Multi-level strategy linkage configuration method and system

Abstract

The invention relates to the technical field of compliance management, and provides a multi-level strategy linkage configuration method and system, and the method comprises the steps: a root node writes a strategy product issued by a governance authority object into a global strategy warehouse in a form of an immutable object, and declares a baseline rule; the child nodes call a rule derivation engine to output a derived rule set according to the business domain label, and the leaf nodes instantiate the derived rule set into configuration items which can be identified by the business process; weaving into a strategy execution engine at the key decision tangent point, executing link verification on the call request, and when verification fails, blocking and recording a blocking event in real time; the blocking events are routed to the corresponding processing interfaces according to the levels, and the unique effective rule is output through the priority matrix when the rule conflicts. According to the method, system rigid landing, version seamless synchronization, risk real-time interception, event closed-loop disposal and difference management and control can be realized, the compliance cost is remarkably reduced, and the compliance safety is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of compliance management, and in particular to a multi-level policy linkage configuration method and system. BACKGROUND

[0002] In the enterprise compliance governance scene, the system is usually landed in a multi-level architecture of "headquarters - subsidiary - business department". Each level of organization not only refines the regulatory system according to its own business characteristics, but also must ensure the "rigid penetration" of the headquarters' will. However, the traditional compliance management mode mainly relies on manual issuance of documents, step-by-step training and post-audit, which is low in efficiency, high in cost, and prone to a series of pain points such as system fragmentation, risk lag, overseas disconnection, and high dependence on manual work.

[0003] In practical application, the existing compliance management has the following shortcomings: 1. Static file management cannot meet the dynamic compliance requirements: The existing compliance system uses a document library or a simple database to store system texts. Once the system is updated, it can only be notified step by step through email or OA. It cannot automatically detect logical conflicts between subsidiary rules and headquarters systems, nor can it verify whether it conforms to the latest rules in real time in the business process.

[0004] 2. Lack of policy implication and version consistency mechanism: There is a lack of automatic verification of the logical implication link of "headquarters system - subsidiary rule - department operation procedure". The subsidiary mechanically copies the headquarters provisions, resulting in "formal compliance, substantial violation". At the same time, the version number management is chaotic, and the business system cannot perceive the rule upgrade, thus producing the risk of "version drift".

[0005] 3. High coupling degree of risk interception point and business system: The existing method is to hard-code risk control rules in the core transaction system. Once the rules change, the application must be restarted or redeployed, which affects business continuity and cannot quickly respond to new regulations.

[0006] 4. Event handling and responsibility tracing process are fragmented: When the system finds a violation, it can only record logs, and subsequent manual assignment of rectification tasks lack automatic hierarchical routing, account freezing, and responsibility notification capabilities, resulting in poor rectification timeliness and unclear responsibility.

[0007] Chinese Patent No. CN115099903A discloses a kind of arbitration guarantee strategy implementation method, device and equipment based on process engine, which improves the quality and efficiency of problem single processing through arbitration request trigger, rule engine construction, process engine driving, strategy execution and subsequent closed loop. However, this scheme is limited to the take-out after-sales scene, and its single-level rules, lack of implication verification, conflict resolution, no hot update and weak closed loop design make it difficult to support a multi-level, real-time, strong compliance, and evolving policy linkage system.

[0008] Therefore, how to provide a multi-level policy linkage configuration method and system to realize system rigidity landing, risk real-time interception, version seamless synchronization and event closed-loop disposal has become a technical problem to be solved. SUMMARY

[0009] Therefore, in order to overcome the deficiencies of the prior art, the present application aims to provide a multi-level policy linkage configuration method and system.

[0010] According to a first aspect of the present application, a multi-level policy linkage configuration method is provided, comprising: Step S1: The root node writes the policy artifacts published by the governance authority object into the global policy repository in the form of an immutable object, and declares the baseline rules; Step S2: The child node calls the rule derivation engine according to the business domain label to output the derived rule set, and the leaf node instantiates the derived rule set into a configuration item recognizable by the business process; Step S3: Weave the policy execution engine into the key decision cut-off point, perform link verification on the call request, and when the verification fails, block it in real time and record the blocking event; Step S4: Route the blocking event to the corresponding processing interface according to the level, and when the rules conflict, output the only effective rule through the priority matrix.

[0011] Optionally, in the multi-level policy linkage configuration method of the present application, in step S1, the global policy repository adopts versioned object storage, each baseline rule is written into the immutable storage area in the form of a rule identifier, an effective timestamp and an invalid timestamp triplet, and an incremental index is generated by comparing the triplets of adjacent versions through a difference comparison service and pushed to a distributed cache.

[0012] Optionally, in the multi-level policy linkage configuration method of the present application, in step S2, the derived rule set is output in the following manner: read the root node baseline rule ontology, retrieve the corresponding terms in the industry dictionary according to the business domain label registered by the child node, perform synonym replacement, numerical interval scaling and condition expression completion, perform subclass inclusion verification through a description logic inference machine, and after verification, write the derived rule set into the child node policy repository and synchronize the version number to the upper node.

[0013] Optionally, in the multi-level policy linkage configuration method of the present application, in step S2, when the leaf node instantiates the derived rule set into a configuration item recognizable by the business process, a field mapper is used to receive and parse the derived rule set, map the tuples obtained by parsing into corresponding fields in the business process input message respectively, and establish a bidirectional hash index of field values and rule identifiers.

[0014] Optionally, in the multi-level policy linkage configuration method of the present application, in step S3, the policy execution engine is woven into the key decision cut point in the following manner: metadata tags are attached to each node in the business process modeling stage, and when the tags hit any preset keyword, a gateway is preposed to the node in the AOP aspect manner for zero-invasive weaving of the policy execution engine.

[0015] Optionally, in the multi-level policy linkage configuration method of the present application, in step S3, link verification is performed on the calling request, and when the verification fails, the calling request is blocked in real time and a blocking event is recorded, including: The policy execution engine takes the root node policy as the upper ontology, performs subclass relationship verification on the child node and leaf node policies, and when the subclass relationship is incorrect, it is determined that the verification fails, and the blocking event is blocked and recorded; When the subclass relationship is correct, the policy version number carried by the calling request is compared with the local cache version number, and when the policy version number carried by the calling request is inconsistent with the local cache version number, it is determined that the verification fails, and the blocking event is blocked and recorded; When the policy version number carried by the calling request is consistent with the local cache version number, the dynamic weight model is called to score the risk of the calling request, and when the risk score is greater than a preset value, it is determined that the verification fails, and the blocking event is blocked and recorded; When the risk score is not greater than the preset value, it is determined that the verification is successful.

[0016] Optionally, in the multi-level policy linkage configuration method of the present application, in step S4, the event router is used to route the blocking event by level, the event router is built-in a two-dimensional decision table, the rows of the two-dimensional decision table represent event levels, and the columns of the two-dimensional decision table represent disposal actions, when the event level is one, the one-level event is routed to the freeze API of the governance authority interface and the synchronous audit log, and when the event level is two, the two-level event is routed to the subject registration interface to generate a rectification task sheet.

[0017] Optionally, in the multi-level policy linkage configuration method of the present application, in step S4, when there is a rule conflict, a unique effective rule is output through a priority matrix, including: The rule category is taken as the row of the priority matrix, the priority factor is taken as the column of the priority matrix, and the priority matrix is constructed; When a rule conflict occurs, the priority matrix is scanned to obtain the rule corresponding to the minimum value, the remaining conflicting rules are suppressed, and the scanning result is written into the runtime cache.

[0018] Optionally, the multi-level policy linkage configuration method of the present application further includes: after a new version of policy product is released at the root node, a version distributor is used to generate a difference package and push it to all child nodes and leaf nodes, the difference package is verified by subclass relationship and regression tested locally, and then the policy replacement is completed in milliseconds through the double cache switching technology by a hot update agent, and the whole business traffic is uninterrupted.

[0019] According to a second aspect of the present application, a multi-level policy linkage configuration system is provided, which comprises a linkage configuration server, the linkage configuration server comprising: a baseline policy issuing module, configured to write the policy product published by the governance authority object into the global policy warehouse in the form of an immutable object by the root node, and declare the baseline rule; a rule derivation and instantiation module, configured to output the derived rule set by the rule derivation engine according to the business domain label by the sub-node, and instantiate the derived rule set into the configuration item recognizable by the business process by the leaf node; a running verification module, configured to interweave the policy execution engine at the key decision cut point, perform link verification on the call request, and when the verification fails, block and record the blocking event in real time; a hierarchical and conflict resolution module, configured to route the blocking event to the corresponding processing interface according to the level, and output the only effective rule through the priority matrix when the rules conflict.

[0020] According to a third aspect of the present application, a computer device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of the first aspect of the present application when executing the program.

[0021] The multi-level policy linkage configuration method and system of the present application realize rigid landing of system, seamless version synchronization, real-time risk interception, event closed-loop disposal and differential control, significantly reduce compliance cost and improve compliance safety, and have the following beneficial technical effects: 1. Through the progressive architecture of "root node-sub node-leaf node", the regulatory system of the governance authority object is solidified into the global baseline policy in the form of an immutable object, ensuring that the highest level rule once published cannot be covered, and realizing millisecond-level version backtracking and zero downtime update by means of difference comparison and incremental indexing, completely eliminating system gaps and version drift.

[0022] 2. The sub-node calls the rule derivation engine according to the business domain label, outputs the industry rule which maintains implication with the baseline after completing synonym replacement, value scaling and description logic verification, and the leaf node maps the rule quadruple to the process configuration item through the field mapper and establishes a bidirectional hash index, realizing the unity of differentiated landing and rigid penetration.

[0023] 3. Preposition AOP aspect in key decision cut point, strategy execution engine performs real-time "policy implication-version consistency-risk score" triple check for each call request, and any failure will be blocked in milliseconds and recorded, moving the compliance threshold from "after-the-fact audit" to "in-process interception"; the blocked events are automatically routed by the built-in two-dimensional decision table, and the first-level events are directly frozen and the account is synchronized with the audit log, and the second-level events generate a rectification work order with a time limit and a person in charge to write back to the legal governance system, forming a closed loop of discovery, blocking, rectification and tracing.

[0024] 4. When multiple rules conflict, the system selects the highest priority rule and suppresses the remaining rules through the "rule category x priority factor" matrix, and the result is immediately written to the runtime cache to ensure zero-latency effect for subsequent requests. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings described in the following are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0026] Figure 1 The architecture example diagram of a multi-level policy linkage configuration system according to an embodiment of the present application; Figure 2 The architecture example diagram of a linkage configuration server of a multi-level policy linkage configuration system according to an embodiment of the present application; Figure 3 The step flow chart of a multi-level policy linkage configuration method according to an embodiment of the present application; Figure 4 Another step flow chart of a multi-level policy linkage configuration method according to an embodiment of the present application; Figure 5 The structure schematic diagram of the device provided by the present application. DETAILED DESCRIPTION

[0027] The embodiments of the present application will be described in detail below with reference to the drawings.

[0028] It should be noted that, in the case of no conflict, the following embodiments and the features in the embodiments can be combined with each other; and based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present disclosure.

[0029] It is important to note that the various aspects described herein are exemplary in nature and are not intended to limit the scope, applicability, or configuration of embodiments of the disclosure. Rather, the aspects described herein provide some example ways in which aspects described herein can be implemented. Although the aspects described herein are described with respect to particular embodiments, it will be understood that aspects described herein can be implemented in any number of ways, and that the embodiments described herein should not be construed as limiting. Rather, the aspects described herein should be understood to be illustrative in nature. Various aspects described herein can be employed independently, collectively, or in any suitable combination of two or more aspects.

[0030] Figure 1 An example diagram of an architecture of a multi-level policy linkage configuration system according to embodiments of the present disclosure is shown in FIG. 1, which can include a linkage configuration server 101, a communication network 102, and / or one or more linkage configuration clients 103. Figure 1 As shown in FIG. 1, the system can include a linkage configuration server 101, a communication network 102, and / or one or more linkage configuration clients 103. Figure 1 As shown in FIG. 1, the system can include a linkage configuration server 101, a communication network 102, and / or one or more linkage configuration clients 103.

[0031] The linkage configuration server 101 can be any suitable server for storing information, data, programs, and / or any other suitable type of content. In some embodiments, the linkage configuration server 101 can perform suitable functions. For example, in some embodiments, the linkage configuration server 101 can be used for multi-level policy linkage configuration.

[0032] Figure 2 An example diagram of an architecture of a linkage configuration server of a multi-level policy linkage configuration system according to embodiments of the present disclosure is shown in FIG. 2, which can include a linkage configuration server 101, a communication network 102, and / or one or more linkage configuration clients 103. Figure 2 As shown in FIG. 2, the linkage configuration server of the present embodiment can include: A baseline policy issuing module for the root node to write the policy artifacts published by the governance authority object in the form of immutable objects into the global policy repository, and declare the baseline rules; A rule derivation and instantiation module for the child node to call the rule derivation engine to output the derived rule set according to the business domain tag, and for the leaf node to instantiate the derived rule set into a configuration item recognizable by the business process; A running verification module for weaving the policy execution engine at the key decision cut point to perform link verification on the call request, and when the verification fails, real-time blocking and recording the blocking event; A hierarchical and conflict resolution module for routing the blocking event to the corresponding processing interface according to the level, and when there is a rule conflict, outputting the only effective rule through the priority matrix.

[0033] As another example, in some embodiments, the linkage configuration service 101 can send the multi-level policy linkage configuration method to the linkage configuration client 103 for user use upon request of the linkage configuration client 103.

[0034] As an optional example, in some embodiments, the linkage configuration client 103 is configured to provide a visual linkage configuration interface for receiving a selection input operation of a multi-level policy linkage configuration, and for, in response to the selection input operation, obtaining and presenting a linkage configuration interface corresponding to an option selected by the selection input operation from the linkage configuration service 101, the linkage configuration interface presenting at least information of the multi-level policy linkage configuration and operation options for the information of the multi-level policy linkage configuration.

[0035] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide-area network (WAN), a local-area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The linkage configuration client 103 can connect to the communication network 102 through one or more communication links (e.g., communication link 104), which can link to the linkage configuration service 101 via one or more communication links (e.g., communication link 105). The communication links can be any communication links suitable for communicating data among the linkage configuration client 103 and the linkage configuration service 101 such as network links, dial-up links, wireless links, hard-wired links, any other suitable communication links, or any suitable combination of such links.

[0036] The linkage configuration client 103 can include any one or more clients that present interfaces related to multi-level policy linkage configurations in a suitable form for user use and operation. In some embodiments, the linkage configuration client 103 can include any suitable type of device. For example, in some embodiments, the linkage configuration client 103 can include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.

[0037] Although the linkage configuration service 101 is illustrated as one device, in some embodiments, any suitable number of devices can be used to perform the functions performed by the linkage configuration service 101. For example, in some embodiments, multiple devices can be used to implement the functions performed by the linkage configuration service 101. Alternatively, cloud services can be used to implement the functions of the linkage configuration service 101.

[0038] Based on the above system, an embodiment of the present invention provides a multi-level policy linkage configuration method, which is described below through the following embodiments.

[0039] Figure 3 FIG. 1 is a flowchart of a multi-level policy linkage configuration method according to an embodiment of the present invention. Figure 3 As shown, the multi-level policy linkage configuration method of this embodiment can be executed on the linkage configuration server, and the multi-level policy linkage configuration method includes the following steps: Step S1: The root node writes the policy artifacts published by the governance authority object into the global policy repository in the form of immutable objects and declares the baseline rules.

[0040] As an optional example, in this embodiment, the global policy repository uses versioned object storage, and each baseline rule is written into the immutable storage area in the form of a triple of rule identifier, effective timestamp, and expiration timestamp. The difference comparison service is used to generate an incremental index by comparing the triplets of adjacent versions and push it to the distributed cache, achieving millisecond-level backtracking and version switching.

[0041] In practice, the triple design of "governance authority object → immutable object → global policy repository" ensures that regulatory systems, once released, are fully effective and cannot be overridden. Each baseline rule is stored as a triplet of "rule identifier + effective timestamp + expiration timestamp." This is combined with a difference comparison service to generate incremental indexes and push them to a distributed cache, enabling millisecond-level version rollbacks and zero-downtime updates, fundamentally eliminating "system gaps" and "version drift."

[0042] Step S2: The child node calls the rule derivation engine according to the business domain label to output the derived rule set, and the leaf node instantiates the derived rule set into a configuration item identifiable by the business process.

[0043] In actual applications, after the child nodes read the baseline ontology through the rule derivation engine, they perform synonym replacement, numerical range scaling, and conditional completion in the industry dictionary based on business domain labels. The descriptive logic inference engine then verifies the implied relationships to ensure the logical consistency of the derived rules with the baseline rules. Leaf nodes use a field mapper to map the "subject-action-amount-term" quadruple to process fields and establish a bidirectional hash index, enabling a "one-click implementation" of rules into configuration items. This approach preserves industry differentiation while ensuring the rigid penetration of headquarters policies, eliminating the "formal compliance, substantive violation" problem.

[0044] As an optional example, in the embodiment, the derived rule set is output in the following manner: the root node baseline rule ontology is read, corresponding terms are retrieved in the industry dictionary according to the business domain label registered by the child node, synonym replacement, numerical interval scaling and conditional expression completion are performed, subclass inclusion verification is performed by a description logic inference machine, and after the verification passes, the derived rule set is written into the child node policy repository, and the version number is synchronized to the upper node.

[0045] As an optional example, in the embodiment, when the leaf node instantiates the derived rule set into a configuration item recognizable by the business process, a field mapper is used to receive and parse the derived rule set, the tuples obtained by parsing are mapped into corresponding fields in the business process input message respectively, and a bidirectional hash index of the field value and the rule identifier is established. So that at runtime, any field value can be located to the original rule entry in constant time.

[0046] Step S3: weaving the policy execution engine at the key decision cut point, performing link verification on the call request, and when the verification fails, blocking in real time and recording the blocking event.

[0047] As an optional example, in the embodiment, the policy execution engine is woven at the key decision cut point in the following manner: during the business process modeling stage, a metadata tag is attached to each node, and when the tag hits any of the preset keywords, a gateway is preposed to the node in the AOP aspect manner for zero-intrusion weaving of the policy execution engine. For example, when the tag hits any of the keywords “major events, important personnel, major projects, and large funds”, a gateway is preposed to the node in the AOP aspect manner for zero-intrusion weaving of the policy execution engine, realizing real-time interception of the call request.

[0048] For example, in the embodiment, by preposing the AOP aspect at the key decision cut point (such as the “major events, important personnel, major projects, and large funds” node), the policy execution engine performs three real-time verifications on each call request link: 1. inclusion verification to ensure that the current rule still conforms to the upper baseline; 2. version verification to prevent misuse of “old rules”; and 3. dynamic weight model to automatically amplify the risk weight for cross-border, large amount, sensitive opponent, etc. Any failed verification will be blocked in milliseconds and a blocking event will be generated, realizing a fundamental change from post-audit to in-process interception, and significantly reducing risks.

[0049] Figure 4 For another step flowchart of a multi-level policy linkage configuration method according to an embodiment of the application, as shown in Figure 4 The policy execution engine takes the root node policy as the upper ontology, performs subclass relationship verification on the child node and leaf node policy, and when the subclass relationship is wrong, it is determined that the verification fails, and the blocking event is blocked and recorded.​

[0050] When the subclass relationship is correct, the policy version number carried by the comparison call request is compared with the local cache version number. When the policy version number carried by the request is inconsistent with the local cache version number, it is determined that the verification fails, and the blocking and recording of the blocking event are blocked.

[0051] When the policy version number carried by the request is consistent with the local cache version number, the dynamic weight model is called to perform risk scoring on the call request. When the risk score is greater than a preset value, it is determined that the verification fails, and the blocking and recording of the blocking event are blocked. For example, the weight model takes regional factors, opponent factors, amount factors, and historical violation times as input vectors, and outputs the final score according to the proportion that the cross-border weight coefficient is greater than the domestic weight coefficient.

[0052] When the risk score is not greater than the preset value, it is determined that the verification is successful.

[0053] Step S4: Routing the blocking event to the corresponding processing interface according to the level, and outputting a unique effective rule through a priority matrix when there is a rule conflict.

[0054] As an optional example, in the embodiment, the event router is used to route the blocking event according to the level. The event router is built-in with a two-dimensional decision table. The rows of the two-dimensional decision table represent event levels, and the columns of the two-dimensional decision table represent handling actions. When the event level is level one, the level one event is routed to the freeze API of the governance authority interface and the audit log is synchronized. When the event level is level two, the level two event is routed to the subject registration interface to generate a rectification task sheet, such as a rectification work order with a time limit and a person in charge. The work order state is written back to the legal person governance system in real time to form a "discovery - blocking - rectification - traceability" closed loop.

[0055] As an optional example, in the embodiment, the rule category is used as the row of the priority matrix, and the priority factor is used as the column of the priority matrix. The smaller the value of the priority factor, the higher the priority. The priority matrix is constructed. When a rule conflict occurs, the priority matrix is scanned to obtain the rule corresponding to the smallest value, that is, the rule with the highest priority. The remaining conflicting rules are suppressed. The scanning result is written into the runtime cache to ensure zero delay effect of subsequent requests and completely solve the problem that rule conflicts cannot be quickly decided and the responsibility is difficult to trace.

[0056] It should be noted that the embodiment also includes a strategy version hot update. After a new version of the strategy product is published at the root node, a version distributor is used to generate a difference package and push it to all child nodes and leaf nodes. After the difference package is locally verified and regression tested, a hot update agent completes the strategy replacement in milliseconds through a double cache switching technology, and there is no interruption in the whole business traffic.

[0057] In practical applications, the multi-level strategy linkage configuration method and system of the embodiment realizes rigid landing of system, seamless synchronization of version, real-time interception of risk, closed-loop disposal of events and differential control, significantly reduces compliance cost and improves compliance security, and has the following beneficial technical effects: 1. Through the progressive architecture of "root node-subnode-leaf node", the regulatory system of governance authority object is solidified as a global baseline strategy in the form of an immutable object, ensuring that the highest level rule once published cannot be covered, and realizing millisecond version backtracking and zero downtime update through difference comparison and incremental indexing, completely eliminating system gaps and version drift.

[0058] 2. The subnode calls the rule derivation engine according to the business domain label, outputs the industry rule that maintains the implication with the baseline after completing synonym replacement, value scaling and description logic verification, and the leaf node maps the rule quadruple to the process configuration item through the field mapper and establishes a bidirectional hash index, realizing the unification of differentiated landing and rigid penetration.

[0059] 3. The AOP aspect is preposed at the key decision cut point, and the strategy execution engine performs real-time "strategy implication-version consistency-risk score" triple verification on each call request, and any failure will be blocked in milliseconds and the event will be recorded, moving the compliance checkpoint from "after-the-fact audit" to "in-process interception"; the blocked events are automatically routed by the built-in two-dimensional decision table, and the first-level events are directly frozen and the account is synchronized with the audit log, and the second-level events generate a rectification work order with a time limit and a person in charge to write back to the legal person governance system, forming a closed loop of discovery, blocking, rectification and tracing.

[0060] 4. When multiple rules conflict, the system selects the highest priority rule through the "rule category x priority factor" matrix and suppresses the remaining rules, and the result is immediately written to the runtime cache to ensure zero delay for subsequent requests.

[0061] As Figure 5 shown, the application also provides a device including a processor 210, a communication interface 220, a memory 230 for storing a processor executable computer program, and a communication bus 240. Wherein the processor 210, the communication interface 220 and the memory 230 complete the communication among each other through the communication bus 240. The processor 210 realizes the multi-level strategy linkage configuration method described above by running the executable computer program.

[0062] The computer program in the memory 230 can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0063] The system embodiments described above are only schematic, and the units illustrated as separate units can or can not be physically separated, and the units illustrated as units can or can not be physical units, i.e. can be located in one place or distributed on multiple network units. Part or all of the modules can be selected based on actual needs to achieve the purpose of the present embodiment. Those skilled in the art can understand and implement without creative labor.

[0064] From the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions essentially or the parts that contribute to the prior art can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of the various embodiments or some parts of the embodiments.

[0065] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed by the present application can be easily thought of by those skilled in the art, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A multi-level policy linkage configuration method, characterized in that: The method comprises: Step S1: The root node writes the policy artifacts issued by the governance authority object into the global policy repository in the form of immutable objects and declares the baseline rules; Step S2: The child node calls the rule derivation engine based on the business domain label to output a derived rule set, and the leaf node instantiates the derived rule set into a configuration item identifiable by the business process; Step S3: A policy execution engine is incorporated into the key decision-making points to perform link verification on the call request. If the verification fails, the request is blocked in real time and the blocking event is recorded. Step S4: Route the blocking event to the corresponding processing interface according to the level, and output the only effective rule through the priority matrix when the rules conflict.

2. The multi-level policy linkage configuration method according to claim 1, characterized in that: In step S1, the global policy repository uses versioned object storage, and each baseline rule is written into the immutable storage area in the form of a triple of rule identifier, effective timestamp, and expiration timestamp. The difference comparison service is used to generate an incremental index by comparing the triplets of adjacent versions and push it to the distributed cache.

3. The multi-level policy linkage configuration method according to claim 1, characterized in that: In step S2, the derived rule set is output in the following manner: read the baseline rule ontology of the root node, search for corresponding terms in the industry dictionary based on the business domain label registered by the child node, perform synonym replacement, numerical range scaling and conditional expression completion, perform subclass inclusion verification through the description logic reasoning engine, write the derived rule set to the child node policy warehouse after verification, and synchronize the version number to the superior node.

4. The multi-level policy linkage configuration method according to claim 1, characterized in that: In step S2, when the leaf node instantiates the derived rule set into a configuration item recognizable by the business process, it uses a field mapper to receive and parse the derived rule set, maps the tuples obtained by the parsing to the corresponding fields in the business process input message, and establishes a bidirectional hash index of the field value and the rule identifier.

5. The multi-level policy linkage configuration method according to claim 1, characterized in that: In step S3, the policy execution engine is woven into the key decision points in the following way: metadata tags are attached to each node in the business process modeling stage. When the tag hits any preset keyword, the front gateway of the node is woven into the policy execution engine in a zero-invasive manner using the AOP aspect.

6. The multi-level policy linkage configuration method according to claim 1, characterized in that: In step S3, a link check is performed on the call request. If the check fails, the call request is blocked in real time and the blocking event is recorded, including: The policy execution engine uses the root node policy as the upper layer ontology and performs subclass relationship verification on the child node and leaf node policies. If the subclass relationship is incorrect, it is judged as a verification failure, and the blocking event is blocked and recorded. If the subclass relationship is correct, the policy version number carried in the call request is compared with the local cache version number. If the policy version number carried in the request is inconsistent with the local cache version number, the verification is considered to have failed, the call is blocked, and the blocking event is recorded; When the policy version number carried in the request is consistent with the locally cached version number, the dynamic weight model is used to perform a risk score on the request. If the risk score is greater than the preset value, the verification is considered to have failed, the request is blocked, and the blocking event is recorded. When the risk score is not greater than the preset value, the verification is considered successful.

7. The multi-level policy linkage configuration method according to claim 1, characterized in that: In step S4, an event router is used to route the blocking events according to the level. The event router has a built-in two-dimensional decision table. The rows of the two-dimensional decision table represent the event levels, and the columns of the two-dimensional decision table represent the disposal actions. When the event level is level one, the level one event is routed to the freeze API of the governance authority interface and the audit log is synchronized. When the event level is level two, the level two event is routed to the subject registration interface to generate a rectification task order.

8. The multi-level policy linkage configuration method according to claim 1, characterized in that: In step S4, when rules conflict, a unique effective rule is output through the priority matrix, including: The priority matrix is ​​constructed by taking the rule categories as the rows of the priority matrix and the priority factors as the columns of the priority matrix; When a rule conflict occurs, the priority matrix is ​​scanned to obtain the rule corresponding to the minimum value, the remaining conflicting rules are suppressed, and the scan results are written to the runtime cache.

9. The multi-level policy linkage configuration method according to claims 1 to 8, characterized in that: The method also includes: after the root node releases a new version of the policy product, a version distributor is used to generate a difference package and push it to all child nodes and leaf nodes. After the difference package undergoes subclass relationship verification and regression testing locally, the hot update agent uses double cache switching technology to complete the policy replacement in milliseconds, and the entire business traffic is uninterrupted.

10. A multi-level policy linkage configuration system, characterized in that: The system includes a linkage configuration server, which includes: The baseline policy delivery module is used by the root node to write the policy artifacts issued by the governance authority object into the global policy repository in the form of immutable objects and declare the baseline rules; The rule derivation and instantiation module is used by child nodes to call the rule derivation engine based on business domain labels to output derived rule sets. Leaf nodes instantiate the derived rule sets into configuration items that can be identified by business processes. The run verification module is used to weave the policy execution engine into key decision points, perform link verification on the call request, and block and record the blocking event in real time when the verification fails; The grading and conflict resolution module is used to route blocking events to the corresponding processing interface according to the level, and output the only effective rule through the priority matrix when the rules conflict.

Images