AI assistant permission configuration and check system

Abstract

The invention discloses an AI assistant permission configuration and verification system. The system comprises a database module, a verification module and a verification module, wherein the database module is used for storing all business data; the user permission module configures and records the permission of accessing the service data owned by the user; when the global AI assistant calls the database module, the permission processing module checks the user permission with the user permission module, and gives a user authorization range; and the global AI assistant module obtains the questions consulted by the user, calls the business data according to the user authorization range, analyzes the business data by using the AI large model, and outputs the answers to the questions consulted by the user. According to the technical scheme provided by the invention, through multi-level permission checking, the security problem that sensitive information is leaked due to the fact that a global AI assistant function cannot distinguish the permission of a user when calling the data due to the fact that the data of the database has no permission setting is solved; the upgrading and reconstruction cost of the original system is reduced, the whole AI assistant function can be realized, the data security is met, and the user experience is improved.

Description

Technical Field

[0001] This invention relates to the field of permission configuration, and more particularly to an AI assistant permission configuration and verification system. Background Technology

[0002] With the development of AI assistants and AI big data modeling technologies, more and more enterprises are leveraging AI assistants to call upon AI big data models to solve real-world problems. In enterprise-level application systems, AI big data models are used to participate in data analysis of certain business flows. The access permissions for these AI big data models are allocated along with these business flows, and the entry point for the AI ​​big data models is also within the specific business flow. For example, adding an AI big data model to the procurement process to evaluate procurement data helps the company make better purchasing decisions; the AI ​​big data model for the procurement process follows the allocated permissions of the procurement business. Furthermore, AI big data models can be integrated with an enterprise knowledge base, using AI assistants to provide all enterprise users with quick-response experts from the knowledge base. For example, if the company establishes industry laws and regulations, adding an AI big data model can provide each user with AI-powered legal and regulatory consultation experts. Here, the AI ​​big data model is directly provided to all users of the company, without requiring very detailed permission division. For the above situations, currently, the introduction of AI big data model technology into enterprise information systems does not consider the redistribution of permissions; it either directly applies to public permissions for all company members or is embedded in a specific business process, with permissions allocated along with the business process's permissions. Such large AI models either lack permission filtering, leading to information security issues, or can only be applied in certain scenarios, failing to realize the full potential of large AI models.

[0003] Existing IT systems typically don't store individual user permissions. This data is directly accessed by various functional modules, meaning that user access is determined by the permissions assigned to these modules or data groups. IT systems use detailed permission configuration tables (e.g., viewing, adding, editing, and deleting permissions for specific data on a page) to configure data processing permissions for individual users or roles. However, when building a global AI assistant, the AI ​​assistant operates outside this permission configuration table, directly retrieving data from the company database and providing analysis results. Therefore, each user in the company usually only has on / off permissions for the global AI assistant, making it impossible for the AI ​​assistant to provide data security-compliant answers based on the user's detailed permission scope.

[0004] Therefore, the problem of how to combine large AI models with business data from enterprise-level application systems, utilize a unified entry point for AI assistants to quickly respond to and answer questions from various users, and output AI data analysis results within the scope of each user's data permissions has not yet been well resolved. Summary of the Invention

[0005] In view of the above-mentioned shortcomings of the current technology, the present invention provides an AI assistant permission configuration and verification system. Through multi-level permission verification, the system reviews the data retrieved by the user layer by layer, which solves the security problem that the lack of permission settings in the database leads to the inability of the global AI assistant function to distinguish the user's permissions when calling data, resulting in the leakage of sensitive information.

[0006] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0007] An AI assistant permission configuration and verification system includes: a database module, a user permission module, a permission processing module, and a global AI assistant module; wherein,

[0008] The database module is used to store all business data;

[0009] The user permissions module is used to configure and record the permissions that users have to access business data;

[0010] The permission processing module is used to verify user permissions with the user permission module and provide the scope of user authorization when the global AI assistant calls the database module;

[0011] The global AI assistant module is used to obtain user inquiries, and based on the user's authorization scope given by the permission processing module, retrieve the corresponding business data from the database module, analyze it using the AI ​​big data model, and output the answer to the user's inquiry.

[0012] According to one aspect of the present invention, the global AI assistant module further includes:

[0013] When business data is outside the scope of user authorization, the database module will stop being accessed, and no AI analysis will be performed. The user will be directly informed that they do not have permission to access the relevant business data.

[0014] According to one aspect of the present invention, the database module includes:

[0015] The data table module is used to store various business data;

[0016] The tag module is used to tag each data table and various business data.

[0017] According to one aspect of the present invention, the tag module includes:

[0018] The overall permissions, associated objects, related functions, and tables for storing business data;

[0019] Store the total permissions, belonging objects, and related functions of the data table.

[0020] According to one aspect of the present invention, when the global AI assistant calls the database module, the permission processing module verifies the user's permissions with the user permission module, including the following steps:

[0021] The global AI assistant module searches for relevant data tables in the data table module, activates the tag module corresponding to the data table, and passes the total permissions, belonging objects, and associated functions of the data table to the permission processing module.

[0022] If the overall permissions for the data table are off, the permission processing module will directly report the result that it cannot be called to the global AI assistant module. The global AI assistant module will then stop calling the data table and the business data in the data table and will not perform any further processing steps.

[0023] If the overall permissions for the data table are enabled, the object to which the data table belongs is matched with the user's permissions. If no match is found, it means that the user does not have permission for the data table. The permission processing module then reports the result that the data cannot be accessed to the global AI assistant module. The global AI assistant module stops accessing the data table and the business data in the data table and does not perform any further processing steps.

[0024] If the object to which the data table belongs matches the user's permissions, then the association function of the data table is matched with the user's permissions. If they do not match, it means that the user does not have permission for the business data. The permission processing module reports the result that it cannot be called to the global AI assistant module. The global AI assistant module stops calling the data table and the business data in the data table and does not perform any further processing steps.

[0025] If the data table's association function matches the user's permissions, the global AI assistant module will search for the business data in that data table and match the table to which the business data belongs with the user's permissions. If they don't match, the global AI assistant module will discard the business data; if they do match, the global AI assistant module will adopt the business data.

[0026] According to one aspect of the present invention, when configuring permissions for new users, user grouping and preset permissions can be used to configure permissions for new users.

[0027] According to one aspect of the present invention, a graph neural network is constructed based on users and permissions, and embeddings of user and permission nodes are learned. When configuring permissions for a new user, the learned user embeddings and permission embeddings are used to recommend permissions.

[0028] According to one aspect of the present invention, an association rule base is constructed based on the association relationship of user permissions. When configuring the permissions of a new user, the permission of the new user can be configured using the association rule base.

[0029] According to one aspect of the present invention, the AI ​​assistant permission configuration and verification system further includes:

[0030] The business function module is used to retrieve business data from the database module, present it to the user, and store the business data after the user's operation into the database module.

[0031] According to one aspect of the present invention, the user permission module further includes:

[0032] Configure and record the permissions that users have for the business function modules.

[0033] Advantages of implementing this invention:

[0034] This invention provides an AI assistant permission configuration and verification system. Through multi-level permission verification, it reviews user data access layer by layer, solving the security problem of sensitive information leakage caused by the lack of permission settings in the database, which prevents the global AI assistant function from distinguishing user permissions when accessing data. It also reduces the upgrade and transformation costs of the original system, enables AI assistant functionality for all users, meets the needs of different users to access large AI models through a unified entry point, and improves user experience while ensuring data security. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a structural diagram of an AI assistant permission configuration and verification system according to the present invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] Example 1

[0039] like Figure 1 As shown, an AI assistant permission configuration and verification system includes: a database module, a user permission module, a permission processing module, and a global AI assistant module.

[0040] Preferably, the AI ​​assistant permission configuration and verification system further includes: a business function module.

[0041] Business function module: Used to retrieve business data from the database module, present it to the user, and store the business data after the user's operation into the database module.

[0042] Database module: Used to store all business data.

[0043] The database module is the area in an information system that stores all data. It typically includes data tables containing various business data. In order to solve the data permission problem of the global AI assistant, this method adds a tag module to tag the data tables and each piece of data in the data tables for permission verification.

[0044] Specifically, the database module includes: a data table module and a tag module.

[0045] Data table module: Used to store various business data.

[0046] Tag module: Used to tag each data table and various business data.

[0047] Specifically, the tag module includes:

[0048] (1) The four pieces of information for storing business data, from largest to smallest, are: total permissions, belonging object, associated function, and belonging table;

[0049] (2) The three pieces of information stored in the data table, from largest to smallest, are: total permissions, belonging object, and associated functions.

[0050] Master permissions: This is like a master switch, used to quickly enable or disable viewing permissions for this data table or business data. Only when master permissions are enabled can the system further verify subsequent permissions for this data.

[0051] Belonging Object: Records the object to which the data table or business data belongs. Generally, it is the primary key of the table with the most relationships among all data tables. For example, in a ship management system, many tables are related to ships, such as the ship certificate table, equipment table, procurement cost table, and crew table. In this case, the ship is regarded as the object, and the ship is called the belonging object of the data in these tables.

[0052] Associated Functions: Records the business functions associated with this data. When a business function module in the system retrieves or stores a piece of data, it will add an associated business function tag to that data.

[0053] Table to which the business data belongs: The data table to which the business data belongs.

[0054] User Permissions Module: Used to configure and record the permissions that users have to access business data, specifically including permissions for business function modules, objects, data tables, etc.

[0055] In practical applications, configuring user permissions traditionally requires setting the scope of business functions or data that each user can access individually. This process is time-consuming and labor-intensive, and is prone to uneven permission allocation or configuration errors due to human error. This one-to-one fine-grained configuration method is manageable in scenarios with a small user base or simple permission requirements, but its complexity increases exponentially when dealing with a large number of users or complex permission systems.

[0056] Therefore, to improve the efficiency of permission configuration and reduce management costs, users can be grouped into groups with similar permission needs, and different user groups can be preset with permissions. When it is necessary to configure permissions for new users, user groups and preset permissions can be used to configure permissions for new users, thereby greatly simplifying the operation process, optimizing permission management, and improving security.

[0057] There are several ways to group users and preset permissions. For example, user roles can be set based on general user categories, including levels such as administrators, technical staff, regular users, and visitors, with different permissions assigned to different user roles. When configuring permissions for a new user, simply select the corresponding user role for the new user to achieve the desired permission settings.

[0058] In addition, machine learning methods such as hierarchical clustering, DBSCAN clustering, and Gaussian mixture models, as well as deep learning methods such as autoencoders and deep clustering models, can be used to segment users and preset permissions.

[0059] Preferably, a graph neural network can also be constructed based on users and permissions to perform embedding learning on user and permission nodes. When configuring permissions for a new user, the learned user embedding and permission embedding are used to recommend permissions.

[0060] Specifically, a heterogeneous graph structure of users and permissions can be constructed first, representing users and permissions with nodes, and connecting nodes with edges.

[0061] User node: Represents a user in the system. Attributes may include user ID, role, department, historical behavior, etc.

[0062] Permission node: Represents permissions in the system (such as access permissions for business functions, objects, data tables, etc.). Attributes may include permission type, resource identifier, operation type, etc.

[0063] User-permission edge: Represents the permissions granted to a user. The edge can have a weight (such as the strength of the permission, frequency of use, etc.).

[0064] User-user edges: Represent the relationships between users (such as superiors and subordinates, team collaboration relationships, etc. in an organizational structure), used to model the propagation or inheritance of permissions.

[0065] Permission-permission edge: Represents the dependency relationship between permissions (such as certain permissions requiring prerequisite permissions), used to model the constraints of permissions.

[0066] Then, graph neural networks (GNNs), such as GCN, GAT, and GraphSAGE, are used to learn the embeddings of user and permission nodes. Through a message passing mechanism, permission information of user nodes and user information of permission nodes are aggregated to learn context-aware representations of users and permissions.

[0067] After the graph neural network is trained, the learned user embeddings and permission embeddings are used to recommend permissions when configuring permissions for new users. In an enterprise's organizational structure, permission inheritance can also be automatically inferred based on user-user relationships.

[0068] Permission processing module: When the global AI assistant calls the database module, it verifies user permissions with the user permission module and provides the scope of user authorization.

[0069] Specifically, when the global AI assistant calls the database module, the permission processing module synchronously records the tag information of the data tables or business data to be retrieved, performs synchronous verification with the user permission module, and feeds back the verification result to the global AI assistant, so that the global AI assistant can determine whether to further retrieve these data tables or business data.

[0070] Global AI Assistant Module: This module is used to obtain user inquiries, and based on the user's authorization scope given by the permission processing module, retrieve the corresponding business data from the database module, analyze it using a large AI model, and output the answers to the user's inquiries.

[0071] The global AI assistant module can access the API interface of the market's large AI model, obtain relevant data from the database, analyze user inquiries using the large AI model, obtain the results, and then provide feedback to the user.

[0072] When the data table or business data is not within the scope of the user's authorization, the global AI assistant module stops calling the database module and does not perform AI analysis, directly informing the user that they do not have the right to access the corresponding data table or business data.

[0073] Specifically, when the global AI assistant calls the database module, the permission processing module verifies user permissions with the user permission module, including the following steps:

[0074] (1) When a user asks a question to the AI ​​assistant, the global AI assistant module and the user permission module are activated. The global AI assistant module starts to retrieve data from the database module, and the user permission module connects the user's permissions (specifically including the user's permissions to access business function modules, objects, data tables, etc.) to the permission processing module. That is, the permission processing module can know which objects and which tables the user has permission to, so as to verify the user's permissions.

[0075] (2) The global AI assistant module searches for relevant data tables in the data table module, activates the corresponding tag module of the data table, and passes the total permissions, belonging objects, and associated function parameters of the data table to the permission processing module. The permission processing module can match and verify these parameters with the user's permissions.

[0076] (3) If the total permissions of the data table are off, the permission processing module will directly report the result that it cannot be called to the global AI assistant module. The global AI assistant module will stop calling the data table and the business data in the data table and will no longer perform subsequent steps.

[0077] (4) If the total permissions of the data table are enabled, the permissions of the object to which the data table belongs are matched with the permissions of the object owned by the user. If no match is found, it means that the user does not have the permissions for the object and the data table. The permission processing module will then report the result that it cannot be called to the global AI assistant module. The global AI assistant module will stop calling the data table and the business data in the data table and will not perform any further processing steps.

[0078] (5) If the object to which the data table belongs can be matched with the user's permissions, the associated functions of the data table will be matched with the permissions of the business functions that the user has. If they cannot be matched, it means that the user does not have the permissions for the business function and business data. The permission processing module will report the result that it cannot be called to the global AI assistant module. The global AI assistant module will stop calling the data table and the business data in the data table and will not perform subsequent steps.

[0079] (6) If the association function of the data table can match the user's permissions for the business functions, the global AI assistant module will search for the business data in the data table and match the table to which the business data belongs with the user's permissions for the data table. If they cannot match, the global AI assistant module will discard the business data. If they can match, the global AI assistant module will adopt the business data.

[0080] When performing data analysis, the AI ​​large model usually needs to retrieve data from multiple data tables. Therefore, the global AI assistant will search and verify multiple data tables at the same time, and the process is carried out in accordance with the above steps (2) to (6).

[0081] After the global AI assistant retrieves business data, the AI ​​model infers an answer from the adopted data range, and then the AI ​​assistant provides the answer to the user. If the global AI assistant receives a large number of requests for unauthorized access while searching for relevant data, making it unable to analyze the results, it will then send a "Permission denied" message to the user.

[0082] This system provides a good solution for the AI ​​upgrade and transformation of existing information systems. When data is called by various business function modules, data tags are stored on both the data table and the data. This does not change the original business function logic and permission allocation mechanism of the system. Only an additional tag module needs to be added to the data in the database. This tag module stores several key pieces of information about the data called by each business module, which facilitates permission verification by the permission processing module of the global AI function.

[0083] The beneficial effects of this embodiment are as follows:

[0084] This system addresses the security issue of data access restrictions in the database, which prevented the global AI assistant from distinguishing user permissions when accessing data, thus leading to the leakage of sensitive information.

[0085] This system reduces the upgrade and transformation costs of the original system, enables AI assistant functionality for all users, meets the needs of different users to call up large AI models through a unified entry point, and improves user experience while ensuring data security.

[0086] This system uses multi-level permission verification to review user data requests layer by layer. It quickly locates and verifies regional data by object and function. If the data meets the requirements, it is deferred layer by layer. The AI ​​big data model obtains the data for analysis. If the data does not meet the requirements, the system directly provides the results.

[0087] This system also utilizes user grouping and preset permissions to simplify the permission setting process for new users, optimize permission management, and enhance security.

[0088] Example 2

[0089] like Figure 1 As shown, an AI assistant permission configuration and verification system includes: a database module, a user permission module, a permission processing module, and a global AI assistant module.

[0090] Preferably, the AI ​​assistant permission configuration and verification system further includes: a business function module.

[0091] Business function module: Used to retrieve business data from the database module, present it to the user, and store the business data after the user's operation into the database module.

[0092] Database module: Used to store all business data.

[0093] The database module is the area in an information system that stores all data. It typically includes data tables containing various business data. In order to solve the data permission problem of the global AI assistant, this method adds a tag module to tag the data tables and each piece of data in the data tables for permission verification.

[0094] Specifically, the database module includes: a data table module and a tag module.

[0095] Data table module: Used to store various business data.

[0096] Tag module: Used to tag each data table and various business data.

[0097] Specifically, the tag module includes:

[0098] (1) The four pieces of information for storing business data, from largest to smallest, are: total permissions, belonging object, associated function, and belonging table;

[0099] (2) The three pieces of information stored in the data table, from largest to smallest, are: total permissions, belonging object, and associated functions.

[0100] Master permissions: This is like a master switch, used to quickly enable or disable viewing permissions for this data table or business data. Only when master permissions are enabled can the system further verify subsequent permissions for this data.

[0101] Belonging Object: Records the object to which the data table or business data belongs. Generally, it is the primary key of the table with the most relationships among all data tables. For example, in a ship management system, many tables are related to ships, such as the ship certificate table, equipment table, procurement cost table, and crew table. In this case, the ship is regarded as the object, and the ship is called the belonging object of the data in these tables.

[0102] Associated Functions: Records the business functions associated with this data. When a business function module in the system retrieves or stores a piece of data, it will add an associated business function tag to that data.

[0103] Table to which the business data belongs: The data table to which the business data belongs.

[0104] User Permissions Module: Used to configure and record the permissions that users have to access business data, specifically including permissions for business function modules, objects, data tables, etc.

[0105] In practical applications, configuring user permissions traditionally requires setting the scope of business functions or data that each user can access individually. This process is time-consuming and labor-intensive, and is prone to uneven permission allocation or configuration errors due to human error. This one-to-one fine-grained configuration method is manageable in scenarios with a small user base or simple permission requirements, but its complexity increases exponentially when dealing with a large number of users or complex permission systems.

[0106] Therefore, to improve the efficiency of permission configuration and reduce management costs, a relational rule base can be built based on the relationship between user permissions. When configuring permissions for new users, the relational rule base can be used to configure the permissions for new users, thereby greatly simplifying the operation process, optimizing permission management, and improving security.

[0107] Specifically, relevant data can be collected first, including user information such as user ID, role, department, position, etc., permission information such as permission ID, permission type, resource identifier, operation type, etc., user-permission allocation records such as historical permission allocation data, including grant time, usage frequency, etc., and user behavior logs such as the actual usage records of permissions by users (such as access time, operation type, etc.).

[0108] The collected data is preprocessed and cleaned. Then, feature engineering is used to encode users and permissions (such as one-hot encoding and embedding representation), extract time features (such as the active time period for permission granting), and calculate statistical features (such as permission usage frequency and the number of user access permissions).

[0109] Then, using methods such as Apriori, FP-Growth, and sequence pattern mining (e.g., GSP method), association rule mining is performed on the data to discover frequent patterns between users and permissions. The mined association rules are stored in a database to build an association rule library.

[0110] Permission processing module: When the global AI assistant calls the database module, it verifies user permissions with the user permission module and provides the scope of user authorization.

[0111] Specifically, when the global AI assistant calls the database module, the permission processing module synchronously records the tag information of the data tables or business data to be retrieved, performs synchronous verification with the user permission module, and feeds back the verification result to the global AI assistant, so that the global AI assistant can determine whether to further retrieve these data tables or business data.

[0112] Global AI Assistant Module: This module is used to obtain user inquiries, and based on the user's authorization scope given by the permission processing module, retrieve the corresponding business data from the database module, analyze it using a large AI model, and output the answers to the user's inquiries.

[0113] The global AI assistant module can access the API interface of the market's large AI model, obtain relevant data from the database, analyze user inquiries using the large AI model, obtain the results, and then provide feedback to the user.

[0114] When the data table or business data is not within the scope of the user's authorization, the global AI assistant module stops calling the database module and does not perform AI analysis, directly informing the user that they do not have the right to access the corresponding data table or business data.

[0115] Specifically, when the global AI assistant calls the database module, the permission processing module verifies user permissions with the user permission module, including the following steps:

[0116] (1) When a user asks a question to the AI ​​assistant, the global AI assistant module and the user permission module are activated. The global AI assistant module starts to retrieve data from the database module, and the user permission module connects the user's permissions (specifically including the user's permissions to access business function modules, objects, data tables, etc.) to the permission processing module. That is, the permission processing module can know which objects and which tables the user has permission to, so as to verify the user's permissions.

[0117] (2) The global AI assistant module searches for relevant data tables in the data table module, activates the corresponding tag module of the data table, and passes the total permissions, belonging objects, and associated function parameters of the data table to the permission processing module. The permission processing module can match and verify these parameters with the user's permissions.

[0118] (3) If the total permissions of the data table are off, the permission processing module will directly report the result that it cannot be called to the global AI assistant module. The global AI assistant module will stop calling the data table and the business data in the data table and will no longer perform subsequent steps.

[0119] (4) If the total permissions of the data table are enabled, the permissions of the object to which the data table belongs are matched with the permissions of the object owned by the user. If no match is found, it means that the user does not have the permissions for the object and the data table. The permission processing module will then report the result that it cannot be called to the global AI assistant module. The global AI assistant module will stop calling the data table and the business data in the data table and will not perform any further processing steps.

[0120] (5) If the object to which the data table belongs can be matched with the user's permissions, the associated functions of the data table will be matched with the permissions of the business functions that the user has. If they cannot be matched, it means that the user does not have the permissions for the business function and business data. The permission processing module will report the result that it cannot be called to the global AI assistant module. The global AI assistant module will stop calling the data table and the business data in the data table and will not perform subsequent steps.

[0121] (6) If the association function of the data table can match the user's permissions for the business functions, the global AI assistant module will search for the business data in the data table and match the table to which the business data belongs with the user's permissions for the data table. If they cannot match, the global AI assistant module will discard the business data. If they can match, the global AI assistant module will adopt the business data.

[0122] When performing data analysis, the AI ​​large model usually needs to retrieve data from multiple data tables. Therefore, the global AI assistant will search and verify multiple data tables at the same time, and the process is carried out in accordance with the above steps (2) to (6).

[0123] After the global AI assistant retrieves business data, the AI ​​model infers an answer from the adopted data range, and then the AI ​​assistant provides the answer to the user. If the global AI assistant receives a large number of requests for unauthorized access while searching for relevant data, making it unable to analyze the results, it will then send a "Permission denied" message to the user.

[0124] The beneficial effects of this embodiment are: the system also utilizes an association rule base to simplify the permission setting process for new users, optimize permission management, and improve security.

[0125] Example 3

[0126] A computer program product comprising a computer program that, when executed, implements the AI ​​assistant permission configuration and verification system as described in Embodiment 1 or 2.

[0127] Example 4

[0128] A readable storage medium storing a computer program as described in Embodiment 3, wherein when the computer program is executed, it implements an AI assistant permission configuration and verification system as described in Embodiment 1 or 2.

[0129] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An AI assistant permission configuration and verification system, characterized in that, include: The module includes a database module, a user permission module, a permission processing module, and a global AI assistant module; among them, The database module is used to store all business data; The user permissions module is used to configure and record the permissions that users have to access business data; The permission processing module is used to verify user permissions with the user permission module and provide the scope of user authorization when the global AI assistant calls the database module; The global AI assistant module is used to obtain user inquiries, and based on the user's authorization scope given by the permission processing module, retrieve the corresponding business data from the database module, analyze it using the AI ​​big data model, and output the answer to the user's inquiry.

2. The AI ​​assistant permission configuration and verification system according to claim 1, characterized in that, The global AI assistant module also includes: When business data is outside the scope of user authorization, the database module will stop being accessed, and no AI analysis will be performed. The user will be directly informed that they do not have permission to access the relevant business data.

3. The AI ​​assistant permission configuration and verification system according to claim 1, characterized in that, The database module includes: The data table module is used to store various business data; The tag module is used to tag each data table and various business data.

4. The AI ​​assistant permission configuration and verification system according to claim 3, characterized in that, The tag module includes: The overall permissions, associated objects, related functions, and tables for storing business data; Store the total permissions, belonging objects, and related functions of the data table.

5. The AI ​​assistant permission configuration and verification system according to claim 4, characterized in that, When the global AI assistant calls the database module, the permission processing module verifies user permissions with the user permission module, including the following steps: The global AI assistant module searches for relevant data tables in the data table module, activates the tag module corresponding to the data table, and passes the total permissions, belonging objects, and associated functions of the data table to the permission processing module. If the overall permissions for the data table are off, the permission processing module will directly report the result that it cannot be called to the global AI assistant module. The global AI assistant module will then stop calling the data table and the business data in the data table and will not perform any further processing steps. If the overall permissions for the data table are enabled, the object to which the data table belongs is matched with the user's permissions. If no match is found, it means that the user does not have permission for the data table. The permission processing module then reports the result that the data cannot be accessed to the global AI assistant module. The global AI assistant module stops accessing the data table and the business data in the data table and does not perform any further processing steps. If the object to which the data table belongs matches the user's permissions, then the association function of the data table is matched with the user's permissions. If they do not match, it means that the user does not have permission for the business data. The permission processing module reports the result that it cannot be called to the global AI assistant module. The global AI assistant module stops calling the data table and the business data in the data table and does not perform any further processing steps. If the data table's association function matches the user's permissions, the global AI assistant module will search for the business data in that data table and match the table to which the business data belongs with the user's permissions. If they don't match, the global AI assistant module will discard the business data; if they do match, the global AI assistant module will adopt the business data.

6. The AI ​​assistant permission configuration and verification system according to claim 1, characterized in that, Users can be grouped and preset permissions can be set. When configuring permissions for new users, user grouping and preset permissions can be used to configure permissions for new users.

7. The AI ​​assistant permission configuration and verification system according to claim 6, characterized in that, A graph neural network is constructed based on users and permissions. Embeddings of user and permission nodes are learned. When configuring permissions for a new user, the learned user embeddings and permission embeddings are used to recommend permissions.

8. The AI ​​assistant permission configuration and verification system according to claim 1, characterized in that, Based on the relationships between user permissions, an association rule base is built. When configuring permissions for new users, the association rule base can be used to configure the permissions for new users.

9. The AI ​​assistant permission configuration and verification system according to claim 1, characterized in that, The AI ​​assistant permission configuration and verification system also includes: The business function module is used to retrieve business data from the database module, present it to the user, and store the business data after the user's operation into the database module.

10. The AI ​​assistant permission configuration and verification system according to claim 9, characterized in that, The user permission module also includes: Configure and record the permissions that users have for the business function modules.

Images