Data permission allocation method and system based on information security

Abstract

The invention relates to the technical field of information security, and discloses a data permission allocation method and system based on information security. According to the method, data preprocessing is carried out on a user identity information set and a resource information set which are collected in advance, a user security level subset and a resource sensitivity subset are obtained, the user identity information set comprises user identity authentication data, and the resource information set comprises resource classification data. And obtaining a user access behavior data set corresponding to the user security level subset and a resource access environment data set corresponding to the resource sensitivity subset, and constructing an authority relation topological graph between the user and the resource based on the two data sets. And extracting a permission relationship feature set from the topological graph to obtain a plurality of permission evaluation result sets containing permission levels and permission types. And fusing the plurality of result sets according to a preset fusion strategy to obtain a target permission allocation result set, and generating access permission configuration of each user to each resource according to the result set.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data authority allocation method and system based on information security. Background Art

[0002] In the digital age, data, as a core production factor, is increasingly prioritized for its security and proper use. Data rights allocation, a crucial component of information security systems, is directly related to the controllability and availability of data resources. With the widespread adoption of various information systems, the number of users has surged, their identities have become increasingly complex, and resource types have continued to expand, with significantly varying levels of sensitivity. Traditional approaches to allocating data rights have gradually exposed numerous issues. Traditional methods often rely on static permission rule settings, often dividing permissions based on fixed attributes such as the user's department and position, and lack consideration of the user's dynamic behavioral characteristics. For example, determining a user's long-term permissions solely based on the identity information registered at the time of employment ignores changes in the user's access behavior during actual use, which may cause permissions to be out of line with actual needs. At the same time, when it comes to resource sensitivity classification, traditional methods often use a single-dimensional static classification, such as simply labeling resources as public, internal, or confidential. This does not take into account dynamic factors such as the resource's real-time usage scenario and dissemination scope, making it difficult to accurately reflect the sensitivity of resources in different environments. Traditional approaches to permissions assessment often rely on a single model. This model's limitations can lead to biased assessment results. Single models often capture only a specific set of characteristics, such as focusing solely on user authentication results or considering only static resource classification tags. These models fail to integrate multi-dimensional information such as user behavior and access context. This results in permissions being either overly permissive, creating data leakage risks, or overly restrictive, impacting legitimate users' access efficiency. The existing permission allocation process lacks an intuitive and systematic presentation of the relationship between users and resources, making it difficult to effectively extract key permission relationship features. This results in a lack of reliable evidence for subsequent permission evaluation. Furthermore, the lack of a scientific and rational integration mechanism for the outputs of different evaluation models prevents the full utilization of the strengths of each model, further impacting the accuracy and applicability of permission allocation results. These issues make it difficult for existing data permission allocation methods to meet increasingly complex information security needs. A more comprehensive, dynamic, and accurate permission allocation solution is urgently needed. Summary of the Invention

[0003] The purpose of the present invention is to provide a data authority allocation method based on information security to solve the problems raised in the above background technology.

[0004] To achieve the above objectives, the present invention provides a data rights allocation method based on information security, the method comprising: Performing data preprocessing on a pre-collected user identity information set and resource information set to obtain a user security level subset and a resource sensitivity subset, wherein the user identity information set includes user identity authentication data and the resource information set includes resource classification data; Obtaining a user access behavior dataset corresponding to the user security level subset and a resource access environment dataset corresponding to the resource sensitivity subset; For the user access behavior dataset and the resource access environment dataset, construct a permission relationship topology graph between users and resources, wherein the nodes of the permission relationship topology graph include user nodes and resource nodes, and the edges represent access relationships; For the constructed permission relationship topology graph, extract the permission relationship feature set; For the permission relationship feature set, inputting the permission relationship feature set into a plurality of pre-trained permission evaluation models to obtain a plurality of permission evaluation result sets, wherein each permission evaluation result set includes a permission level and a permission type; For the multiple permission evaluation result sets, merge them according to a preset fusion strategy to obtain a target permission allocation result set; According to the target permission allocation result set, an access permission configuration for each user in the user identity information set to each resource in the resource information set is generated.

[0005] Preferably, the data preprocessing of the user identity information set and the resource information set to obtain the user security level subset and the resource sensitivity subset includes: Extracting key attribute features of the user identity information set to generate a user security level feature vector; Extracting key attribute features of the resource information set to generate a resource sensitivity feature vector; Filtering the user security level feature vector according to a preset security threshold condition to obtain a user security level subset; According to a preset sensitivity threshold condition, the resource sensitivity feature vector is screened to obtain a resource sensitivity subset.

[0006] Preferably, the construction of a topological diagram of the permissions relationship between users and resources includes: Determining an initial connection relationship between a user node and a resource node based on historical access records of the user access behavior dataset; Adjusting the weight value of the initial connection relationship according to the environmental security parameter of the resource access environment data set; Based on the adjusted weight value, an access intensity feature of each edge in the permission relationship topology graph is generated.

[0007] Preferably, the extracted authority relationship feature set includes: Normalizing the access intensity feature of each edge in the permission relationship topology graph to obtain a standardized access intensity feature set; Extracting dependency features between nodes from the standardized access strength feature set to generate a permission dependency feature vector; Extracting conflict relationship features between nodes from the standardized access strength feature set to generate a permission conflict feature vector; The permission dependency feature vector and the permission conflict feature vector are merged to obtain a permission relationship feature set.

[0008] Preferably, the permission relationship feature set is input into multiple permission evaluation models to obtain multiple permission evaluation result sets, including: Inputting the permission relationship feature set into a first permission evaluation model, and outputting a first permission evaluation result set, wherein the first permission evaluation result set includes a permission level and a permission type based on role attributes; Inputting the permission relationship feature set into a second permission evaluation model, and outputting a second permission evaluation result set, wherein the second permission evaluation result set includes a permission level and a permission type based on the behavior pattern; The permission relationship feature set is input into a third permission evaluation model, and a third permission evaluation result set is output, wherein the third permission evaluation result set includes permission levels and permission types based on environmental risks.

[0009] Preferably, the fusion is performed according to a preset fusion strategy to obtain a target authority allocation result set, including: Assigning priority weights to the permission levels in the first permission evaluation result set, the second permission evaluation result set, and the third permission evaluation result set respectively; Calculate the comprehensive weight value of each permission level based on the priority weight; Screening the permission levels whose comprehensive weight values ​​meet the preset threshold as candidate permission levels; Merge all candidate permission levels and their corresponding permission types to generate a target permission allocation result set.

[0010] Preferably, assigning priority weights to authority levels includes: Determining a priority coefficient of a role attribute according to the permission type of the first permission evaluation result set; Determining a priority coefficient of the behavior pattern according to the permission type of the second permission evaluation result set; Determining a priority coefficient of environmental risk according to the permission type of the third permission evaluation result set; Based on the priority coefficient, the weight distribution of the permission level of each permission evaluation result set is dynamically adjusted.

[0011] Preferably, after generating the access rights configuration, the method further includes: Real-time monitoring of users' actual access behavior data to resources; updating the user access behavior data set according to the actual access behavior data; Based on the updated user access behavior dataset, the steps of constructing the permission relationship topology graph, extracting the permission relationship feature set, inputting the permission evaluation model and fusing are re-executed to generate an optimized access permission configuration.

[0012] Preferably, after updating the user access behavior dataset, the method further includes: Adjust the parameters of multiple permission evaluation models based on the deviation between actual access behavior data and the target permission allocation result set; The plurality of permission evaluation models are retrained based on the adjusted parameters.

[0013] Preferably, a data rights allocation system based on information security is used to implement the above-mentioned data rights allocation method based on information security, including: A preprocessing module is used to perform data preprocessing on the user identity information set and the resource information set to generate a user security level subset and a resource sensitivity subset; A data collection module is used to obtain a user access behavior dataset corresponding to a user security level subset and a resource access environment dataset corresponding to a resource sensitivity subset; The topology construction module is used to construct a topological diagram of the permission relationship between users and resources based on the user access behavior dataset and the resource access environment dataset; A feature extraction module is used to extract a permission relationship feature set from the permission relationship topology graph; A model processing module is used to input the permission relationship feature set into multiple permission evaluation models to obtain multiple permission evaluation result sets; A fusion module is used to execute a fusion strategy on multiple permission evaluation result sets to generate a target permission allocation result set; The configuration generation module is used to generate the user's access permission configuration for resources based on the target permission allocation result set; The update module is used to update the user access behavior dataset based on the actual access behavior data and trigger the topology construction module to re-run; The optimization module is used to adjust the parameters of the permission evaluation model based on actual access behavior data and retrain the model.

[0014] Compared with the prior art, the present invention has the following beneficial effects: Through a multi-step collaborative design, this method demonstrates significant advantages in the comprehensiveness, dynamism, and accuracy of data permission allocation. During the data preprocessing phase, both the user identity information set and the resource information set are processed simultaneously to derive user security level subsets and resource sensitivity subsets, respectively. This dual-dimensional preprocessing approach overcomes the limitations of traditional methods that rely solely on fixed user attributes or static resource labels. It more comprehensively captures the essential characteristics of users and resources, laying a more solid foundation for subsequent permission allocation. The steps involved in acquiring datasets of user access behavior and resource access environment expand the considerations for permission allocation from static to dynamic. User access behavior can change over time, depending on tasks, and other factors. The access environment of a resource can also affect its actual sensitivity. By incorporating this dynamic data, permission allocation is no longer limited to initially set rules, allowing it to better adapt to complex scenarios in real applications and align permission configuration with real-time user behavior and environmental status. The construction of a permission relationship topology provides an intuitive and systematic representation of the access relationships between users and resources. The nodes and edges in the topology clearly demonstrate the connections between users and resources. This structured representation not only facilitates subsequent feature extraction but also helps discover potential relationships that are easily overlooked in traditional methods. This allows for a deeper and more comprehensive understanding of permission relationships and provides richer material for feature extraction. Extracting permission relationship feature sets from the topology ensures that the features used for permission evaluation are highly relevant and representative. These features encompass comprehensive information about users, resources, and their relationships, avoiding the single or one-sided nature of traditional evaluations. This allows subsequent model evaluations to be based on more comprehensive information, improving the reliability of the evaluation. Using multiple pre-trained permission assessment models for evaluation can fully leverage the strengths of different models. Different models focus on processing different types of data or capturing different features. Parallel multi-model evaluation can synthesize the output of each model, addressing the limitations of a single model and avoiding evaluation bias caused by inherent model flaws. This ensures that each permission assessment result set reflects the appropriate direction for permission configuration from different perspectives. Fusion of multiple evaluation result sets based on a pre-set fusion strategy further enhances the rationality of permission allocation results. This fusion process comprehensively considers the outputs of different models, balancing the strengths and weaknesses of each model and avoiding the one-sidedness of a single result. The resulting target permission allocation result set is more aligned with actual permission requirements, taking into account multi-dimensional evaluation opinions while forming a unified and coordinated allocation plan through the fusion mechanism. Based on the target permission allocation result set, each user's access rights for each resource are configured, achieving precise implementation of permission allocation. This precise configuration ensures that users receive permissions that match their security level and behavioral characteristics, while also setting appropriate access restrictions based on resource sensitivity and access environment. This ensures that data access meets normal user needs while effectively maintaining data security, improving the efficiency of data resource utilization while ensuring information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a timing diagram of the data authority allocation method based on information security according to the present invention; Figure 2 Flowchart for generating user security level subsets and resource sensitivity subsets for data preprocessing; Figure 3 Flowchart for extracting feature set of authority relationship; Figure 4 A flowchart for generating a target permission assignment result set by fusing the permission evaluation result set. DETAILED DESCRIPTION

[0016] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0017] See also Figure 1 The present invention provides a data authority allocation method and system based on information security, the method comprising: User identity information sets and resource information sets are collected. The user identity information set includes user authentication data, while the resource information set includes resource classification data. Data preprocessing is performed on these two datasets: key attribute features are extracted to generate user security level feature vectors and resource sensitivity feature vectors, respectively. User security level subsets and resource sensitivity subsets are then filtered using pre-set security and sensitivity thresholds. Next, a user access behavior dataset associated with the user security level subset and a resource access environment dataset associated with the resource sensitivity subset are obtained. Based on these two datasets, a permission relationship topology graph is constructed between user nodes and resource nodes. Edges in the graph represent access relationships, and their weights are dynamically adjusted based on access behavior and environment parameters. A permission relationship feature set is extracted from the topology graph, including normalized access intensity features, inter-node dependency features, and conflict relationship features. The feature sets are input into three pre-trained permission evaluation models, which output an evaluation result set containing permission levels and types. The three result sets are integrated using a fusion strategy: dynamic priority weights are assigned, the combined weights of each permission level are calculated, candidate permission levels that meet pre-set thresholds are screened, and their permission types are merged to generate the target permission allocation result set. Finally, each user's access rights to resources are configured based on the result set to achieve refined control.

[0018] Example 1: See Figure 2 During the data preprocessing phase, the user identity information set and resource information set are loaded into the system memory as input data. The user identity information set contains structured fields such as user ID, department, job level, historical access records, authentication method, etc. The resource information set covers resource ID, resource type, storage path, creator information, access logs, etc. The system first cleans these two data sets, removes duplicate records, fills in missing values, and performs standardized conversions on unstructured fields. For example, job level may be stored in text form, and the system maps it to a numerical security level.

[0019] The process of generating the user security level feature vector involves multi-dimensional attribute extraction. The system selects key attributes from the user identity information set, including but not limited to position weight, department confidentiality, number of historical violations, and multi-factor authentication strength. Each attribute is quantified, and the position weight is calculated based on the organizational structure tree diagram, with higher-level positions given higher values; department confidentiality is matched based on the preset department sensitivity table, such as the financial department's confidentiality is higher than the administrative department; the number of historical violations is obtained by counting the user's security event records in the past year; and the multi-factor authentication strength is assigned a score based on the authentication method. These attribute values ​​are normalized and spliced ​​into a fixed-length feature vector, where each dimension of the vector corresponds to the security contribution value of a specific attribute.

[0020] A similar approach is used to construct the resource sensitivity feature vector. The system analyzes key attributes within the resource information set, including resource type, confidentiality label, access frequency, and modification history. Resource types are assigned sensitivity coefficients using a predefined classification system. For example, database tables are generally more sensitive than log files. Confidentiality labels are directly converted to numerical values, with 0 for public, 1 for internal, and 2 for confidential. Access frequency is calculated by counting recent accesses and applying logarithmic smoothing. Modification history examines the number of recent changes and the operator's permission level. These attribute values ​​are scaled and combined to form a resource sensitivity feature vector, whose dimensions remain independent of the user security level feature vector.

[0021] The preset security threshold conditions act on the user security level feature vector. The system sets a minimum security access value and filters out users whose feature vector comprehensive scores are lower than this value. For example, if the comprehensive score of a user's attributes such as position weight, department confidentiality level, and authentication strength does not meet the minimum security threshold specified by the organization, the user will be excluded from the user security level subset. Similarly, the resource sensitivity subset is filtered through the sensitivity threshold conditions, and only resources with sensitivity scores exceeding the preset critical value are retained. This step ensures that subsequent processing is only for high-value users and resources, reducing computing overhead while improving the accuracy of permission allocation.

[0022] The construction of the permission relationship topology graph relies on two dynamic datasets: the user access behavior dataset and the resource access environment dataset. The user access behavior dataset is extracted from the log system and records the user's resource operation history, including access time, operation type (read, write, delete), and operation result (success, failure). The system parses these records and initializes the connection between user nodes and resource nodes. For example, if the log shows that user A successfully read resource X 10 times in the past 30 days, a directed edge from user A's node to resource X's node is added to the topology graph, with an initial weight of 10.

[0023] The resource access environment dataset provides environmental security parameters, including the geographic location of the access source IP, device fingerprint, network protocol type, timestamp, etc. The system adjusts the weight values ​​of the topology edges based on these parameters. Geographic location information is used to determine whether the access comes from a trusted area. For example, the weight of the company's intranet IP segment is increased, while the weight of overseas IP is reduced. The device fingerprint checks the device registration status, and the weight of registered devices is increased, while the weight of unknown devices is reduced. Among the network protocol types, HTTPS connections are given a higher weight, while HTTP connections are given a lower weight. The timestamp is used to identify access during abnormal periods, and operations outside working hours may have a reduced weight. The adjusted weight values ​​are normalized to a uniform interval through linear interpolation, ultimately forming the access intensity characteristics of the edge.

[0024] Topology nodes are categorized as user nodes and resource nodes, each carrying metadata tags. User nodes store summary information of the security level feature vector, while resource nodes store the key values ​​of the sensitivity feature vector. Edge access strength characteristics are stored as floating-point numbers, with the high or low value directly reflecting the tendency of permission allocation. The system periodically scans the topology structure, merging duplicate edges and removing long-inactive edges. Anomalous connection patterns are detected using a graph traversal algorithm, triggering real-time alerts.

[0025] The edge access strength feature is not only used for permission calculation but also supports dynamic permission adjustment. When a new record is added to the user access behavior dataset, the system instantly updates the weight of the corresponding edge. For example, if a user frequently accesses a resource, the edge weight will gradually accumulate; if the user subsequently does not access the resource for an extended period, the weight will decay over time. Changes to the resource access environment dataset also trigger weight recalculation. For example, if a device is marked as stolen, the weights of all access edges through that device are reset to zero. This dynamic mechanism ensures that the permission relationship topology map always reflects the latest security status, providing real-time data support for subsequent feature extraction.

[0026] The entire implementation process utilizes a distributed computing framework to process large amounts of data. User identity and resource information sets are loaded in parallel using a sharding strategy, and feature vector generation tasks are dispatched to multiple worker nodes for execution. The permission relationship topology is stored in a graph database, supporting high-concurrency read and write operations. The access intensity feature calculation task is handled in real time by a stream processing engine, ensuring low-latency response. The system also provides expansion interfaces to allow for the subsequent integration of new data sources and adjustments to the weight calculation logic to accommodate evolving security policies of different organizations.

[0027] Example 2: See Figure 3 , the extraction process of the permission relationship feature set starts with the access intensity features of the edges in the topological graph. These features are stored in the edge attributes of the graph in numerical form, indicating the closeness of the access relationship between the user and the resource. The system first standardizes these original weight values ​​so that they fall into a unified numerical range. The standardization process uses a linear transformation method to proportionally map the weight values ​​of all edges to a range of zero to one. For example, if the original weight values ​​are distributed between ten and one hundred, the system converts them to an interval of zero point one to one. This processing enables weight values ​​from different sources and different dimensions to be directly compared and calculated, eliminating the deviation caused by differences in numerical scales.

[0028] After standardization is complete, the system generates a standardized access intensity feature set. This feature set is organized in a matrix format, with rows representing user nodes and columns representing resource nodes. The matrix elements are the standardized access intensity values. This structured representation facilitates subsequent processing by feature extraction algorithms. The system maintains a feature version control system that records the parameters and results of each standardization process, allowing for backtracking or recalculation when necessary. Outliers detected during the standardization process are marked and handled separately. For example, extremely high or low weight values ​​may trigger a manual review process to confirm whether the access is legitimate or a data anomaly.

[0029] Dependency features between nodes are extracted by analyzing a standardized set of access intensity features. The system uses a graph traversal algorithm to identify multi-hop association paths between users and resources. For example, if user A accesses resource X, and resource X is in turn associated with resource Y, then there is an indirect dependency between user A and resource Y. The system calculates the weighted sum of all such paths to quantify the strength of the dependency. The traversal process considers path length constraints, typically setting a maximum number of hops to balance computational complexity and feature validity. Path weight superposition uses a decay strategy, where the weight decreases by a fixed percentage with each additional hop to reflect the weakening effect of long-distance dependencies.

[0030] The vectorization process of dependency features compresses complex graph structure information into a fixed-dimensional numerical representation. The system presets a set of typical dependency pattern templates, such as direct access, secondary indirect access, shared resource access, etc. For each user node, the dependency strength with all resource nodes in different modes is calculated to generate a multidimensional vector. Each dimension in the vector corresponds to a dependency pattern, and its value reflects the significance of the pattern in the current user-resource relationship. This representation method not only retains the structural information of the topological graph, but also reduces the data dimension, which is convenient for subsequent model processing. The system regularly evaluates the effectiveness of the dependency pattern template and dynamically adjusts the template set according to the actual data distribution to capture more accurate dependency features.

[0031] Extracting conflict relationship features focuses on identifying mutually exclusive access patterns between users and resources. The system maintains a resource conflict rule base that defines which resource combinations have mutually exclusive relationships. For example, financial data and personnel data might be marked as mutually exclusive resources, and the same user should not have access to both types of data. The system scans the topology graph to detect whether user nodes are connected to mutually exclusive resource groups through edges. For each detected conflict instance, the identity of the conflicting resource, the conflict type, and the conflict intensity are recorded. The conflict intensity is calculated based on the standardized access intensity value, reflecting the severity of the conflict.

[0032] The vectorization of conflict relationship features uses binary encoding. The system defines a set of conflict types, each corresponding to a binary bit in the vector. When a specific type of conflict is detected, the corresponding position is one, otherwise it is zero. This sparse representation method effectively reduces the data dimension while clearly identifying the type of conflict. The system generates a conflict feature vector for each user node, summarizing the conflicts existing in all its resource accesses. The conflict rule library supports dynamic updates. Administrators can add new conflict rules at any time based on changes in organizational policies. The system will automatically rescan the topology map and update the feature vector.

[0033] The final generation of the permission relationship feature set is accomplished by merging the dependency feature vector and the conflict feature vector. This merging operation uses vector concatenation, simply concatenating the two feature types in terms of dimension. For example, if the dependency feature vector is 50-dimensional and the conflict feature vector is 10-dimensional, the merged permission relationship feature vector will be 60-dimensional. This merging method preserves the independence of the original features and avoids mutual interference between features of different properties. The system performs a secondary normalization on the merged feature set to ensure that the numerical ranges of each dimension are consistent, preventing certain features from dominating the model training process due to their large dimensions.

[0034] The permission relationship feature set is input into three pre-trained models for processing. The first permission evaluation model is based on role attributes. Its input layer receives the dependency part in the feature vector and focuses on analyzing the access pattern formed by the inherent attributes of the user's position, department, etc. The model adopts a hierarchical decision-making mechanism to first determine the major role category to which the user belongs, and then refines the evaluation of the specific permission level and type. The second permission evaluation model focuses on behavioral pattern analysis and processes the dimensions related to access frequency and timing in the feature vector. The model uses a sequence analysis method to identify users' typical access habits and abnormal operation patterns. The third permission evaluation model targets environmental risk factors and mainly processes the part of the feature vector that reflects the security of the access environment. The model combines real-time environmental parameters to evaluate the level of permission that should be granted under current network and device conditions.

[0035] The output of all three models is a permission evaluation result set, which contains two types of information: permission level and permission type. The permission level is expressed as a numerical value ranging from zero to one hundred, with higher numbers indicating higher permission levels. The permission type is an enumeration value, including predefined operation types such as read, write, execute, and manage. The system retains the evaluation results of the three models for each user-resource pair, forming an intermediate result set. These result sets are stored in a structured format and contain fields such as model identifier, evaluation timestamp, permission level, and permission type. The system records complete evaluation pipeline information to support auditing and tracing of the permission decision-making process.

[0036] Multiple validation mechanisms are implemented during model processing. Input feature vector integrity checks ensure the absence of missing or outliers; resource monitoring during model runtime prevents computations from exceeding predefined limits; and output validation filters out clearly illogical evaluation values. When processing anomalies are detected, the system automatically triggers alternate evaluation processes, such as falling back to a simple, rule-based evaluation model, to ensure high availability of the permission allocation service. Strict model version management ensures that historical versions are retained for each model update, enabling rapid rollback to previous evaluation logic when necessary.

[0037] The entire implementation process emphasizes feature transparency and explainability. The system provides a detailed source description for each generated permission relationship feature, annotating the corresponding original data item and calculation path. The decision logic of the permission evaluation model is displayed through visualization tools, helping administrators understand the reasons for specific permission allocation results. This transparent design not only meets the requirements of security audits, but also facilitates the discovery and correction of potential system issues. Detailed log data is generated at each stage of feature extraction and model evaluation, recording operational indicators such as processing time, data volume, and abnormal events, providing data support for system performance optimization.

[0038] The system's scalable design allows for the flexible addition of new feature types or evaluation models. When introducing new factors influencing permissions, simply append a new feature calculation module to the existing feature extraction process and concatenate the new feature dimensions into the original feature vector. The evaluation model utilizes a plug-in architecture, allowing new models to be incorporated into the evaluation process simply by implementing standardized input and output interfaces. This design enables the system to adapt to evolving security needs and policy requirements, maintaining the timeliness and accuracy of the permission allocation mechanism. The system provides feature importance analysis tools to help identify the feature dimensions that have the greatest impact on evaluation results, guiding subsequent feature engineering optimization.

[0039] Example 3: See Figure 4 The fusion process of the permission assessment result sets uses a dynamic weighting mechanism to process the assessment results from the three models. The role attribute result set output by the first permission assessment model contains permission recommendations based on the user's position and organizational structure. The behavior pattern result set of the second permission assessment model reflects the user's historical operation characteristics. The environmental risk result set of the third permission assessment model reflects the access restrictions under the current security environment. The system first assigns a priority weight to each permission level in the result set. This weight is determined by the permission type and the context.

[0040] The priority coefficient α of the role attribute model is determined by analyzing the permission type. The system maintains a role coefficient mapping table that associates different types of permissions with preset coefficients. For example, the α value for administrator permissions is 0.6, for audit permissions is 0.5, and for general user permissions is 0.4. When the permission type involves cross-departmental access, the coefficient is adjusted based on organizational structure distance: the coefficient for access from a higher-level department to a lower-level department is increased by 0.1, and for access between departments at the same level is reduced by 0.05. These adjustment values ​​are set based on experience and stored in the configuration library, allowing administrators to modify them according to actual needs.

[0041] The priority coefficient β of the behavior pattern model is calculated based on both frequency and timing characteristics. The system defines a base coefficient of 0.5 and dynamically adjusts it based on the number of visits in the past week. After comparing the access frequency f with the standard frequency threshold f0, the adjustment is made according to the following rules: in: Indicates the actual number of times users visit the resource. is the average number of visits by similar users. The tanh function limits the adjustment range to a reasonable range to avoid the impact of extreme values. For periodic operation patterns, the system adds an additional coefficient of 0.1 to compensate for important visits that meet the expected cycle but have a lower overall frequency.

[0042] The priority coefficient γ of the environmental risk model is determined by real-time security parameters. It has a base value of 0.4 and is dynamically calculated based on the device security score s (range: 0-100) and the network environment risk value r (range: 0-10). When the device score is below 60 or the risk value is above 5, the coefficient decreases proportionally, with a minimum value of 0.2. In a secure environment, the coefficient can be increased to 0.6. The system uses a piecewise linear function to process these parameters, ensuring smooth coefficient changes and compliance with security policy requirements. In special circumstances, such as when an ongoing network attack is detected, all access requests through that network connection will temporarily set γ to 0, completely denying access.

[0043] The calculation of comprehensive weight value adopts weighted summation method. (i represents the model number), its comprehensive weight for: in: 、 、 These correspond to the adjustment coefficients for the i-th permission level in each of the three models. Calculations are rounded to two decimal places to avoid floating-point errors. The system maintains a weight matrix for each user-resource pair, recording the evaluation results of each model and their corresponding combined weights to form a complete set of candidate permissions.

[0044] The generation of the target permission allocation result set adopts a hierarchical merging strategy. The candidate permissions that pass the screening are sorted from high to low by level, and permissions of the same level are merged according to type priority. The system defines type priority rules, and management class permissions take precedence over read-write class, and read-write class takes precedence over read-only class. Conflicts are detected and resolved during the merging process. For example, when there are mutually exclusive permission types at the same level, the one with the higher comprehensive weight is retained. The final result set is stored in a tree structure, with the root node being the user-resource pair and the child nodes being the granted permission items. Each permission item contains attributes such as level, type, and effective time.

[0045] The dynamic weight adjustment mechanism continuously monitors actual access. The system compares the user's actual operations with the assigned permissions and calculates compliance indicators. When the actual usage rate of a certain permission type is consistently lower than expected, the corresponding model coefficient will be adjusted downward; conversely, the coefficient of the frequently used permission type will be increased. The adjustment range is controlled within a range of ±0.1 to avoid drastic fluctuations. The coefficient update cycle is set to 24 hours to ensure that the system has sufficient time to collect statistically significant behavioral data. Historical coefficient changes are recorded in a dedicated log to support retrospective analysis and anomaly detection.

[0046] Permission conflict detection occurs in real time during the integration process. The system loads the resource conflict rule library and checks whether the target permission allocation result set contains mutually exclusive permissions. The detection algorithm traverses all permission combinations in the result set, matching them with predefined conflict patterns. When a conflict is discovered, the system automatically handles it based on the conflict resolution strategy: retaining the high-weight permission, retaining the frequently used permission, or completely revoking the conflicting permission. The results of the resolution are recorded in the audit log, including conflict details, resolution, and operation timestamp. For complex conflicts that cannot be resolved automatically, a pending task is generated for manual resolution by the administrator.

[0047] The result set validation phase implements multiple checks. Syntax checks ensure that all fields conform to predefined data formats; logic checks confirm the proper mapping of permission levels to types; and consistency checks compare current allocations with historical records. Entries that fail validation trigger a reassessment process, reverting to the last valid allocation if necessary. The system maintains a temporary storage area to hold a copy of the result set being validated; the master database is not updated until all checks pass.

[0048] The resulting permission configuration information is converted into a standardized access control language. The system maps permission levels to specific operational permissions. For example, levels 70-79 correspond to read and write permissions, while levels 80 and above include administrative permissions. Each configuration item has a precise scope, such as column-level permissions for a database table or directory-level permissions for a file system. This configuration information is distributed to each execution node via a secure channel, implementing specific access control rules on the target system. This distribution process uses an incremental update strategy, transmitting only the modified parts to reduce network load.

[0049] The version control mechanism manages the historical evolution of permission assignments. Each major update creates a new version branch, fully documenting the change context. The system supports point-in-time rollbacks, allowing you to restore permission configurations from any historical version. Version information is integrated with the user identity management system to ensure that rollbacks do not disrupt existing authentication relationships. The audit interface provides a version comparison function, visually displaying permission differences between versions to aid security analysis and decision-making.

[0050] Example 4: The dynamic update mechanism of the permission configuration system achieves closed-loop optimization by continuously monitoring the actual access behavior of users. Taking the customer data access system of a financial institution as an example, the system initially configures read and write permissions for the customer credit record table for Wang, an analyst in the risk management department, with the permission level set to 65. During the actual operation process, the system collects all of Wang's operation records through embedded points to form a detailed access behavior log. After cleaning and structured processing, these log data are stored in a dedicated access behavior data warehouse. Its core fields include operation time, user ID, resource type, operation type, execution result and other elements.

[0051] Table 1: Wang’s typical access behavior in the past week is recorded below.

[0052] Record ID Operation time User ID Resource Type Operation Type Execution Results Device fingerprint Network environment 1001 2025-08-14 U1005 Customer credit record Read success DEV-8765 Intranet 1002 2025-08-14 U1005 Customer credit record Write success DEV-8765 Intranet 1003 2025-08-15 U1005 Customer transaction flow sheet Read fail DEV-9201 VPN 1004 2025-08-16 U1005 Customer credit record Write success DEV-8765 Intranet 1005 2025-08-17 U1005 Customer Asset Information Form Read success MOBILE-1122 4G The system performs data analysis every morning, aggregating raw access records into user behavior profiles. In Wang's case, the analysis revealed three unusual patterns: frequent access to unauthorized resources (the customer asset information table) on his mobile device; repeated failed operations when connecting through a VPN; and attempts to access the customer transaction flow table that exceeded his current permissions. These behavioral characteristics are quantified into new metrics and updated to the user access behavior dataset. These metrics include cross-resource access rate, unconventional device usage, and the number of operations during unusual time periods, with each dimension assigned a weighted score.

[0053] The reconstruction process of the permission relationship topology graph adopts an incremental update strategy. The system retains the basic framework of the original graph structure and only modifies the nodes and edges that have changed. The edge weight between Wang's node and the customer credit record table node is adjusted from the initial value of 65 to 68 based on the actual access frequency, reflecting its normal usage pattern. The newly added abnormal access edge is marked in red, and the initial weight is set to 30, indicating a temporary relationship with low confidence. In terms of environmental factors, the edge corresponding to the VPN connection is added with a risk tag, and the mobile device access edge is attached with a device security score. These adjustments use the transaction mechanism of the graph database to ensure data consistency and ensure that other query operations are not affected during the update process.

[0054] The feature extraction module performs differential analysis on the updated topology map. It compares the permission relationship feature sets of the new and old versions and calculates the magnitude of change in each dimension. In Wang's case, the dependency relationship feature vector indicated a new cross-resource access feature value of 0.15, and the conflict relationship feature vector detected a device environment conflict value of 0.2. These changes exceeded the preset sensitivity threshold, triggering the parameter adjustment process of the permission assessment model. The system initiates the model diagnostic mode, analyzing the current parameters' ability to identify such abnormal behavior, focusing on examining the decision boundaries of the behavioral pattern model and the environmental risk model.

[0055] Model parameter adjustments utilize a progressive learning approach. New input nodes were added to the behavioral model's neural network layer to reflect newly added unconventional device usage patterns. The connection weights of existing nodes were fine-tuned based on false positives, improving the sensitivity of mobile device access patterns by 15%. The environmental risk model updated its risk rule base, adding a combined risk entry for "4G network + mobile device" and incorporating VPN connection failures into risk assessment metrics. The role attribute model remained relatively stable, with only adjustments made to the strictness of inter-departmental access rules. All parameter changes are recorded in the model version control system, noting the reason for the adjustment and the expected impact.

[0056] The retraining process uses a data set containing new behavioral features. The system retrieves similar cases from the past three months from historical storage to build a balanced training sample set. During training, 10% of the validation set is retained to prevent overfitting of newly emerged abnormal patterns. Wang's case was marked as a sample that requires intensive learning, and a higher sample weight was given during the training process. The model evaluation phase checks the balance between recall rate and false alarm rate to ensure that parameter adjustments do not lead to excessive restrictions on normal permissions. The trained model is deployed to the shadow environment, and its decision consistency is first tested with historical requests, and then gradually switched to the production environment.

[0057] The optimized permission configuration generation process takes multiple factors into consideration. In Wang's case, the system first lowered his mobile device permission level, reducing mobile access permissions for the customer credit record from 65 to 50. Secondly, to address the issue of unstable VPN connections, batch operations were temporarily restricted, while retaining basic query permissions. Finally, for unauthorized requests to access the customer asset information table, a permission upgrade approval ticket was generated and forwarded to the department head for review. These adjustments take effect in real time through the configuration management interface, and a detailed permission change notification is sent to the user, explaining the basis for the adjustment and the appeal channel.

[0058] The system establishes a complete feedback loop to handle edge cases. After receiving the permission change notification, Wang submitted a user manual through the system, explaining that mobile device access was necessary to urgently handle a customer complaint. This feedback information was entered into the case library, and after review, his mobile terminal permission level was partially restored to 60, but a secondary authentication requirement was added. The entire feedback processing process takes an average of 2 hours, and important emergency requests can be responded to within 30 minutes. The system continuously tracks user behavior after feedback processing, verifies the rationality of permission adjustments, and initiates a secondary optimization cycle when necessary.

[0059] The audit tracking mechanism records the entire lifecycle of permission changes. In Wang's case, detailed audit logs were generated for all intermediate steps from initial permission configuration to the final optimization plan, including each automatic adjustment and manual intervention. The logs contain key information such as the operation time, executor (system or administrator), change content, and decision-making basis. Auditors can use the timeline view to trace the evolution of permissions and verify that each decision point complies with security policies. The system also generates a monthly permission change report, which summarizes the distribution of reasons for various adjustments and the processing time, and is used to continuously improve the optimization algorithm.

[0060] Example 5: The hardware architecture of the data authority allocation system adopts a distributed microservice design, and each functional module is independently deployed in a containerized environment. The preprocessing module runs on a computing node with a large memory configuration, and is specifically responsible for the initial loading and cleaning of user identity information and resource information. This module receives change notifications from the data source system through an asynchronous message queue and triggers the incremental update process. When a new user joins the company or a resource is created, the preprocessing module completes feature extraction and subset screening within five minutes, and writes the processing results to the distributed cache layer. The cached data adopts a sharding storage strategy, and the user security level subset and resource sensitivity subset are stored in different key-value storage areas, respectively, and load balancing is achieved through a consistent hashing algorithm.

[0061] The data collection module consists of multiple collector instances, deployed at edge nodes close to the data source. Each collector is responsible for collecting a specific type of data, such as an operation log collector that monitors system audit logs, and an environmental data collector that connects to the network monitoring system. The collector implements an adaptive sampling mechanism that automatically reduces the sampling frequency when the system load is high to ensure that the core business operations are not affected. After preliminary filtering, the collected raw data is transmitted to the central processing cluster through a dedicated data channel. The transmission process uses end-to-end encryption, and the data packets include timestamps and digital signatures to prevent tampering by middlemen. After the receiving service of the central processing cluster verifies the integrity of the data, it stores it in a time series database and tags it with metadata indicating the data source and collection time.

[0062] The topology construction module is implemented based on the graph computing framework and runs on GPU-accelerated nodes. This module regularly pulls the latest user security level subset and resource sensitivity subset from the cache layer, and combines them with the real-time information provided by the data acquisition module to build an in-memory permission relationship graph. The node objects of the graph contain rich attribute fields. User nodes store organizational information such as department and position, and resource nodes are labeled with classification features such as type and sensitivity. The weight calculation of edge objects uses a dynamic adjustment algorithm, taking into account multiple variables such as historical access frequency, recent operation time attenuation factor, and environmental risk score. The graph structure is fully persisted to the graph database once an hour, and incremental updates are recorded through change data capture technology to support rapid rollback to any historical version.

[0063] The feature extraction module runs as a standalone service, interacting with the topology building module via remote procedure calls. Upon startup, the service loads predefined feature extraction rules, including standardized processing methods, dependency detection algorithms, and conflict identification patterns. When a processing request arrives, the service loads the corresponding subgraph from the graph database and performs feature calculations in memory. The calculation results are serialized and stored in the feature repository, and feature update events are published to the message bus. The feature repository implements version control, retaining snapshots of the ten most recent calculation results for subsequent analysis and comparison. Abnormal feature values ​​trigger an alert process, notifying administrators to review data quality or adjust extraction rules.

[0064] The model processing module is deployed as a scalable prediction service cluster, and each permission evaluation model runs in an isolated container environment. When the service starts, the latest trained model parameters and feature mapping tables are loaded from the model repository. Request processing adopts a pipeline design. The feature vector first passes through the input validation layer to check the dimension consistency, and then is distributed to three models for parallel evaluation. Each model instance is equipped with a resource isolation mechanism to prevent computationally intensive tasks from affecting the overall service response time. The model output results are standardized and formatted, and then written to the result database, along with diagnostic information such as the model version and evaluation time. The health status of the service is monitored through a heartbeat mechanism, and abnormal instances are automatically restarted or removed from the load balancing pool.

[0065] The fusion module implements multi-policy decision-making logic and runs on a highly available application server. This service subscribes to result update events from the model processing module, triggering the fusion calculation process. The service maintains a weighted rule library internally, storing priority coefficient configurations for different scenarios. The rule matching process considers factors such as the current system mode, resource sensitivity level, and user risk profile. The fusion calculation utilizes a multi-stage screening strategy, first eliminating clearly conflicting results and then weighting and ranking the remaining candidate solutions. The final decision results are generated into a structured document containing a detailed description and rationale for the granted permissions, which is submitted to the authorization terminal through the approval workflow engine.

[0066] The configuration generation module connects to the management interfaces of various target systems and converts abstract permission descriptions into specific access control rules. The module implements the adapter pattern internally and develops dedicated converters for different types of resource systems. For example, the converter for the database system generates SQL authorization statements, and the converter for the file system produces ACL configuration documents. The conversion process retains complete audit trail information, recording the mapping relationship between the original permission decision and the final system configuration. Configuration deployment adopts a blue-green release strategy, first verifying the correctness of the configuration in the test environment, and then pushing it to the production environment in batches. After each configuration change, the module automatically triggers a verification test to confirm that the actual permissions in effect on the target system are consistent with expectations.

[0067] The update module serves as the system's nerve center, coordinating the coordinated operation of various modules. This module implements a state machine engine that manages each stage of the permission allocation lifecycle. The engine monitors change events and manual intervention instructions from data sources and determines which processing flows to trigger based on the current system state. Critical operations such as model retraining and topology reconstruction require health checks and security assessments before execution. The module maintains operation logs and performance metrics for the operations team to monitor system health. A scheduled task scheduler triggers routine maintenance tasks, such as weekly data archiving and monthly model evaluations.

[0068] The optimization module runs on a separate management cluster and provides model training and parameter tuning capabilities. The training data pipeline extracts labeled samples from the feature warehouse and historical decision records, and after balancing and enhancement transformations, feeds them into the training process. Model training supports multiple algorithm frameworks and is flexibly extensible through a plug-in mechanism. The training process records metadata such as hyperparameters, feature importance, and validation metrics to facilitate subsequent analysis and comparison. Newly trained models are marked as production candidates only after their effectiveness is verified through A / B testing. The parameter tuning interface allows security experts to interactively adjust decision thresholds and observe the impact on test datasets in real time.

[0069] The system implements fine-grained access control to ensure its security. Each module's service account is configured with the minimum necessary permissions, and inter-module communication utilizes two-way TLS authentication. Management operations require multi-factor authentication, and critical configuration changes require dual approval. Audit logs are synchronized in real time to the Security Information and Event Management System, with abnormal behavior triggering automated response rules. The system undergoes regular penetration testing and architecture reviews to promptly address potential vulnerabilities.

[0070] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0071] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A data authority allocation method based on information security, characterized in that: include: Performing data preprocessing on a pre-collected user identity information set and resource information set to obtain a user security level subset and a resource sensitivity subset, wherein the user identity information set includes user identity authentication data and the resource information set includes resource classification data; Obtaining a user access behavior dataset corresponding to the user security level subset and a resource access environment dataset corresponding to the resource sensitivity subset; For the user access behavior dataset and the resource access environment dataset, construct a permission relationship topology graph between users and resources, wherein the nodes of the permission relationship topology graph include user nodes and resource nodes, and the edges represent access relationships; For the constructed permission relationship topology graph, extract the permission relationship feature set; For the permission relationship feature set, inputting the permission relationship feature set into a plurality of pre-trained permission evaluation models to obtain a plurality of permission evaluation result sets, wherein each permission evaluation result set includes a permission level and a permission type; For the multiple permission evaluation result sets, merge them according to a preset fusion strategy to obtain a target permission allocation result set; According to the target permission allocation result set, an access permission configuration for each user in the user identity information set to each resource in the resource information set is generated.

2. The data authority allocation method based on information security according to claim 1 is characterized in that: The data preprocessing of the user identity information set and the resource information set to obtain the user security level subset and the resource sensitivity subset includes: Extracting key attribute features of the user identity information set to generate a user security level feature vector; Extracting key attribute features of the resource information set to generate a resource sensitivity feature vector; Filtering the user security level feature vector according to a preset security threshold condition to obtain a user security level subset; According to a preset sensitivity threshold condition, the resource sensitivity feature vector is screened to obtain a resource sensitivity subset.

3. The data authority allocation method based on information security according to claim 1 is characterized in that: The construction of the permission relationship topology diagram between users and resources includes: Determining an initial connection relationship between a user node and a resource node based on historical access records of the user access behavior dataset; Adjusting the weight value of the initial connection relationship according to the environmental security parameter of the resource access environment data set; Based on the adjusted weight value, an access intensity feature of each edge in the permission relationship topology graph is generated.

4. The data authority allocation method based on information security according to claim 3 is characterized in that: The extracted authority relationship feature set includes: Normalizing the access intensity feature of each edge in the permission relationship topology graph to obtain a standardized access intensity feature set; Extracting dependency features between nodes from the standardized access strength feature set to generate a permission dependency feature vector; Extracting conflict relationship features between nodes from the standardized access strength feature set to generate a permission conflict feature vector; The permission dependency feature vector and the permission conflict feature vector are merged to obtain a permission relationship feature set.

5. The data authority allocation method based on information security according to claim 1 is characterized in that: The permission relationship feature set is input into multiple permission evaluation models to obtain multiple permission evaluation result sets, including: Inputting the permission relationship feature set into a first permission evaluation model, and outputting a first permission evaluation result set, wherein the first permission evaluation result set includes a permission level and a permission type based on role attributes; Inputting the permission relationship feature set into a second permission evaluation model, and outputting a second permission evaluation result set, wherein the second permission evaluation result set includes a permission level and a permission type based on the behavior pattern; The permission relationship feature set is input into a third permission evaluation model, and a third permission evaluation result set is output, wherein the third permission evaluation result set includes permission levels and permission types based on environmental risks.

6. The data authority allocation method based on information security according to claim 5 is characterized in that: The fusion is performed according to the preset fusion strategy to obtain the target permission allocation result set, including: Assigning priority weights to the permission levels in the first permission evaluation result set, the second permission evaluation result set, and the third permission evaluation result set respectively; Calculate the comprehensive weight value of each permission level based on the priority weight; Screening the permission levels whose comprehensive weight values ​​meet the preset threshold as candidate permission levels; Merge all candidate permission levels and their corresponding permission types to generate a target permission allocation result set.

7. The data authority allocation method based on information security according to claim 6 is characterized in that: The assigning of priority weights to permission levels includes: Determining a priority coefficient of a role attribute according to the permission type of the first permission evaluation result set; Determining a priority coefficient of the behavior pattern according to the permission type of the second permission evaluation result set; Determining a priority coefficient of environmental risk according to the permission type of the third permission evaluation result set; Based on the priority coefficient, the weight distribution of the permission level of each permission evaluation result set is dynamically adjusted.

8. The data authority allocation method based on information security according to claim 1 is characterized in that: After generating the access permission configuration, the following steps are also included: Real-time monitoring of users' actual access behavior data to resources; updating the user access behavior data set according to the actual access behavior data; Based on the updated user access behavior dataset, the steps of constructing the permission relationship topology graph, extracting the permission relationship feature set, inputting the permission evaluation model and fusing are re-executed to generate an optimized access permission configuration.

9. The data authority allocation method based on information security according to claim 8, characterized in that: After updating the user access behavior dataset, the following steps are also included: Adjust the parameters of multiple permission evaluation models based on the deviation between actual access behavior data and the target permission allocation result set; The plurality of permission evaluation models are retrained based on the adjusted parameters.

10. A data authority allocation system based on information security, used to implement the data authority allocation method based on information security according to any one of claims 1 to 9, characterized in that: include: A preprocessing module is used to perform data preprocessing on the user identity information set and the resource information set to generate a user security level subset and a resource sensitivity subset; A data collection module is used to obtain a user access behavior dataset corresponding to a user security level subset and a resource access environment dataset corresponding to a resource sensitivity subset; The topology construction module is used to construct a topological diagram of the permission relationship between users and resources based on the user access behavior dataset and the resource access environment dataset; A feature extraction module is used to extract a permission relationship feature set from the permission relationship topology graph; A model processing module is used to input the permission relationship feature set into multiple permission evaluation models to obtain multiple permission evaluation result sets; A fusion module is used to execute a fusion strategy on multiple permission evaluation result sets to generate a target permission allocation result set; The configuration generation module is used to generate the user's access permission configuration for resources based on the target permission allocation result set; The update module is used to update the user access behavior dataset based on the actual access behavior data and trigger the topology construction module to re-run; The optimization module is used to adjust the parameters of the permission evaluation model based on actual access behavior data and retrain the model.

Images