Authority control method and device, storage medium and electronic equipment

Abstract

The invention discloses an authority control method and device, a storage medium and electronic equipment, and relates to the field of artificial intelligence. The method comprises the following steps: receiving an operation request of a user for a target system, and obtaining operation environment information of the target system and user information of the user in the target system; inputting the operation request, the operation environment information and the user information into a dynamic permission decision model, and predicting the operation permission of the user by using the dynamic permission decision model; and controlling the operation request according to the operation authority. Through the method and the device, the problem of relatively poor accuracy of controlling the operation authority in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and more specifically, to a permission control method and device, a storage medium, and an electronic device. Background Art

[0002] Access control is a crucial security management measure in modern information systems. Its purpose is to ensure that users can access specific resources and functions based on their roles and needs, while preventing unauthorized access and operations. It protects information assets from unauthorized changes or disclosures by defining and enforcing access policies that limit users' operational capabilities within the system.

[0003] Existing permission control systems mostly employ two approaches: role-based access control and discretionary access control. Role-based access control predefines roles and associated permissions. Once a user is assigned to a role, their permissions are relatively fixed. Adjusting permissions relies on the administrator's active actions, making it difficult to adapt to rapidly changing user needs. This approach struggles to respond quickly when users need to temporarily grant or lose permissions in specific scenarios, leading to erroneous permission control decisions. In contrast, discretionary access control allows resource owners to independently determine the access rights granted to other users. While discretionary access control allows resource owners to independently determine access rights, it improves the agility of permission allocation. However, because permissions granted in this approach may not be constrained by unified policies, permission leaks are prone to occur. This can especially lead to inappropriate access to sensitive information if users lack a comprehensive understanding of system security policies. Consequently, existing permission control systems generally lack a comprehensive consideration of user behavior and the dynamic system environment, making it difficult for permission control policies to respond immediately and accurately. In a dynamic work environment, user operational needs frequently change, and system status fluctuates. Existing technologies, based on static role definitions and fixed permission lists, fail to capture and analyze these changes in real time, resulting in reduced accuracy in permission decisions.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The main purpose of this application is to provide a permission control method and device, a storage medium and an electronic device to solve the problem of poor accuracy in controlling operation permissions in related technologies.

[0006] To achieve the above objectives, according to one aspect of the present application, a permission control method is provided. The method comprises: receiving a user's operation request for a target system, obtaining the target system's operating environment information and the user's user information in the target system; inputting the operation request, operating environment information, and user information into a dynamic permission decision model, and using the dynamic permission decision model to predict the user's operation permission; and controlling the operation request based on the operation permission.

[0007] Furthermore, the operating environment information includes system load, network status and timestamp, and the use of the dynamic permission decision model to predict the user's operation authority includes: using the multi-dimensional policy decision sub-model in the dynamic permission decision model to predict the user's first permission result based on the operation request, system load, network status, timestamp and user information; using the user behavior pattern prediction sub-model in the dynamic permission decision model to predict the user's second permission result based on the operation request, system load, network status and user information; and using the fusion decision mechanism in the dynamic permission decision model to predict the user's operation authority based on the first permission result and the second permission result.

[0008] Furthermore, the user information includes the user registration time and the user IP address. The multidimensional policy decision sub-model in the dynamic permission decision model predicts the user's first permission result based on the operation request, system load, network status, timestamp and user information, including: reading the multidimensional policy decision configuration file, wherein the multidimensional policy decision configuration file includes at least system load detection parameters, operation time detection parameters, sensitive operation detection parameters, permission progressive detection parameters and abnormal operation detection parameters; determining the user's system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission based on the operation request, system load, network status, timestamp, user registration time, user IP address and the multidimensional policy decision configuration file; predicting the user's first permission result based on the system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission.

[0009] Furthermore, user information includes the user's user role and historical operation records in the target system. The user behavior pattern prediction sub-model includes a simplest permission prediction component and a second permission prediction component. The simplest permission prediction component is used to predict the simplest permission required for the operation request in the target system. The second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the simplest permission in the target system. Through the user behavior pattern prediction sub-model in the dynamic permission decision model, the second permission result of the user is predicted based on the operation request, system load, network status and user information, including: inputting the operation request, user role and historical operation records into the simplest permission prediction component to predict the target simplest permission corresponding to the operation request; inputting the target simplest permission, user role, system load and network status into the second permission prediction component to predict the second permission result corresponding to the target simplest permission.

[0010] Furthermore, the user information includes the user's user role and historical operation records in the target system. The user behavior pattern prediction sub-model includes a minimum permission prediction component and a second permission prediction component. The minimum permission prediction component is used to predict the minimum permission required for the operation request in the target system. The second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the minimum permission in the target system. The training steps of the user behavior pattern prediction sub-model include: obtaining a training data set for user behavior pattern recognition, wherein each data in the training data set includes an operation request, a user role, a historical operation record, a system load, a network status, at least one minimum permission label and a permission label; using the operation request, user role, and historical operation record as prediction factors, and at least one minimum permission label as a prediction target, using the training data set to train a preset time series prediction algorithm to obtain a minimum permission prediction component; using the user role, historical operation record, system load, network status, at least one minimum permission label as prediction factors, and the permission label as a prediction target, using the training data set to train a random forest algorithm to obtain a second permission prediction component; based on the minimum permission prediction component and the second permission prediction component, determining the user behavior pattern prediction sub-model.

[0011] Furthermore, through the fusion decision mechanism in the dynamic permission decision model, the user's operation authority is predicted based on the first permission result and the second permission result, including: determining the first predicted authority based on the first permission result and the first weight corresponding to the first permission result, and determining the second predicted authority based on the second permission result and the second weight corresponding to the second permission result; predicting the user's operation authority based on the first predicted authority and the second predicted authority.

[0012] Furthermore, after controlling the user operation request based on the user operation authority, the method also includes: obtaining the operation log of the dynamic authority decision model and the operation data information corresponding to the operation request; standardizing the operation log and the operation data information to obtain the audit log corresponding to the operation request, and submitting the audit log for audit.

[0013] Furthermore, after submitting the audit log for audit, the method also includes: receiving the audit results of the audit log, and screening out the audit logs whose audit results are permission misjudgments; correcting the audit logs whose audit results are permission misjudgments to obtain the target audit log; and updating the dynamic permission decision model based on the target audit log.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a permission control device is provided, including: a data perception unit, used to receive a user's operation request for a target system, and obtain the operating environment information of the target system and the user information of the user in the target system; a permission decision unit, used to input the operation request, operating environment information and user information into a dynamic permission decision model, and use the dynamic permission decision model to predict the user's operation permission; and a permission execution unit, used to control the operation request based on the operation permission.

[0015] Furthermore, the operating environment information includes system load, network status and timestamp, and the permission decision unit includes: a first decision module, which is used to predict the user's first permission result based on the operation request, system load, network status, timestamp and user information through the multi-dimensional policy decision sub-model in the dynamic permission decision model; a second decision module, which is used to predict the user's second permission result based on the operation request, system load, network status and user information through the user behavior pattern prediction sub-model in the dynamic permission decision model; and a third decision module, which is used to predict the user's operation permission based on the first permission result and the second permission result through the fusion decision mechanism in the dynamic permission decision model.

[0016] Furthermore, the user information includes user registration time and user IP address, and the first decision module includes: a first configuration submodule, used to read a multidimensional policy decision configuration file, wherein the multidimensional policy decision configuration file includes at least system load detection parameters, operation time detection parameters, sensitive operation detection parameters, permission progressive detection parameters and abnormal operation detection parameters; a first determination submodule, used to determine the user's system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission based on the operation request, system load, network status, timestamp, user registration time, user IP address and multidimensional policy decision configuration file; a first prediction submodule, used to predict the user's first permission result based on the system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission.

[0017] Furthermore, the user information includes the user's user role and historical operation records in the target system, and the user behavior pattern prediction sub-model includes a simplest permission prediction component and a second permission prediction component. The simplest permission prediction component is used to predict the simplest permission required for the operation request in the target system, and the second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the simplest permission in the target system. The second decision module includes: a simplest prediction sub-module, which is used to input the operation request, user role and historical operation records into the simplest permission prediction component to predict the target simplest permission corresponding to the operation request; a second prediction sub-module, which is used to input the target simplest permission, user role, system load, and network status into the second permission prediction component to predict the second permission result corresponding to the target simplest permission.

[0018] Furthermore, the user information includes the user role and historical operation records of the user in the target system, the user behavior pattern prediction sub-model includes a minimum permission prediction component and a second permission prediction component, the minimum permission prediction component is used to predict the minimum permission required for the operation request in the target system, and the second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the minimum permission in the target system. The device also includes: a data set acquisition unit, which is used to acquire a training data set for user behavior pattern recognition, wherein each data in the training data set includes an operation request, a user role, a historical operation record, a system load, a network status, at least one minimum permission label and a permission. Limited labels; a first training unit is used to use operation requests, user roles, and historical operation records as prediction factors, and at least one simplest permission label as a prediction target, and use the training data set to train the preset time series prediction algorithm to obtain a simplest permission prediction component; a second training unit is used to use user roles, historical operation records, system load, network conditions, and at least one simplest permission label as prediction factors, and use the permission label as a prediction target, and use the training data set to train the random forest algorithm to obtain a second permission prediction component; a third determination unit is used to determine the user behavior pattern prediction sub-model based on the simplest permission prediction component and the second permission prediction component.

[0019] Furthermore, the third decision module includes: a weight allocation submodule, which is used to determine the first predicted authority based on the first authority result and the first weight corresponding to the first authority result, and to determine the second predicted authority based on the second authority result and the second weight corresponding to the second authority result; and a result fusion submodule, which is used to predict the user's operation authority based on the first predicted authority and the second predicted authority.

[0020] Furthermore, the device also includes: an information collection unit, which is used to obtain the operation log of the dynamic authority decision model and the operation data information corresponding to the operation request after controlling the user operation request based on the user operation authority; a standardization unit, which is used to standardize the operation log and operation data information, obtain the audit log corresponding to the operation request, and submit the audit log for audit.

[0021] Furthermore, the device also includes: a screening unit, which is used to receive the audit results of the audit log after submitting the audit log for audit, and screen out the audit logs whose audit results are permission misjudgments; a correction unit, which is used to correct the audit logs whose audit results are permission misjudgments to obtain the target audit log; and an update unit, which is used to update the dynamic permission decision model based on the target audit log.

[0022] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer-readable storage medium is provided, the storage medium including a stored program, wherein the program executes any one of the above-mentioned permission control methods.

[0023] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is provided, which includes one or more processors and a memory, and the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned permission control methods.

[0024] Through this application, the following steps are adopted: receiving a user's operation request for a target system, and obtaining the target system's operating environment information and the user's user information in the target system; inputting the operation request, operating environment information, and user information into a dynamic permission decision model, and using the dynamic permission decision model to predict the user's operation permissions; controlling the operation request based on the operation permissions, thereby solving the problem of poor accuracy in controlling operation permissions in related technologies. By obtaining the operation request, operating environment information, and user information, status data related to the user and the target system is obtained. By inputting this status data into the dynamic permission decision model, the user's operation permissions can be dynamically predicted without the need for frequent manual adjustment of user permissions. Compared with the traditional single fixed permission management model, it can more accurately control user permissions and improve the accuracy of predicting operation permissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0026] Figure 1 is a flowchart of a permission control method provided according to an embodiment of the present application;

[0027] Figure 2 is a schematic diagram of a permission control device provided according to an embodiment of the present application;

[0028] Figure 3 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0030] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation portals for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation portals for users to choose to agree or refuse the automated decision-making results; if the user chooses to refuse, the expert decision-making process will be entered.

[0033] The present invention will be described below in conjunction with preferred implementation steps. Figure 1is a flowchart of the permission control method provided in accordance with an embodiment of the present application. Figure 1 As shown, the method includes the following steps:

[0034] Step S101: receiving a user's operation request for a target system, and obtaining the target system's operating environment information and the user's user information in the target system.

[0035] Optionally, when a user interacts with the target system, they may submit various types of operation requests. These can range from simple login attempts, data queries, file uploads, and feature configuration modifications to more complex business process initiations, such as approval processes and transaction confirmations. The target system's operating environment information characterizes the environmental conditions under which the target system receives and processes operation requests. This operating environment information can include system resource status, network conditions, time information, and geographic location information. User information is specific to the user's operations within the target system and can be the user's past behavior patterns within the target system. This information is used to provide a more accurate basis for permission prediction.

[0036] For example, by using an application gateway or front-end service interface to capture user operational behavior information in the target system, the information may include the type of operation (e.g., login, query, modification, deletion), the object of operation (e.g., file, database record, application function, etc.), the time of operation, and the location of operation (e.g., the geographical location of the IP address). These operational behavior information are stored in a standardized format as user operation requests for the target system. Information such as CPU usage, memory usage, disk space, and network bandwidth may be collected as system resource status to determine whether the system is under high load; network latency, packet loss rate, and connection stability may be collected as network status; the current date and time, and whether it is working hours, may be collected as time information; and the IP address or GPS location of the target system may be collected as geographical location information. Information such as the user's role in the target system and historical operation records may be collected as the aforementioned user information.

[0037] Step S102: Input the operation request, operating environment information and user information into a dynamic authority decision model, and use the dynamic authority decision model to predict the user's operation authority.

[0038] Optionally, a dynamic permission decision model is used to predict user operation permissions based on collected operation requests, operating environment information, and user information. This means that the prediction process for operation permissions is based on user and target system data at the time each operation request is triggered, enabling dynamic prediction of operation permissions. The training step for the dynamic permission decision model can be to collect historical data samples of operation requests, operating environment information, and user information, annotate the actual operation permissions possessed by each historical data sample to construct a training dataset, and then use this training dataset to select an appropriate artificial intelligence algorithm for training iterations to obtain the dynamic permission decision model.

[0039] For example, based on the historical interaction records between the user and the target system, multiple historical data samples such as operation requests, CPU usage, memory usage, whether it is working hours, network delay, packet loss rate, and the user's role in the target system can be collected, and the labels of the actual operation permissions under each historical data sample can be annotated to construct a training data set. The user's actual operation permissions can be either the actual permissions (such as data reading and data writing permissions) or whether the user is allowed to execute the operation requests in the historical data samples (such as allowed or not allowed).

[0040] Step S103: Control the operation request according to the operation authority.

[0041] For example, the operation request can be controlled based on the operation authority predicted in step S102. The data form of the operation authority can be the operation authority actually possessed by the user, and the data form of the operation authority can also be allowed or not. When the data form of the operation authority is the operation authority actually possessed by the user, it is determined whether the operation request complies with the operation authority possessed by the user. If it does, the operation request is allowed to proceed; otherwise, the operation request is rejected and a corresponding error message is returned to the user. When the data form of the operation authority is allowed or not, if the operation authority is allowed, the operation request is allowed to proceed; otherwise, the operation request is rejected and a corresponding error message is returned to the user.

[0042] In summary, by obtaining operation requests, operating environment information and user information, we obtain status data related to the user and the target system. By inputting these status data into the dynamic permission decision model, we can dynamically predict the user's operation permissions without the need to frequently manually adjust user permissions. Compared with the traditional single fixed permission management model, it can control user permissions more accurately and improve the accuracy of predicting operation permissions.

[0043] In order to improve the accuracy of the dynamic permission decision model in predicting operation permissions, optionally, the operating environment information includes system load, network status and timestamp, and the dynamic permission decision model is used to predict the user's operation permissions, including: using the multi-dimensional policy decision sub-model in the dynamic permission decision model, predicting the user's first permission result based on the operation request, system load, network status, timestamp and user information; using the user behavior pattern prediction sub-model in the dynamic permission decision model, predicting the user's second permission result based on the operation request, system load, network status and user information; and using the fusion decision mechanism in the dynamic permission decision model, predicting the user's operation permissions based on the first permission result and the second permission result.

[0044] For example, the operation request, system load, network status, timestamp and user information can be input into a multi-dimensional policy decision sub-model. The multi-dimensional policy decision sub-model is used to make permission decisions based on preset security policy rules to predict the first permission result. The preset security policy rules can be defined based on multiple dimensions of the above input information. User information can include user roles. If the user's user role in the target system is a newly registered user, the preset security policy rule is that the user only has information browsing permissions; if the system load is greater than 80%, the preset security policy rule is to downgrade the operation permissions of users with non-administrator roles to only have information reading permissions and restrict data export operations; the time represented by the timestamp can include working hours and non-working hours. If the time represented by the timestamp is non-working hours, the preset security policy rule is that all users only have query permissions. After obtaining the content of the security policy rules based on the above input information, determine whether the operation request is allowed based on the content of the security policy rules to output the first permission result. The user behavior pattern prediction sub-model is a model trained using an artificial intelligence algorithm to predict user operation permissions. Operation requests, system load, network conditions, and user information can be input into the user behavior pattern prediction sub-model to obtain a second permission result. The second permission result can be either allowed or not allowed. Alternatively, the output layer of the user behavior pattern prediction sub-model can be set as a softmax layer, and the probability values ​​of different categories output by the softmax are used as the second permission result. For example, the probability of allowed is 64% and the probability of not allowed is 36%. The fusion decision-making mechanism can adopt consensus decision-making. When both the first permission result and the second permission result are allowed, the user's operation permission is allowed; otherwise, the user's operation permission is not allowed. Such a fusion decision-making mechanism can maximize the security of permission control.

[0045] In summary, through the combination of the multidimensional policy decision sub-model and the user behavior pattern prediction sub-model, as well as the fusion decision-making mechanism, the dynamic permission decision model comprehensively considers user information and the operating environment information of the target system, and makes predictions based on both the policy and artificial intelligence algorithm levels, thereby improving the accuracy of the prediction of operation permissions.

[0046] In order to improve the accuracy of predicting operation permissions, optionally, user information includes user registration time and user IP address, and the multidimensional policy decision sub-model in the dynamic permission decision model is used to predict the user's first permission result based on the operation request, system load, network status, timestamp and user information, including: reading the multidimensional policy decision configuration file, wherein the multidimensional policy decision configuration file at least includes system load detection parameters, operation time detection parameters, sensitive operation detection parameters, permission progressive detection parameters and abnormal operation detection parameters; determining the user's system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission based on the operation request, system load, network status, timestamp, user registration time, user IP address and the multidimensional policy decision configuration file; predicting the user's first permission result based on the system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission.

[0047] Optionally, the multidimensional policy decision sub-model can make decisions based on a multidimensional policy decision configuration file, and the multidimensional policy decision configuration file can be updated over time. The multidimensional policy decision configuration file contains a variety of detection parameters, and the corresponding permissions can be obtained based on these detection parameters. The operation request can include the operation type, operation object, user registration time, operation location, and operation time. Based on the system load permission, operation time permission, sensitive operation permission, permission progressive permission, and abnormal operation permission, the first permission result of the user can be predicted to be the permission intersection of the system load permission, operation time permission, sensitive operation permission, permission progressive permission, and abnormal operation permission (that is, the requirements of multiple permissions are superimposed), and the first permission result is determined based on the permission intersection.

[0048] For example, the system load detection parameter defines the permission adjustment mechanism that starts according to the system load. When the CPU usage reaches 80% and the memory utilization exceeds 90%, the write permission of non-administrator user roles is automatically prohibited, and batch data operations of all user roles are restricted. When the CPU usage reaches 95% and lasts for more than 10 minutes, all non-urgent operation permissions are frozen, and only login and logout operations are allowed. The operation time detection parameter defines the permission requirements within a specific time period. When the time represented by the timestamp is non-working hours, for operation requests with sensitive operation types (such as data deletion, permission allocation), the user's operation permissions are adjusted to mandatory multi-factor authentication (such as SMS verification code and dynamic token), and multi-factor authentication is limited to be completed within 10 minutes. For operation requests with normal operation types, the operation frequency is limited to 5 times / minute. The sensitive operation detection parameter defines the hierarchical control rules for sensitive operations. When the operation type is a highly sensitive operation (such as the operation object is an ID number or transaction record), the user's operation permissions are adjusted to the user's operation location must be at a common office IP and the operation frequency must not exceed 3 times per hour; when the operation type is a medium-sensitive operation (For example, when the operation object is a process template or permission policy), the user's operation permissions are adjusted to require verification of the user's operation success rate in the past 7 days; the permission progressive detection parameters define the rules for the user's operation permissions to change with the registration time. When the time interval between the registration time and the current time of the target system is 0-24 hours, the user's operation permissions are adjusted to only open browsing permissions. When the time interval between the registration time and the current time of the target system is 24-72 hours, the user's operation permissions are adjusted to open basic operation permissions (such as user rest modification and simple data query). When the time interval between the registration time and the current time of the target system is greater than 72 hours, the user's operation permissions are adjusted to grant the user role with full permissions; the abnormal operation detection parameters define the permission requirements for abnormal behavior. When the user fails to log in more than 5 times per hour, the user's operation permissions are adjusted to lock the account for 30 minutes. When the user's operation frequency per minute is greater than 100 times, the user's operation permissions are adjusted to limit the amount of word operation data. When the user's operation location is different from the location of the target system, the user's operation permissions are adjusted to force the current device to be bound before allowing the operation. The permission requirements of system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission are superimposed to obtain the permission intersection. If the operation request meets all the requirements in the permission intersection, the first permission result is allowed; otherwise, the first permission result is not allowed.

[0049] In summary, the above-mentioned multidimensional policy decision sub-model can better take into account the operating environment information and user information in multiple dimensions, and since the multidimensional policy decision configuration file can be updated over time, the multidimensional policy decision sub-model can dynamically adapt to changes in time. The above-mentioned scheme improves the accuracy of the prediction of the first permission result, thereby improving the accuracy of the prediction of the operation permission.

[0050] In order to improve the prediction accuracy of operation permissions, optionally, user information includes the user's user role and historical operation records in the target system, and the user behavior pattern prediction sub-model includes a simplest permission prediction component and a second permission prediction component. The simplest permission prediction component is used to predict the simplest permission required for the operation request in the target system, and the second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the simplest permission in the target system. Through the user behavior pattern prediction sub-model in the dynamic permission decision model, the user's second permission result is predicted based on the operation request, system load, network status and user information, including: inputting the operation request, user role and historical operation records into the simplest permission prediction component to predict the target simplest permission corresponding to the operation request; inputting the target simplest permission, user role, system load, and network status into the second permission prediction component to predict the second permission result corresponding to the target simplest permission.

[0051] Optionally, the simplest permission prediction component can predict the minimum permission set (i.e., simplest permission) required for the operation request based on the user's user role and historical operation records in the target system. Since the user's operation request may involve complex operations, and complex operations may involve multiple different permissions, these multiple different permissions may have dependencies and cross-relationships. If the operation request is directly predicted to be allowed based on the operation request, the prediction is difficult due to the complexity of the permissions involved, so the accuracy is difficult to guarantee. The simplest permission prediction component can decouple the complex operations in the operation request and convert the operation request containing complex operations into a simpler simplest permission, so that the subsequent second permission prediction component focuses on the simplest permission for prediction, thereby improving the user behavior pattern prediction sub-model's prediction accuracy for the second permission result. User information can also include user device fingerprint stability. User device fingerprint stability can be the frequency of changes in the user's binding information in the target system. The input data of the second permission prediction component can increase the user device fingerprint stability to improve the accuracy of predicting the second permission result. Based on the above introduction, those skilled in the art, after knowing the input data and output data of the simplest permission prediction component and the second permission prediction component, obtain a training data set through annotation and select a suitable algorithm for training to obtain the above two prediction components.

[0052] For example, a user wants to update the PPT content, so the operation object in the operation request is "file browsing, file uploading, file modification, file editing, file downloading", the operation location in the operation request is the first location, the user role is non-administrator, and there are many operation records of file modification at the first location in the historical operation records. The above information is input into the simplest permission prediction component, and the target simplest permission is predicted to be "temporary browsing, file modification". Then the target simplest permission, user role, system load, and network status are input into the second permission prediction component, and the second permission result is predicted to be "allow". The target simplest permission can also be returned to the user to prompt the user to use the simplest permission for operation.

[0053] In summary, by first predicting the target simplest authority and then predicting the second authority result based on the target simplest authority, the prediction of the second authority prediction component can be more focused on the core needs for authority prediction, thereby improving the prediction accuracy of the second authority result, and then improving the prediction accuracy of the operation authority.

[0054] In order to improve the prediction accuracy of operation permissions, optionally, the user information includes the user's user role and historical operation records in the target system, and the user behavior pattern prediction sub-model includes a simplest permission prediction component and a second permission prediction component. The simplest permission prediction component is used to predict the simplest permission required for the operation request in the target system, and the second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the simplest permission in the target system. The training steps of the user behavior pattern prediction sub-model include: obtaining a training data set for user behavior pattern recognition, wherein each data in the training data set includes an operation request, a user role, a historical operation record, a system load, a network status, at least one simplest permission label and a permission label; using the operation request, user role, and historical operation record as prediction factors, and at least one simplest permission label as a prediction target, using the training data set to train a preset time series prediction algorithm to obtain the simplest permission prediction component; using the user role, historical operation record, system load, network status, at least one simplest permission label as prediction factors, and the permission label as the prediction target, using the training data set to train a random forest algorithm to obtain the second permission prediction component; and determining the user behavior pattern prediction sub-model based on the simplest permission prediction component and the second permission prediction component.

[0055] Optionally, data samples including operation requests, user roles, historical operation records, system load, and network status can be collected from the target system. Based on the target system log, it is determined whether the operation request is permitted to obtain the permission label (allowed or not) for the data sample. The data sample is labeled based on the target system log and historical operation records to obtain the simplest permission label for the data sample. A preset time series prediction algorithm is trained using the simplest permission label as the fitting target, and a random forest algorithm is trained using the permission label as the fitting target to obtain a user behavior pattern prediction sub-model.

[0056] For example, feature engineering can be performed on historical operation records. Historical operation records can be the operation records of the user in the target system within 100 days. Time-related features can be extracted from historical operation records, such as extracting the time distribution of operations in historical operation records within 24 hours a day, and extracting the frequency difference of operations in historical operation records on weekdays and non-working days. User roles, system loads, and network conditions can also be dummy-coded to obtain corresponding vector features. The output of the simplest permission prediction component can have multiple categories (such as data reading, data writing, system configuration, page jump, etc.), and different categories can be independently judged. That is, the simplest permissions of a user under a certain data sample can have multiple categories of operation permissions (for example, the simplest permissions are data reading permissions and data writing permissions). A time series prediction neural network based on a multi-label classification task can be selected. The output layer of the time series prediction neural network is a sigmoid activation function so that multiple categories of operation permissions can be predicted. The time series prediction neural network is trained using the above training data set to obtain a simplest permission prediction component.

[0057] In summary, by constructing a training dataset and using it to train the time series prediction algorithm and the random forest algorithm, a user behavior pattern prediction sub-model was obtained, which improved the accuracy of the user behavior pattern prediction sub-model and thus improved the prediction accuracy of operation permissions.

[0058] In order to improve the prediction accuracy of operation permissions, optionally, through the fusion decision mechanism in the dynamic permission decision model, the user's operation permissions are predicted based on the first permission result and the second permission result, including: determining the first predicted permission based on the first permission result and the first weight corresponding to the first permission result, and determining the second predicted permission based on the second permission result and the second weight corresponding to the second permission result; predicting the user's operation permissions based on the first predicted permission and the second predicted permission.

[0059] For example, if the first permission result is allowed and the second permission result is not allowed, the first weight corresponding to the first permission result may be 0.6, and the second weight corresponding to the second permission result may be 0.4. The first predicted permission, determined based on the first permission result and the first weight corresponding to the first permission result, can be obtained by multiplying the first weight by the probability that the operation permission is allowed based on the first permission result. The second predicted permission, determined based on the second permission result and the second weight corresponding to the second permission result, can be obtained by multiplying the second weight by the probability that the operation permission is allowed based on the second permission result. If the first permission result is allowed, that is, the probability that the operation permission is allowed is 100%, and if the second permission result is not allowed, that is, the probability that the operation permission is allowed is 0%, then the first predicted permission is 60% and the second predicted permission is 0%. The first predicted permission and the second predicted permission can be added together to obtain a sum. If the probability of the sum is greater than 50%, the user's operation permission is allowed; otherwise, the user's operation permission is not allowed.

[0060] In summary, by fusing the first permission result and the second permission result according to different weights, the prediction accuracy of the operation permission is improved.

[0061] In order to improve the traceability of operation authority prediction, optionally, after controlling the user operation request based on the user operation authority, the method also includes: obtaining the operation log of the dynamic authority decision model and the operation data information corresponding to the operation request; standardizing the operation log and the operation data information to obtain the audit log corresponding to the operation request, and submitting the audit log for audit.

[0062] For example, the operation log of a dynamic permission decision model can include the input data, all intermediate data generated, and the final result record when predicting the operation permission. The operation data information corresponding to the operation request can include the actual operation result generated by the user when controlling the operation request based on the operation permission (for example, the data changes in the target system after the user operates on the target system when the operation permission is allowed). Standardization processing can include converting the time information in the operation log and operation data information into a standard timestamp, and then converting all the operation logs and operation data information into a standard JSON format for storage.

[0063] In summary, through the above-mentioned audit log generation process, the operation authority prediction process of this application becomes highly traceable. The standardized processing process and detailed audit logs not only enhance the security of predicting operation permissions, but also provide a basis for subsequent security analysis, problem troubleshooting and compliance checks, thereby improving the traceability of the prediction.

[0064] In order to improve the accuracy of prediction of operation permissions, optionally, after submitting the audit log for audit, the method also includes: receiving the audit results of the audit log, and screening out the audit logs whose audit results are permission misjudgments; correcting the audit logs whose audit results are permission misjudgments to obtain target audit logs; and updating the dynamic permission decision model based on the target audit logs.

[0065] For example, the audit result can be to mark the operation permissions in the audit log as misjudged permissions or correct permissions. Based on the audit results, the audit logs are screened to obtain audit logs with misjudged permissions. The operation permissions in these misjudged permissions audit logs are then corrected. In other words, the operation permissions originally predicted as not allowed are changed to allowed, or the operation permissions originally predicted as allowed are changed to not allowed. The corrected audit logs can be used as the target audit log, and the target audit log is used as the basis for updating the dynamic permission decision model. In other words, the dynamic permission decision model is updated using the target audit log.

[0066] In summary, by updating the dynamic permission decision model based on audit results, the dynamic permission decision model can continuously learn from audit logs that were previously predicted incorrectly, thereby continuously improving the accuracy of predictions.

[0067] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0068] The embodiment of the present application further provides a permission control device. It should be noted that the permission control device of the embodiment of the present application can be used to execute the permission control method provided in the embodiment of the present application. The permission control device provided in the embodiment of the present application is introduced below.

[0069] Figure 2 Schematic diagram of the permission control device according to the embodiment of the present application. Figure 2 As shown, the device includes: a data perception unit 201, a permission decision unit 202 and a permission execution unit 203.

[0070] The data sensing unit 201 is used to receive a user's operation request for a target system, and obtain the target system's operating environment information and the user's user information in the target system.

[0071] The permission decision unit 202 is used to input the operation request, operating environment information and user information into the dynamic permission decision model, and use the dynamic permission decision model to predict the user's operation permission.

[0072] The permission execution unit 203 is used to control the operation request according to the operation permission.

[0073] The permission control device provided in the embodiment of the present application receives the user's operation request for the target system through the data perception unit 201, and obtains the operating environment information of the target system and the user information of the user in the target system. The operation request, operating environment information and user information are input into the dynamic permission decision model through the permission decision unit 202, and the user's operation permission is predicted by the dynamic permission decision model. The operation request is controlled according to the operation permission through the permission execution unit 203, which solves the problem of poor accuracy in controlling operation permission in related technologies. By obtaining the operation request, operating environment information and user information, status data related to the user and the target system are obtained. These status data are input into the dynamic permission decision model, which can dynamically predict the user's operation permission without frequent manual adjustment of user permissions. Compared with the traditional single fixed permission management model, it can more accurately control user permissions and improve the accuracy of predicting operation permissions.

[0074] Optionally, in the permission control device provided in the embodiment of the present application, the operating environment information includes system load, network status and timestamp, and the permission decision unit 202 includes: a first decision module, used to predict the user's first permission result based on the operation request, system load, network status, timestamp and user information through the multi-dimensional policy decision sub-model in the dynamic permission decision model; a second decision module, used to predict the user's second permission result based on the operation request, system load, network status and user information through the user behavior pattern prediction sub-model in the dynamic permission decision model; a third decision module, used to predict the user's operation permission based on the first permission result and the second permission result through the fusion decision mechanism in the dynamic permission decision model.

[0075] Optionally, in the permission control device provided in the embodiment of the present application, the user information includes the user registration time and the user IP address, and the first decision module includes: a first configuration sub-module, used to read the multi-dimensional policy decision configuration file, wherein the multi-dimensional policy decision configuration file includes at least system load detection parameters, operation time detection parameters, sensitive operation detection parameters, permission progressive detection parameters and abnormal operation detection parameters; a first determination sub-module, used to determine the user's system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission based on the operation request, system load, network status, timestamp, user registration time, user IP address and the multi-dimensional policy decision configuration file; a first prediction sub-module, used to predict the user's first permission result based on the system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission.

[0076] Optionally, in the permission control device provided in the embodiment of the present application, user information includes the user's user role and historical operation records in the target system, the user behavior pattern prediction sub-model includes a simplest permission prediction component and a second permission prediction component, the simplest permission prediction component is used to predict the simplest permission required for the operation request in the target system, the second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the simplest permission in the target system, the second decision module includes: a simplest prediction sub-module, used to input the operation request, user role and historical operation records into the simplest permission prediction component, and predict the target simplest permission corresponding to the operation request; a second prediction sub-module, used to input the target simplest permission, user role, system load, and network status into the second permission prediction component, and predict the second permission result corresponding to the target simplest permission.

[0077] Optionally, in the permission control device provided in the embodiment of the present application, the user information includes the user role and historical operation records of the user in the target system, the user behavior pattern prediction sub-model includes a simplest permission prediction component and a second permission prediction component, the simplest permission prediction component is used to predict the simplest permission required for the operation request in the target system, and the second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the simplest permission in the target system. The device also includes: a data set acquisition unit, which is used to acquire a training data set for user behavior pattern recognition, wherein each data in the training data set includes an operation request, a user role, a historical operation record, a system load, a network status, at least one A simplest permission label and a permission label; a first training unit, used to use operation requests, user roles, and historical operation records as prediction factors, and at least one simplest permission label as a prediction target, and use the training data set to train the preset time series prediction algorithm to obtain a simplest permission prediction component; a second training unit, used to use user roles, historical operation records, system load, network conditions, and at least one simplest permission label as prediction factors, and use the permission label as a prediction target, and use the training data set to train the random forest algorithm to obtain a second permission prediction component; a third determination unit, used to determine the user behavior pattern prediction sub-model based on the simplest permission prediction component and the second permission prediction component.

[0078] Optionally, in the permission control device provided in the embodiment of the present application, the third decision module includes: a weight allocation submodule, used to determine the first predicted permission based on the first permission result and the first weight corresponding to the first permission result, and determine the second predicted permission based on the second permission result and the second weight corresponding to the second permission result; a result fusion submodule, used to predict the user's operation permission based on the first predicted permission and the second predicted permission.

[0079] Optionally, in the permission control device provided in the embodiment of the present application, the device also includes: an information collection unit, which is used to obtain the operation log of the dynamic permission decision model and the operation data information corresponding to the operation request after controlling the user operation request based on the user operation permission; a standardization unit, which is used to standardize the operation log and operation data information, obtain the audit log corresponding to the operation request, and submit the audit log for audit.

[0080] Optionally, the permission control device provided in the embodiment of the present application also includes: a screening unit, which is used to receive the audit results of the audit log after submitting the audit log for audit, and screen out the audit logs whose audit results are permission misjudgments; a correction unit, which is used to correct the audit logs whose audit results are permission misjudgments to obtain target audit logs; and an update unit, which is used to update the dynamic permission decision model based on the target audit log.

[0081] The permission control device includes a processor and a memory. The above-mentioned data perception unit 201, permission decision unit 202 and permission execution unit 203 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0082] The processor contains a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set up, and permissions can be controlled by adjusting kernel parameters.

[0083] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0084] An embodiment of the present invention provides a computer-readable storage medium having a program stored thereon, which implements the permission control method when executed by a processor.

[0085] An embodiment of the present invention provides a processor, which is used to run a program, wherein the permission control method is executed when the program is running.

[0086] like Figure 3As shown, an embodiment of the present invention provides an electronic device, the electronic device 10 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: receiving a user's operation request for a target system, and obtaining the target system's operating environment information and the user's information in the target system; inputting the operation request, operating environment information, and user information into a dynamic permission decision model, and using the dynamic permission decision model to predict the user's operation authority; and controlling the operation request based on the operation authority.

[0087] When the processor executes the program, it also implements the following steps: through the multidimensional policy decision sub-model in the dynamic permission decision model, the user's first permission result is predicted based on the operation request, system load, network status, timestamp and user information; through the user behavior pattern prediction sub-model in the dynamic permission decision model, the user's second permission result is predicted based on the operation request, system load, network status and user information; through the fusion decision mechanism in the dynamic permission decision model, the user's operation permission is predicted based on the first permission result and the second permission result.

[0088] When the processor executes the program, the following steps are also implemented: reading a multidimensional policy decision configuration file, wherein the multidimensional policy decision configuration file includes at least system load detection parameters, operation time detection parameters, sensitive operation detection parameters, permission progressive detection parameters and abnormal operation detection parameters; determining the user's system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission based on the operation request, system load, network status, timestamp, user registration time, user IP address and the multidimensional policy decision configuration file; and predicting the user's first permission result based on the system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission.

[0089] When the processor executes the program, it also implements the following steps: inputting the operation request, user role and historical operation records into the simplest permission prediction component to predict the target simplest permission corresponding to the operation request; inputting the target simplest permission, user role, system load and network status into the second permission prediction component to predict the second permission result corresponding to the target simplest permission.

[0090] When the processor executes the program, the following steps are also implemented: obtaining a training data set for user behavior pattern recognition, wherein each data in the training data set includes an operation request, a user role, a historical operation record, a system load, a network status, at least one simplest permission label, and a permission label; using the operation request, user role, and historical operation record as prediction factors, and at least one simplest permission label as a prediction target, the preset time series prediction algorithm is trained using the training data set to obtain a simplest permission prediction component; using the user role, historical operation record, system load, network status, and at least one simplest permission label as prediction factors, and the permission label as a prediction target, the random forest algorithm is trained using the training data set to obtain a second permission prediction component; and determining a user behavior pattern prediction sub-model based on the simplest permission prediction component and the second permission prediction component.

[0091] When the processor executes the program, it also implements the following steps: determining a first predicted authority based on the first authority result and the first weight corresponding to the first authority result, and determining a second predicted authority based on the second authority result and the second weight corresponding to the second authority result; and predicting the user's operation authority based on the first predicted authority and the second predicted authority.

[0092] When the processor executes the program, it also implements the following steps: obtaining the operation log of the dynamic permission decision model and the operation data information corresponding to the operation request; standardizing the operation log and operation data information to obtain the audit log corresponding to the operation request, and submitting the audit log for audit.

[0093] When the processor executes the program, it also implements the following steps: receiving the audit results of the audit log and filtering out the audit logs whose audit results are permission misjudgments; correcting the audit logs whose audit results are permission misjudgments to obtain the target audit logs; and updating the dynamic permission decision model based on the target audit logs.

[0094] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: receiving a user's operation request for a target system, and obtaining the target system's operating environment information and the user's user information in the target system; inputting the operation request, operating environment information and user information into a dynamic permission decision model, and using the dynamic permission decision model to predict the user's operation permission; and controlling the operation request based on the operation permission.

[0095] When executed on a data processing device, it is also suitable for executing an initialization program with the following method steps: through the multidimensional policy decision sub-model in the dynamic permission decision model, the user's first permission result is predicted based on the operation request, system load, network status, timestamp and user information; through the user behavior pattern prediction sub-model in the dynamic permission decision model, the user's second permission result is predicted based on the operation request, system load, network status and user information; through the fusion decision mechanism in the dynamic permission decision model, the user's operation permission is predicted based on the first permission result and the second permission result.

[0096] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: reading a multi-dimensional policy decision configuration file, wherein the multi-dimensional policy decision configuration file includes at least system load detection parameters, operation time detection parameters, sensitive operation detection parameters, permission progressive detection parameters and abnormal operation detection parameters; determining the user's system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission based on the operation request, system load, network status, timestamp, user registration time, user IP address and the multi-dimensional policy decision configuration file; predicting the user's first permission result based on the system load permission, operation time permission, sensitive operation permission, permission progressive permission and abnormal operation permission.

[0097] When executed on a data processing device, it is also suitable for executing an initialization program with the following method steps: inputting the operation request, user role and historical operation records into the simplest permission prediction component to predict the target simplest permission corresponding to the operation request; inputting the target simplest permission, user role, system load and network status into the second permission prediction component to predict the second permission result corresponding to the target simplest permission.

[0098] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: obtaining a training data set for user behavior pattern recognition, wherein each data in the training data set includes an operation request, a user role, a historical operation record, a system load, a network condition, at least one simplest permission label, and a permission label; using the operation request, the user role, and the historical operation record as prediction factors, and at least one simplest permission label as a prediction target, the preset time series prediction algorithm is trained using the training data set to obtain a simplest permission prediction component; using the user role, the historical operation record, the system load, the network condition, and at least one simplest permission label as prediction factors, and the permission label as a prediction target, the random forest algorithm is trained using the training data set to obtain a second permission prediction component; and determining a user behavior pattern prediction sub-model based on the simplest permission prediction component and the second permission prediction component.

[0099] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: determining a first predicted authority based on a first authority result and a first weight corresponding to the first authority result, and determining a second predicted authority based on a second authority result and a second weight corresponding to the second authority result; and predicting the user's operating authority based on the first predicted authority and the second predicted authority.

[0100] When executed on a data processing device, it is also suitable for executing an initialization program with the following method steps: obtaining the operation log of the dynamic permission decision model and the operation data information corresponding to the operation request; standardizing the operation log and operation data information to obtain the audit log corresponding to the operation request, and submitting the audit log for audit.

[0101] When executed on a data processing device, it is also suitable for executing an initialization program with the following method steps: receiving the audit results of the audit log, and screening out the audit logs whose audit results are permission misjudgments; correcting the results of the audit logs whose audit results are permission misjudgments to obtain the target audit logs; and updating the dynamic permission decision model based on the target audit logs.

[0102] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0103] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0104] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0105] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0106] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0107] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0108] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0109] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0110] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A permission control method, characterized in that: include: Receive a user's operation request for a target system, and obtain operating environment information of the target system and user information of the user in the target system; Inputting the operation request, the operating environment information, and the user information into a dynamic authority decision model, and using the dynamic authority decision model to predict the user's operation authority; The operation request is controlled according to the operation authority.

2. The method according to claim 1, characterized in that The operating environment information includes system load, network status and timestamp. The user's operation permissions predicted by the dynamic permission decision model include: Predicting a first permission result of the user according to the operation request, the system load, the network status, the timestamp and the user information through the multi-dimensional policy decision sub-model in the dynamic permission decision model; Predicting the second permission result of the user according to the operation request, the system load, the network status and the user information through the user behavior pattern prediction sub-model in the dynamic permission decision model; The user's operation authority is predicted based on the first authority result and the second authority result through the fusion decision mechanism in the dynamic authority decision model.

3. The method according to claim 2, characterized in that The user information includes the user registration time and the user IP address. The first permission result of the user is predicted based on the operation request, the system load, the network status, the timestamp and the user information through the multi-dimensional policy decision sub-model in the dynamic permission decision model, including: Reading a multi-dimensional policy decision configuration file, wherein the multi-dimensional policy decision configuration file includes at least a system load detection parameter, an operation time detection parameter, a sensitive operation detection parameter, a permission progressive detection parameter, and an abnormal operation detection parameter; Determine the user's system load permission, operation time permission, sensitive operation permission, progressive permission, and abnormal operation permission based on the operation request, the system load, the network status, the timestamp, the user registration time, the user IP address, and the multi-dimensional policy decision profile; A first permission result of the user is predicted based on the system load permission, the operation time permission, the sensitive operation permission, the permission progressive permission and the abnormal operation permission.

4. The method according to claim 2, characterized in that The user information includes the user role and historical operation records of the user in the target system. The user behavior pattern prediction sub-model includes a minimum permission prediction component and a second permission prediction component. The minimum permission prediction component is used to predict the minimum permission required by the operation request in the target system. The second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the minimum permission in the target system. The second permission result of the user is predicted based on the operation request, the system load, the network status and the user information through the user behavior pattern prediction sub-model in the dynamic permission decision model includes: Inputting the operation request, the user role, and the historical operation record into the minimum permission prediction component to predict the target minimum permission corresponding to the operation request; The target simplest permission, the user role, the system load, and the network status are input into the second permission prediction component to predict a second permission result corresponding to the target simplest permission.

5. The method according to claim 2, characterized in that The user information includes the user role and historical operation records of the user in the target system. The user behavior pattern prediction sub-model includes a minimum permission prediction component and a second permission prediction component. The minimum permission prediction component is used to predict the minimum permission required by the operation request in the target system. The second permission prediction component is used to predict whether the user is allowed to perform the operation corresponding to the minimum permission in the target system. The training steps of the user behavior pattern prediction sub-model include: Obtaining a training data set for user behavior pattern recognition, wherein each piece of data in the training data set includes an operation request, a user role, historical operation records, system load, network status, at least one minimal permission tag, and a permission tag; Using the operation request, user role, and historical operation records as prediction factors, and the at least one simplest permission label as a prediction target, a preset time series prediction algorithm is trained using the training data set to obtain the simplest permission prediction component; Using the user role, historical operation records, system load, network status, and at least one simplest permission label as prediction factors, and the permission label as a prediction target, a random forest algorithm is trained using the training data set to obtain the second permission prediction component; The user behavior pattern prediction sub-model is determined based on the simplest permission prediction component and the second permission prediction component.

6. The method according to claim 2, characterized in that The user's operation authority is predicted based on the first authority result and the second authority result through the fusion decision mechanism in the dynamic authority decision model, including: Determining a first prediction authority based on the first authority result and a first weight corresponding to the first authority result, and determining a second prediction authority based on the second authority result and a second weight corresponding to the second authority result; The operation authority of the user is predicted based on the first prediction authority and the second prediction authority.

7. The method according to claim 1, characterized in that After controlling the user operation request according to the user operation authority, the method further includes: Obtaining the operation log of the dynamic permission decision model and the operation data information corresponding to the operation request; The operation log and the operation data information are standardized to obtain an audit log corresponding to the operation request, and the audit log is submitted for audit.

8. The method according to claim 7, characterized in that After submitting the audit log for audit, the method further includes: receiving audit results of the audit logs, and screening out audit logs whose audit results indicate misjudgment of authority; Correct the audit log whose audit result is a misjudgment of authority to obtain a target audit log; The dynamic authority decision model is updated according to the target audit log.

9. A permission control device, characterized in that: include: A data sensing unit is configured to receive a user's operation request for a target system and obtain operating environment information of the target system and user information of the user in the target system; a permission decision unit, configured to input the operation request, the operating environment information, and the user information into a dynamic permission decision model, and predict the user's operation permission using the dynamic permission decision model; The permission execution unit is used to control the operation request according to the operation permission.

10. A computer-readable storage medium, characterized in that The storage medium includes a stored program, wherein the program executes the permission control method according to any one of claims 1 to 8.

11. An electronic device, characterized in that: It includes one or more processors and a memory, the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the permission control method described in any one of claims 1 to 8.

Images