A collaborative office security management method and system for preventing information leakage

Abstract

This invention relates to the field of collaborative office security management, providing a method and system for preventing information leakage in collaborative office security management. The method includes: collecting task planning information to construct a dynamic permission rule base; tracking task stages in real time and identifying multi-phase iterative tasks; dynamically adjusting user permissions based on stages and task content, including document read / write and export permissions; creating nested permission capsules for each stage of multi-phase iterative tasks, configuring resource access rules, and implementing permission decay for non-permitted members during the closing stage; automatically replacing operation permissions during stage transitions, and forcibly terminating and generating a report if the replacement time is outside a safe period. The system includes modules for task planning information collection, dynamic permission adjustment, task permission management, and security monitoring. This solution achieves deep integration of permissions and business processes through dynamic permission management throughout the entire lifecycle, effectively reducing the risk of information leakage and improving the security and efficiency of collaborative office work.

Description

Technical Field

[0001] This invention belongs to the field of collaborative office security management, and in particular relates to a collaborative office security management method and system for preventing information leakage. Background Technology

[0002] As enterprises deepen their digital transformation, collaborative office work has become the mainstream model for cross-departmental and cross-regional collaboration, and the demand for full-lifecycle online management of various projects and tasks is becoming increasingly urgent. In this process, the frequency of data flow between different stages and different members has increased significantly, and the risk of information leakage has also risen accordingly. Currently, the industry's security management of collaborative office work is gradually evolving from simple access control to full lifecycle permission management. However, how to achieve dynamic matching of permissions with business processes and cope with the complex permission requirements of multi-stage iteration tasks remains a pressing technical challenge.

[0003] Existing technologies implement access control through role-based access control (RBAC) or attribute-based access control (ABAC), which can assign basic permissions based on user roles or task attributes. Some advanced solutions attempt to adjust permissions in conjunction with task nodes, such as manually updating user permissions after project milestones are completed, or implementing simple dynamic permission changes through preset rules. However, these solutions lack real-time tracking of task phases and automated permission adaptation mechanisms, especially in multi-phase iterative tasks, making it difficult to achieve cross-phase permission isolation and dynamic replacement. Summary of the Invention

[0004] The purpose of this invention is to provide a collaborative office security management method and system to prevent information leakage, aiming to solve the technical problems existing in the prior art as identified in the background art.

[0005] This invention is implemented as follows: a collaborative office security management method to prevent information leakage, the method comprising:

[0006] Collect task planning information, obtain project nodes, build a basic rule base for dynamic permission lifecycle management, track task progress in real time, compare the current task status with the preset basic rule base, determine the stage of the task, identify the task content, and identify whether the project is a multi-phase iteration task.

[0007] Based on the project's current stage and the identification results of the project's tasks, the system automatically performs dynamic permission adjustment operations at the user permission level. These dynamic permission adjustment operations include modifying the user's read and write permissions, export permissions, and historical access permissions for documents.

[0008] To assign permissions to employees, for multi-phase iteration tasks, nested permission capsules are created for each phase of the task, and resource access rules are configured for each nested permission capsule. If it is determined that the task is currently in the closing phase, regardless of whether it is in a multi-phase iteration task, permission decay control is implemented for non-permissioned members. When a phase transition is performed, the permissions required for all operations in the previous phase and the permissions required for the same operations in the next phase are identified, and the operation permissions are automatically replaced.

[0009] During the automatic replacement of operation permissions, the replacement time is recorded. If the replacement time period is not within the safe time period range, the replacement process is forcibly terminated and a sensitive operation report is generated.

[0010] As a further aspect of the present invention, the step of determining the stage of the task, identifying the task content, and identifying whether the project is a multi-phase iterative task specifically includes:

[0011] Automatically collect task planning information, extract each node of the task, and collect the internal security policies and historical permission configuration data of the enterprise responsible for the task to build a basic rule base for dynamic permission lifecycle management and clarify the basic permission level corresponding to different task nodes.

[0012] The system acquires real-time data on task completion and node achievement, compares the current task status with task nodes in the basic rule base, and determines the specific stage of the task.

[0013] Natural language processing techniques are used to perform semantic analysis on task description documents, extract stage keywords in the task, determine whether the task contains multiple interrelated subtasks that need to be progressively advanced, and whether there are dynamic changes in permission requirements between subtasks, and define them as multi-phase iterative tasks.

[0014] As a further aspect of the present invention, the step of creating nested permission capsules for each stage of the task and configuring resource access rules for each nested permission capsule specifically includes:

[0015] Assign permissions to employees based on their job level and role in the task;

[0016] For multi-phase iteration tasks, separate permission capsules are created for each task phase based on the task phase.

[0017] Based on the sequence and dependencies between stages, all permission capsules are nested hierarchically to form multi-level nested permission capsules. Each capsule corresponds to a task stage, and a unique mapping relationship between stages and permission capsules is established.

[0018] Based on the business needs, data sensitivity, and participating personnel at each task stage, configure resource access rules for each nested permission capsule to clarify the operation permissions of different employees for different resources.

[0019] As a further aspect of the present invention, the permission decay control operation for non-authorized members specifically includes:

[0020] Identify the current stage of the task. When the task reaches the final stage, filter out non-authorized members who do not belong to the final stage's permission capsule based on the employee's permission allocation results, and determine the scope of the object subject to permission decay control.

[0021] For all identified non-authorized members, access permissions will be restricted to include only the final results, and any content extraction operations will be prohibited; at the same time, a cross-departmental collaboration isolation mechanism will be activated, and unnecessary data transmission channels will be closed.

[0022] As a further aspect of the present invention, the step of identifying all permissions required for operations in the previous stage and permissions required for the same operations in the next stage, and automatically replacing operation permissions, specifically includes:

[0023] Based on the tracking results of task progress, the task phase transition signals are monitored in real time through task progress monitoring and event triggering mechanisms;

[0024] Based on the internal security regulations of the enterprise responsible for the task and the characteristics of the project, determine the operation type for each stage. At the end of the previous stage, identify all permissions required to perform each operation in the previous stage, as well as the new permissions required for the same operation in the next stage.

[0025] During phase transition, the permission replacement operation is automatically executed, the operation permissions of the previous phase are revoked, and the new permissions are assigned to the corresponding operations at the same time as the phase switch is executed, and the permission replacement information is recorded.

[0026] As a further aspect of the present invention, recording the replacement time during the automatic replacement of operation permissions specifically includes:

[0027] Record operation timestamps at the start and end of the permission replacement operation;

[0028] Based on the mission schedule and the patterns of historical security incidents, preset safe time periods are established.

[0029] The timestamp of the permission replacement is compared with the safe time period interval to determine whether the operation is within the safe time period interval.

[0030] If the timestamp is outside the safe time period, the permission replacement process will be forcibly terminated immediately, and a sensitive operation report will be generated, including the operation time, the users involved, and details of the permission change.

[0031] Another objective of this invention is to provide a collaborative office security management system for preventing information leakage, the system comprising:

[0032] The task planning information collection module is used to collect task planning information, obtain project nodes, build a basic rule base for dynamic permission lifecycle management, track task progress in real time, compare the current task status with the preset basic rule base, determine the stage of the task, identify the task content, and identify whether the project is a multi-phase iteration task.

[0033] The dynamic permission adjustment module is used to automatically perform dynamic permission adjustment operations on the user permission level based on the project stage and the project task content identification results. The dynamic permission adjustment operations include modifying the user's read and write permissions, export permissions, and historical access permissions for documents.

[0034] The task permission management module is used to assign permissions to employees. For multi-phase iterative tasks, nested permission capsules are created for each stage of the task, and resource access rules are configured for each nested permission capsule. If it is determined that the task is currently in the closing stage, regardless of whether it is in a multi-phase iterative task, permission decay control is implemented for non-permissioned members. When the stage transition is performed, the module identifies all the permissions required for the previous stage and the permissions required for the same operation in the next stage, and performs automatic replacement of operation permissions.

[0035] The security monitoring module records the replacement time during the automatic replacement of operation permissions. If the replacement time period is not within the safe time period range, the replacement process is forcibly terminated and a sensitive operation report is generated.

[0036] The beneficial effects of this invention are:

[0037] This solution utilizes nested permission capsule technology to construct a permission management system deeply coupled with multi-phase iterative tasks. Permission capsules create independent permission units based on task phases, forming a multi-level nested structure according to the phase sequence and dependencies. Each capsule has a unique mapping to a task phase and is configured with fine-grained resource access rules, achieving on-demand, minimal allocation of permissions. This technology encapsulates the permission requirements of each phase into independent, controllable security units, fundamentally preventing cross-phase permission overreach. For example, during task phase transitions, the system can automatically revoke permissions from the previous phase and grant new permissions based on preset capsule rules, avoiding chaotic permission transitions. For the finalization phase, permission capsules use a dynamic shrinking mechanism to precisely limit the access scope of non-authorized members to the final result, solving the problem of delayed permission revoketable permissions in traditional solutions.

[0038] The innovation of permission capsule technology lies in upgrading permission management from a set of scattered rules to a three-dimensional protection system that is isomorphic to business processes. Through stage nesting mapping and dynamic permission adaptation, permission flow strictly follows the task logic, which not only ensures the physical isolation of data at each stage, but also improves the automation and accuracy of permission adjustment in collaborative work. It is especially suitable for complex project scenarios with high security requirements. Attached Figure Description

[0039] Figure 1 A flowchart illustrating a collaborative office security management method for preventing information leakage, provided in an embodiment of the present invention;

[0040] Figure 2 The flowchart provided in this embodiment of the invention is for determining the stage of a task, identifying the task content, and identifying whether a project is a multi-phase iterative task.

[0041] Figure 3 A flowchart for creating nested permission capsules for each stage of a task and configuring resource access rules for each nested permission capsule is provided for embodiments of the present invention.

[0042] Figure 4 This is a flowchart of the permission decay control operation for non-authorized members provided in an embodiment of the present invention;

[0043] Figure 5 A flowchart for identifying all permissions required for operations in the previous stage and permissions required for the same operations in the next stage, and for automatically replacing operation permissions, provided in an embodiment of the present invention;

[0044] Figure 6 A flowchart for recording the replacement time during the automatic replacement of operation permissions provided in this embodiment of the invention;

[0045] Figure 7 This is a structural block diagram of a collaborative office security management system for preventing information leakage, provided as an embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0047] Figure 1 A flowchart illustrating a collaborative office security management method for preventing information leakage, as provided in an embodiment of the present invention, is shown below. Figure 1 As shown, the method includes:

[0048] S100 collects task planning information, obtains project nodes, builds a basic rule base for dynamic permission lifecycle management, tracks task progress in real time, compares the current task status with the preset basic rule base, determines the stage of the task, identifies the task content, and identifies whether the project is a multi-phase iteration task.

[0049] In practice, data is integrated with the enterprise's internal project management system and OA system through API interfaces to automatically collect information such as milestone nodes, schedules, and task allocation tables from the task planning document. At the same time, internal security policies, such as access control rules for documents with different security levels, are extracted from the enterprise's security management platform, and permission configuration records of similar past projects are retrieved from the historical project database. This allows for the construction of a more targeted and dynamic permission lifecycle management basic rule base.

[0050] When tracking task progress in real time, the system continuously acquires data such as the actual completion time and deliverable status of each task node by using multiple data acquisition methods such as IoT sensors and task progress reporting systems. The system dynamically compares the current task status with the standard nodes in the basic rule base through time series analysis algorithms. When the completion of the requirements analysis document in the software development project reaches the preset stage and passes the review, the system automatically determines that it has entered the design stage.

[0051] When identifying whether a project is a multi-phase iteration task, natural language processing technology is used to conduct in-depth semantic analysis on the project feasibility study report and task breakdown document to extract keywords for each phase of iterative development, version evolution, etc. At the same time, the dependency graph between tasks is analyzed. If it is found that sub-tasks such as product prototype design, user testing, and iterative optimization have a clear sequence and the permission requirements of each phase are significantly different, such as the testing phase requiring write permissions while the optimization phase only requires read permissions, then it is determined to be a multi-phase iteration task.

[0052] This step, through the construction of a basic rule base by integrating multi-dimensional data, lays a precise decision-making foundation for the entire dynamic permission management system, enabling permission configuration to closely align with the company's actual business processes and security standards, thus avoiding the problem of traditional static permission management being out of touch with business needs.

[0053] The real-time dynamic task phase judgment mechanism ensures that permission adjustments are synchronized with project progress. Furthermore, the multi-phase iterative task identification based on natural language processing and dependency analysis can predict the dynamic changes in permission requirements in advance. In development projects, when it is identified that a project is using an agile development model with multiple iterations, the system can pre-configure nested permission capsules for each iteration cycle, achieving proactive permission management. Compared to the traditional method of temporarily adjusting permissions during phase transitions, this significantly improves the timeliness and accuracy of permission management, effectively reducing the risk of information leakage due to chaotic permission transitions. Simultaneously, the reuse of historical data improves the efficiency of permission configuration for new projects, providing strong underlying support for secure cross-project and cross-phase collaborative work within enterprises.

[0054] like Figure 2 As shown, determining the stage of the task, identifying the task content, and identifying whether the project is a multi-phase iterative task specifically includes:

[0055] S111 automatically collects task planning information, extracts each node of the task, and collects the internal security policies and historical permission configuration data of the enterprise responsible for the task to build a basic rule base for dynamic permission lifecycle management and clarify the basic permission level corresponding to different task nodes.

[0056] S112: Real-time acquisition of task completion rate and node achievement data; comparison of the current task status with task nodes in the basic rule base to determine the specific stage of the task.

[0057] S113 uses natural language processing technology to perform semantic analysis on the task description document, extracts stage keywords in the task, determines whether the task contains multiple interrelated subtasks that need to be progressively advanced, and whether there are dynamic changes in permission requirements between subtasks, and defines them as multi-phase iterative tasks.

[0058] S200, based on the project stage and the project task content identification results, automatically execute dynamic permission adjustment operations for user permission levels. The dynamic permission adjustment operations include modifying the user's read and write permissions, export permissions, and historical access permissions for documents.

[0059] S300 assigns permissions to employees. For multi-phase iteration tasks, it creates nested permission capsules for each phase of the task and configures resource access rules for each nested permission capsule. If it is determined that the task is currently in the closing phase, regardless of whether it is in a multi-phase iteration task, it implements permission decay control operation for non-permissioned members. When the phase transition is executed, it identifies all the permissions required for the previous phase and the permissions required for the same operation in the next phase, and performs automatic replacement of operation permissions.

[0060] By leveraging the data integration between the enterprise human resource management system and the task management platform, the system automatically obtains employees' job level information (such as director, engineer, etc.) and their role in specific tasks (such as requirements analyst, test manager, etc.). It also combines the RBAC (role-based access control) model and the ABAC (attribute-based access control) model to dynamically assign basic permissions and temporary task permissions to employees.

[0061] For multi-phase iteration tasks, the system will create independent permission capsules for each development phase (requirements analysis, prototype design, integration testing) based on the task decomposition structure and phase dependency graph. Each capsule uses encrypted container technology to encapsulate the resource access strategy of that phase, and uses a directed acyclic graph algorithm to nest the capsules of each phase in the order of requirements analysis → design → development → testing, ensuring that the capsule of the later phase can only call the output results of the capsule of the previous phase.

[0062] In the resource access rule configuration phase, based on the enterprise's data classification standards and business needs at each stage, historical permission configuration cases are analyzed to generate refined permission rules. When a task enters the final stage, the system obtains completion data in real time through the task progress monitoring interface, automatically filters out members not included in the final stage permission capsule, shrinks their access permissions to only be able to view the read-only version of the final deliverables, and simultaneously calls the enterprise data loss prevention (DLP) system via API to close these members' access channels to intermediate process documents and activates cross-departmental firewall policies to block unnecessary internal data transmission.

[0063] During the automatic permission replacement process during phase transitions, the permission replacement process is triggered by task status change events (such as email notifications of phase review approval or status updates in the project management system). First, based on the enterprise security baseline and project customization strategy, a permission mapping table between the upper and lower phases is constructed (such as code submission permissions in the development phase corresponding to test case execution permissions in the testing phase). When switching phases, the permissions of the previous phase are revoked in batches through automated scripts, and new permissions are granted simultaneously. The entire process records permission change logs through blockchain technology to ensure that the operation is traceable.

[0064] This step establishes a three-tiered protection system—dynamic roles, nested phases, and permission decay—to build a permission management mechanism deeply coupled with business processes. Nested permission capsule technology enables the minimal, on-demand allocation of permissions, ensuring that participants in each task phase can only access the resources necessary for that phase.

[0065] The permission decay mechanism in the closing stage solves the problem of delayed permissions in traditional collaborative office work when the project ends but permissions are not revoked. The automated permission replacement during the stage transition eliminates the window of risk of manually adjusting permissions. It is several times more efficient than the traditional manual approval process. In the scenario of rapid iteration of Internet products, it can support batch updates of permissions once a week, ensuring a balance between security and efficiency in the agile development model.

[0066] like Figure 3 As shown, the process of creating nested permission capsules for each stage of the task and configuring resource access rules for each nested permission capsule specifically includes:

[0067] S311: Assign permissions to employees based on their job level and role in the task;

[0068] S312, for multi-phase iteration tasks, creates independent permission capsules for each task phase according to the task phase division;

[0069] S313, based on the sequence and dependency between each stage, all permission capsules are nested hierarchically to form multi-level nested permission capsules. Each capsule corresponds to a task stage, and a unique mapping relationship between the stage and the permission capsule is established.

[0070] S314, combining the business needs, data sensitivity, and participating personnel of each task stage, configures resource access rules for each nested permission capsule, clarifying the operation permissions of different employees for different resources.

[0071] like Figure 4 As shown, the permission decay control operation for non-authorized members specifically includes:

[0072] S321, Identify the current stage of the task. When the task progress reaches the final stage, filter out non-authorized members who do not belong to the final stage's authorization capsule based on the employee's authorization allocation results, and determine the scope of the authorization decay control object.

[0073] S322: For all identified non-authorized members, restrict access permissions to include only the final results and prohibit any content extraction operations; at the same time, activate the cross-departmental collaboration isolation mechanism and close unnecessary data transmission channels.

[0074] like Figure 5 As shown, the process of identifying all permissions required for operations in the previous stage and the permissions required for the same operations in the next stage, and then automatically replacing the operation permissions, specifically includes:

[0075] S331, based on the tracking results of task progress, monitors task phase transition signals in real time through task progress monitoring and event triggering mechanisms;

[0076] S332, based on the internal security standards of the enterprise responsible for the task and the characteristics of the project, determine the operation type of each stage, and at the end of the previous stage, identify all the permissions required to perform each operation in the previous stage, as well as the new permissions required for the same operation in the next stage.

[0077] S333: During phase transition, automatically perform permission replacement operation, revoke all operation permissions of the previous phase, and simultaneously assign new permissions to the corresponding operations and record the permission replacement information.

[0078] S400 records the replacement time during the automatic replacement of operation permissions. If the replacement time period is not within the safe time period range, the replacement process is forcibly terminated and a sensitive operation report is generated.

[0079] During actual operation, the system records millisecond-accurate timestamps at the start and end of permission replacement operations via a clock synchronization service. These timestamps, along with operation logs, user IDs, and permission change types, are then hashed and encrypted for storage, forming an immutable time chain. The preset mechanism for secure time intervals combines the enterprise's historical security event database with analysis of peak business periods, using machine learning algorithms to generate dynamically adjusted security windows.

[0080] When a permission replacement operation is triggered, the system will retrieve the server's timezone configuration and timezone conversion rules from around the world in real time, and convert the timestamp to Coordinated Universal Time for comparison to avoid time misjudgment caused by cross-timezone operations. If the replacement operation is detected to occur outside the secure period, the system will immediately terminate the permission replacement process through a hardware-level interrupt mechanism. At the same time, it will call the enterprise message push platform to send an emergency alarm containing biometric authentication (fingerprint + dynamic verification code) to the security administrator, and automatically generate a sensitive operation report containing a permission comparison table before and after the permission change, sensitivity level labels of the files involved, and source information of the operation IP address.

[0081] like Figure 6 As shown, recording the replacement time during the automatic replacement of operation permissions specifically includes:

[0082] S411, Record operation timestamps at the start and end of the permission replacement operation;

[0083] S412, based on the mission schedule and the pattern of historical security incidents, preset safe time intervals;

[0084] S413, compare the timestamp recorded for permission replacement with the safe time period interval to determine whether the operation is within the safe time period interval;

[0085] S414 If the timestamp is outside the safe time period, the permission replacement process will be forcibly terminated immediately, and a sensitive operation report will be generated. The report will include the operation time, the users involved, and details of the permission change.

[0086] Figure 7 A structural block diagram of a collaborative office security management system for preventing information leakage, provided in an embodiment of the present invention, is shown below. Figure 7 As shown, the system includes:

[0087] The task planning information collection module 100 is used to collect task planning information, obtain project nodes, build a basic rule base for dynamic permission lifecycle management, track task progress in real time, compare the current task status with the preset basic rule base, determine the stage of the task, identify the task content, and identify whether the project is a multi-phase iteration task.

[0088] The dynamic permission adjustment module 200 is used to automatically perform dynamic permission adjustment operations on the user permission level based on the project stage and the project task content identification results. The dynamic permission adjustment operations include modifying the user's read and write permissions, export permissions, and historical access permissions for documents.

[0089] The task permission management module 300 is used to assign permissions to employees. For multi-phase iterative tasks, nested permission capsules are created for each stage of the task, and resource access rules are configured for each nested permission capsule. If it is determined that the task is currently in the closing stage, regardless of whether it is in a multi-phase iterative task, permission decay control is implemented for non-permissioned members. When the stage transition is performed, the permissions required for all operations in the previous stage and the permissions required for the same operations in the next stage are identified, and the operation permissions are automatically replaced.

[0090] The security monitoring module 400 is used to record the replacement time during the automatic replacement of operation permissions. If the replacement time period is not within the safe time period range, the replacement process will be forcibly terminated and a sensitive operation report will be generated.

[0091] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0092] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0093] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A collaborative office security management method to prevent information leakage, characterized in that, The method includes: Collect task planning information, obtain project nodes, build a basic rule base for dynamic permission lifecycle management, track task progress in real time, compare the current task status with the preset basic rule base, determine the stage of the task, identify the task content, and identify whether the project is a multi-phase iteration task. Based on the project's current stage and the identification results of the project's tasks, the system automatically performs dynamic permission adjustment operations at the user permission level. These dynamic permission adjustment operations include modifying the user's read and write permissions, export permissions, and historical access permissions for documents. To assign permissions to employees, for multi-phase iteration tasks, nested permission capsules are created for each phase of the task, and resource access rules are configured for each nested permission capsule. If it is determined that the task is currently in the closing phase, regardless of whether it is in a multi-phase iteration task, permission decay control is implemented for non-permissioned members. When a phase transition is performed, the permissions required for all operations in the previous phase and the permissions required for the same operations in the next phase are identified, and the operation permissions are automatically replaced. During the automatic replacement of operation permissions, the replacement time is recorded. If the replacement time period is not within the safe time period range, the replacement process is forcibly terminated and a sensitive operation report is generated. The process of creating nested permission capsules for each stage of the task and configuring resource access rules for each nested permission capsule specifically includes: Assign permissions to employees based on their job level and role in the task; For multi-phase iteration tasks, separate permission capsules are created for each task phase based on the task phase. Based on the sequence and dependencies between stages, all permission capsules are nested hierarchically to form multi-level nested permission capsules. Each capsule corresponds to a task stage, and a unique mapping relationship between stages and permission capsules is established. Based on the business needs, data sensitivity, and participating personnel at each task stage, configure resource access rules for each nested permission capsule to clarify the operation permissions of different employees for different resources.

2. The method according to claim 1, characterized in that, The process of determining the stage of a task, identifying its content, and determining whether a project is a multi-phase iterative task specifically includes: Automatically collect task planning information, extract each node of the task, and collect the internal security policies and historical permission configuration data of the enterprise responsible for the task to build a basic rule base for dynamic permission lifecycle management and clarify the basic permission level corresponding to different task nodes. Real-time acquisition of task completion and node achievement data; comparison of the current task status with task nodes in the basic rule base to determine the specific stage of the task. Natural language processing techniques are used to perform semantic analysis on task description documents, extract stage keywords in the task, determine whether the task contains multiple interrelated subtasks that need to be progressively advanced, and whether there are dynamic changes in permission requirements between subtasks, and define them as multi-phase iterative tasks.

3. The method according to claim 2, characterized in that, The permission decay control operation for non-authorized members specifically includes: Identify the current stage of the task. When the task reaches the final stage, filter out non-authorized members who do not belong to the final stage's permission capsule based on the employee's permission allocation results, and determine the scope of the object subject to permission decay control. For all identified non-authorized members, access permissions will be restricted to include only the final results, and any content extraction operations will be prohibited; at the same time, a cross-departmental collaboration isolation mechanism will be activated, and unnecessary data transmission channels will be closed.

4. The method according to claim 3, characterized in that, The process of identifying all permissions required for operations in the previous stage and the permissions required for the same operations in the next stage, and then automatically replacing these permissions, specifically includes: Based on the tracking results of task progress, the task phase transition signals are monitored in real time through task progress monitoring and event triggering mechanisms; Based on the internal security regulations of the enterprise responsible for the task and the characteristics of the project, determine the operation type for each stage. At the end of the previous stage, identify all permissions required to perform each operation in the previous stage, as well as the new permissions required for the same operation in the next stage. During phase transition, the permission replacement operation is automatically executed, the operation permissions of the previous phase are revoked, and the new permissions are assigned to the corresponding operations at the same time as the phase switch is executed, and the permission replacement information is recorded.

5. The method according to claim 4, characterized in that, The process of automatically replacing operation permissions includes recording the replacement time, specifically including: Record operation timestamps at the start and end of the permission replacement operation; Based on the mission schedule and the patterns of historical security incidents, preset safe time periods are established. The timestamp of the permission replacement is compared with the safe time period interval to determine whether the operation is within the safe time period interval. If the timestamp is outside the safe time period, the permission replacement process will be forcibly terminated immediately, and a sensitive operation report will be generated, including the operation time, the users involved, and details of the permission change.

6. A collaborative office security management system for preventing information leakage, used to implement the method described in any one of claims 1-5, characterized in that, The system includes: The task planning information collection module is used to collect task planning information, obtain project nodes, build a basic rule base for dynamic permission lifecycle management, track task progress in real time, compare the current task status with the preset basic rule base, determine the stage of the task, identify the task content, and identify whether the project is a multi-phase iteration task. The dynamic permission adjustment module is used to automatically perform dynamic permission adjustment operations on the user permission level based on the project stage and the project task content identification results. The dynamic permission adjustment operations include modifying the user's read and write permissions, export permissions, and historical access permissions for documents. The task permission management module is used to assign permissions to employees. For multi-phase iterative tasks, nested permission capsules are created for each stage of the task, and resource access rules are configured for each nested permission capsule. If it is determined that the task is currently in the closing stage, regardless of whether it is in a multi-phase iterative task, permission decay control is implemented for non-permissioned members. When the stage transition is performed, the module identifies all the permissions required for the previous stage and the permissions required for the same operation in the next stage, and performs automatic replacement of operation permissions. The security monitoring module records the replacement time during the automatic replacement of operation permissions. If the replacement time period is not within the safe time period range, the replacement process is forcibly terminated and a sensitive operation report is generated. The process of creating nested permission capsules for each stage of the task and configuring resource access rules for each nested permission capsule specifically includes: Assign permissions to employees based on their job level and role in the task; For multi-phase iteration tasks, separate permission capsules are created for each task phase based on the task phase. Based on the sequence and dependencies between stages, all permission capsules are nested hierarchically to form multi-level nested permission capsules. Each capsule corresponds to a task stage, and a unique mapping relationship between stages and permission capsules is established. Based on the business needs, data sensitivity, and participating personnel at each task stage, configure resource access rules for each nested permission capsule to clarify the operation permissions of different employees for different resources.

Images