching the highest sensitivity level. Therefore, the greater the correlation between the two departments, the higher the degree of adjustment can be, hence the permission adjustment coefficient is positive and larger.

[0093] S4: Adjust the access level of each employee in each department according to the permission adjustment coefficient to obtain the employee's access permission level to other departments; perform access control based on the permission level of employees between departments and the sensitivity level of data types.

[0094] Finally, permission management is deployed for cross-departmental access using permission adjustment coefficients to determine the permission level of employees. In this embodiment of the invention, for any employee in any department, the product of the employee's access level and the employee's permission adjustment coefficient for each other department is used as the adjustment degree of the employee for each other department. When the permission adjustment coefficient is positive, the permission level needs to be increased, that is, the level value needs to be smaller. When the permission adjustment coefficient is negative, the permission level needs to be suppressed, that is, the level value needs to be larger.

[0095] Finally, the difference between the employee's access level and the employee's adjustment degree to each other department is rounded to obtain the employee's permission level to each other department. In this embodiment of the invention, the rounding is rounded up to ensure the necessary existence of the level. The smaller the permission level, the greater the access permission configuration and the higher the sensitivity of the accessible data.

[0096] In other specific embodiments of the present invention, if the difference in permission levels is too large, such as exceeding half of the total number of levels, it is very likely that even after adjustment, some highly sensitive data will still not be available. In this case, an access request can be submitted to the administrator of the department being accessed. If the request is approved, the department being accessed needs to grant independent access permission to access the data in order to ensure the security of data access.

[0097] In this embodiment, the inconsistency of access policies within different departments is considered, and cross-departmental data access permissions are automatically managed and controlled. This allows for more efficient management of data access permissions across multiple departments. During cross-departmental business operations, if an employee's permission level for another department's data type is lower than the data type's sensitivity level, an unauthorized access warning is issued. An alert is automatically generated and relevant personnel are notified, assisting in access authorization and control. Furthermore, the permission levels for different employees can be updated periodically to ensure smooth business execution.

[0098] In summary, this invention categorizes data sensitivity and employee access levels based on different data types within departments and employee attribute characteristics within current enterprise data. Then, it establishes corresponding cross-departmental data access permission policies based on the business relevance between different departments within the enterprise. This means adjusting cross-departmental approval permissions to address potential unauthorized data access needs by employees in different departments, and adjusting and deploying employee access permissions across departments for cross-departmental business transactions. This establishes a comprehensive access control strategy for data access across different departments within the enterprise. Based on internal departmental data access and data sensitivity, this invention establishes cross-departmental data access permission policies for employees through business relevance between different departments, improving the security and efficiency of internal enterprise data access permission management.

[0099] The present invention also provides a data automation governance system based on a large model, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the data automation governance method based on a large model as described above.

[0100] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0101] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A data automation governance method based on a large model, characterized in that, The method includes: Retrieve the indexes of each data type and employees at each job level within each department of the enterprise database; Based on the confidentiality and access status of each data type, obtain the sensitivity index for each data type; based on each employee's professional level, obtain the access index for each employee according to the redundancy of historical access and allowed access data type indexes; synchronously classify and mark the sensitivity index of data types and the access index of employees in each department to obtain the sensitivity level of data types and the access level of employees in each department. In each cross-departmental business, the degree of association between each pair of departments is obtained based on the access association; based on the deviation distribution between the access level of each employee in each department and the sensitivity level in each other department in the cross-departmental business, the permission adjustment coefficient of each employee to each other department is obtained in combination with the degree of association. The access level of each employee in each department is adjusted according to the permission adjustment coefficient to obtain the employee's access permission level to other departments; access control is carried out based on the permission level of employees between departments and the sensitivity level of data types. The method for obtaining the correlation degree includes: For any two departments in any cross-departmental business, obtain the average daily access frequency of each department to the other department; combine the average daily access frequency of the two departments to obtain the mutual access index of the two departments. Obtain the business time periods of the two departments in the cross-departmental business; use the intersection duration of the business time periods of the two departments as the time synchronization degree of the two departments; By combining the mutual visit indicators and time synchronization of the two departments, the correlation between the two departments can be obtained.

2. The data automation governance method based on a large model according to claim 1, characterized in that, The methods for obtaining the sensitive indicators include: For any data type in any department, obtain the confidentiality assessment score of that data type; combine the confidentiality assessment score of that data type with its lifecycle length to obtain the static sensitivity of that data type. Calculate the average daily access frequency of this data type within a preset time period, where the preset time period is longer than one week; The product of the daily average access frequency of this data type (which is negatively correlated with the static sensitivity) and the value is used as the sensitivity index for this data type.

3. The data automation governance method based on a large model according to claim 1, characterized in that, The methods for obtaining the access metrics include: For any employee in any department, obtain the index combination of data types involved in the employee's historical access during a preset time period, and use it as the employee's historical access set; use the index combination of data types that the employee is allowed to access at the employee's job level, and use it as the employee's allowed access set. Calculate the intersection-union ratio of the employee's historical access set and the allowed access set, and use it as the reasonableness of the employee's behavior; Based on the reasonableness of the employee's behavior and their professional level, obtain the employee's access metrics.

4. The data automation governance method based on a large model according to claim 1, characterized in that, The process of synchronously classifying and marking the sensitivity indicators of data types and the access indicators of employees in each department to obtain the sensitivity level of data types and the access level of employees in each department includes: For any department, sort all data types in the department in descending order of sensitivity index to obtain the sensitivity sequence of the department; sort all employees in the department in descending order of access index to obtain the access sequence of the department. Calculate the difference in sensitivity index between every two adjacent data types in the sensitivity sequence, and take the data type with the largest sensitivity index among the two data types with the largest difference in sensitivity index as the partition type; take the data type with a sensitivity index less than the partition type as a subsequence, and take the remaining data types as another subsequence; For each subsequence, iteratively determine the partitioning type and partition it until the preset number of iterations is reached to obtain all subsequences; arrange all subsequences in descending order of the mean of the sensitivity index to obtain the sensitivity level sequence; and use the index of each data type in the sensitivity level sequence as the sensitivity level of each data type. Based on the sensitivity level, the access sequence is divided to obtain the employee's access level.

5. The data automation governance method based on a large model according to claim 4, characterized in that, The process of dividing the access sequence based on sensitivity levels to obtain employee access levels includes: Calculate the difference in access metrics between any two adjacent employees in the access sequence. Select the employee with the largest access metric among the two employees with the largest difference in access metrics as the dividing employee. Select employees with access metrics less than the dividing employee as one subsequence and the remaining employees as another subsequence. For each subsequence, iteratively determine the partitioning type and partition it until the preset number of iterations is reached to obtain all subsequences; arrange all subsequences in descending order of the mean of the access index to obtain the access level sequence; and use the sequence number of each employee in the access level sequence as the access level of each employee.

6. The automated data governance method based on a large model according to claim 1, characterized in that, The method for obtaining the permission adjustment coefficient includes: For any department in any cross-departmental business, each other department in the cross-departmental business except for that department is successively regarded as the analysis department; obtain the minimum sensitivity level of the data type accessed by that department in the analysis department data, as the requirement sensitivity level; calculate the difference between the requirement sensitivity level and the access level of each employee in that department, and obtain the permission level difference of each employee in that department. When the permission level difference is negative, the ratio of the normalized value of the employee's permission level difference to the correlation degree is used as the employee's permission adjustment coefficient for the analysis department. The permission adjustment coefficient is negative. When the permission level difference is zero, the permission adjustment coefficient is set to the preset adjustment coefficient. When the permission level difference is positive, the product of the normalized value of the employee's permission level difference and the correlation degree is calculated as the demand degree. The sum of the normalized value of the employee's permission level difference and the demand degree is used to obtain the employee's permission adjustment coefficient for the analysis department.

7. The data automation governance method based on a large model according to claim 6, characterized in that, The methods for obtaining the permission level include: For any employee in any department, the product of the employee's access level and the employee's permission adjustment coefficient for each other department is used as the employee's adjustment degree for each other department. The difference between the employee's access level and the employee's control level over each other department is rounded down to obtain the employee's authority level over each other department.

8. The data automation governance method based on a large model according to claim 1, characterized in that, The access control based on employee permission levels and data type sensitivity levels between departments includes: In cross-departmental business operations, when employees of one department access data types from other departments, an unauthorized access warning is issued if the employee's permission level for the other department is lower than the sensitivity level of the data type.

9. A data automation governance system based on a large model, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the data automation governance method based on a large model as described in any one of claims 1 to 8.

Images