Office authority transfer management system for mobile office

Abstract

The invention relates to the technical field of computer authority management, and discloses an office authority transfer management system for mobile office, which comprises an authority abstraction layer module used for converting original authority representation of each terminal platform into unified and standardized intermediate state representation; the permission authorization service module is used for supporting permission verification, granting and revocation operations in an offline state; the scene sensing module is used for constructing a multi-dimensional scene feature space and identifying key features related to safety in a current scene through a multi-head attention network; the permission adjusting module is used for realizing a continuous permission control strategy from strict limitation to high freedom; the behavior monitoring module is used for recording permission use behaviors in an offline state and detecting potential abnormal operations; according to the method, the working continuity and the user experience in a mobile office environment are improved, and meanwhile, the enterprise data security is effectively guaranteed through a permission progressive release mechanism and a permission re-evaluation mechanism triggered by environment change.

Description

Technical Field

[0001] This invention relates to the field of computer access control technology, and more specifically, to an office access control transfer management system for mobile office use. Background Technology

[0002] With the widespread adoption of mobile work and remote collaboration, employees need to use multiple devices in different locations to handle work tasks. This work style requires employees to seamlessly switch between different devices and maintain work continuity. However, due to the differences in terminal devices and operating systems, access control and data access management have become significant technical challenges.

[0003] Current access control technologies are primarily designed for single devices or platforms, lacking a systematic approach to cross-device scenarios. In practical applications, users often need to switch frequently between multiple devices, and existing technologies struggle to guarantee the consistency of permission states and the continuity of work sessions. Especially when network connections are unstable or offline, the transfer and verification of permissions face significant technical bottlenecks.

[0004] Furthermore, traditional access control systems typically employ static security policies, failing to dynamically adjust permission scopes based on the specific context of a user. This lack of context awareness can lead to either excessive restrictions that negatively impact work efficiency or overly lenient security policies that introduce security vulnerabilities. Simultaneously, the lack of effective oversight of permission usage in offline environments increases the risk to enterprise data security. Summary of the Invention

[0005] This invention provides an office permission transfer management system for mobile office use, which solves the technical problems in related technologies such as inconsistent permission status between heterogeneous terminals, limited permission transfer in offline environments, lack of scenario adaptability of permission policies, poor continuity of cross-device sessions, and lack of supervision over the use of offline permissions.

[0006] This invention provides an office access control management system for mobile office use, comprising:

[0007] The permission abstraction layer module is used to convert the native permission representation of various terminal platforms into a unified and standardized intermediate representation;

[0008] The permission authorization service module is deployed on terminal devices to support permission verification, granting, and revocation operations in offline mode;

[0009] The scene perception module is used to construct a multi-dimensional scene feature space and identify key safety-related features in the current scene through a multi-head attention network.

[0010] The permission adjustment module dynamically adjusts the security boundary parameters of permissions based on the scenario security score, realizing a continuous permission control strategy from strictly restricted to highly flexible.

[0011] The behavior monitoring module records permission usage behavior in offline mode and compares it with expected behavior patterns after the network is restored to detect potential abnormal operations.

[0012] In a preferred embodiment, the permission abstraction layer module includes three components: a permission parser, a permission converter, and a permission verifier. The permission parser is used to identify and parse the native permission formats of various platforms, the permission converter is used to convert the native permissions into a unified representation, and the permission verifier is used to ensure that the converted permissions meet the requirements of consistency and integrity.

[0013] In a preferred embodiment, the unified and standardized intermediate state representation includes four basic elements: action, resource, constraint, and context. The action represents the operation that the permission allows to be performed, the resource represents the object of the operation, the constraint represents the restriction condition of the permission, and the context represents the usage scenario in which the permission is valid.

[0014] In a preferred embodiment, the permission authorization service module uses a conflict-free copy data type to manage distributed permission states, ensuring that permission operations can be automatically merged and conflicts resolved when performed across multiple devices. The conflict-free copy data type defines a complete state structure for permission items, including authorization time, authorizer, validity period, and operation restrictions.

[0015] In a preferred embodiment, the multi-dimensional scene feature space includes multiple dimensions such as location type, network security level, device status, surrounding environmental context, and user behavior patterns. Through multi-source data such as sensor data, network information, and user interaction behavior, the user's current work scene is comprehensively analyzed.

[0016] In a preferred embodiment, the multi-head attention network includes a feature embedding layer, a multi-head self-attention layer, and a fully connected output layer. The feature embedding layer converts different types of scene features into vector representations of a uniform dimension. The multi-head self-attention layer contains multiple attention heads, each focusing on different aspects of the input features. The fully connected output layer maps the results of the multi-head attention to a scene safety score.

[0017] In a preferred embodiment, the security boundary parameters include the scope of the permission, the validity period, the operation restrictions, and the audit level. When the scenario security score is high, the scope of the permission is broadened, the validity period is extended, and the operation restrictions are reduced. When the scenario security score is low, the scope of the permission is tightened, the validity period is shortened, and the operation restrictions are increased.

[0018] In a preferred embodiment, an office permission transfer management system for mobile office also includes a progressive permission release mechanism, which gradually expands the scope of permission operations based on the passage of time, user behavior, and trust assessment. The system initially grants the minimum necessary permissions, and gradually releases more permission operations as the user's secure usage permissions increase over time.

[0019] In a preferred embodiment, the comparison employs a behavior pattern matching algorithm, which compares the behavior sequences collected during offline periods with the expected behavior model constructed by the system based on the user's historical behavior data, calculates a similarity score, and evaluates the legality of the offline behavior. The expected behavior model includes three features: operation frequency, operation sequence, and time distribution.

[0020] In a preferred embodiment, a computer-readable storage medium is provided for storing computer-readable instructions that, when read by a computer, enable the operation of an office access transfer management system for mobile office use.

[0021] The beneficial effects of this invention are as follows:

[0022] The scenario-aware cross-device permission transfer method provided by this invention, by introducing a permission abstraction layer and a unified permission description language, achieves consistent expression and seamless migration of permission status between heterogeneous terminals, significantly improving work continuity and user experience in mobile office environments.

[0023] By using lightweight permission authorization services and conflict-free copy data types, this invention solves the problem of limited permission transfer in offline environments, enabling enterprise employees to maintain efficient collaboration even when the network is unavailable, while ensuring data consistency in a distributed environment.

[0024] Based on intelligent analysis using a multi-dimensional scene feature space and a multi-head attention network, this invention enables dynamic adjustment and scene adaptation of permission policies, ensuring data security while avoiding the impact of excessive restrictions on work efficiency. The gradual release of permissions and the permission re-evaluation mechanism triggered by environmental changes further enhance the system's security and flexibility.

[0025] The behavior pattern matching technology and offline monitoring mechanism of this invention effectively solve the shortcomings of traditional technologies in offline permission usage monitoring, providing enterprises with comprehensive security protection, while supporting the continuity of cross-device sessions, greatly improving work efficiency in mobile office environments. Attached Figure Description

[0026] Figure 1 This is a module diagram of an office access control system for mobile office use according to the present invention;

[0027] Figure 2 This is a bar chart comparing the accuracy of cross-platform permission migration scenarios according to the present invention;

[0028] Figure 3 This is a line graph showing the permission availability trend in the offline working environment of this invention;

[0029] Figure 4 This is a radar chart showing the comprehensive performance evaluation of the access control system of the present invention.

[0030] Figure 5 This is a pie chart showing the distribution of the abnormal detection effect of the permission usage of this invention. Detailed Implementation

[0031] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0032] At least one embodiment of the present invention discloses an office access transfer management system for mobile office use, such as... Figure 1 As shown, it includes the following steps:

[0033] The permission abstraction layer module is used to convert the native permission representation of various terminal platforms into a unified and standardized intermediate representation;

[0034] Specifically, the following steps are included:

[0035] Step 1.1, Construction of the permission abstraction layer;

[0036] According to embodiments of this application, a device-independent Permission Abstraction Layer (PAL) is constructed as an intermediate layer between the permission management system of each terminal platform and the unified permission representation.

[0037] PAL consists of three core components: a permission resolver, a permission converter, and a permission verifier.

[0038] The permission parser is responsible for recognizing and parsing the native permission formats of each platform;

[0039] The permission converter transforms native permissions into a unified representation.

[0040] The permission validator ensures that the converted permissions meet the requirements of consistency and integrity.

[0041] PAL can also include a caching module to store the conversion results of frequently used permissions, improving conversion efficiency. In some implementations, PAL can adopt a plug-in architecture, allowing the dynamic addition of permission parsing and conversion plug-ins for new platforms to support the access of new terminal devices.

[0042] Step 1.2, Define a unified permission description language;

[0043] This application provides a Unified Permission Description Language (UPDL) for standardizing the representation of permissions across platforms. UPDL adopts a structured format, representing permissions as a structure containing four main elements: action, resource, constraint, and context.

[0044] Among them, the action represents the operation that the permission allows to be performed (such as reading, writing, executing, etc.);

[0045] Resources represent the objects being manipulated (such as files, databases, APIs, etc.);

[0046] Constraints represent restrictions on permissions (such as time limits, number of uses, etc.);

[0047] The context indicates the usage scenario in which the permission is valid (such as network environment, location, etc.).

[0048] In some implementations, UPDL can be represented in JSON or XML format for easier transmission and parsing between systems. For example, a UPDL representation of document editing permissions could be:

[0049] {

[0050] "action": ["read", "write", "share"],

[0051] "resource": {"type": "document", "id": "doc12345"},

[0052] "constraint": {"expiry": "2023-12-31", "use_count": 10},

[0053] "context": {"network": "secure", "location": "office"}

[0054] };

[0055] UPDL can also support nested and inherited permission representations, which can be used to handle complex permission structures and hierarchical relationships.

[0056] Step 1.3, implementation of the permission mapping engine;

[0057] According to an embodiment of this application, a permission mapping engine is implemented for dynamically calculating permission mapping relationships between different platforms.

[0058] The mapping process takes the permissions of the source platform and the identifier of the target platform as input, and outputs the equivalent permissions on the target platform.

[0059] The mapping engine, based on a predefined mapping rule library and machine learning model, can handle complex cross-platform permission conversions, ensuring that permission semantics are not lost during the conversion process.

[0060] Map(P src Platform dst ) = P dst ;

[0061] Among them, P src Indicates permissions on the source platform; Platform dst Indicates the identifier of the target platform; P dst This represents the equivalent permissions mapped to the target platform; Map represents the permission mapping function.

[0062] For example, when mapping "full file control permissions" on a PC platform to a mobile platform, the mapping engine will convert it into a combination of "file read permissions", "file modify permissions", and "file share permissions" because mobile platforms may have different permission granularities.

[0063] During the mapping process, if the target platform does not support certain permission operations (such as mobile platforms not supporting the modification of advanced file attributes), the mapping engine will adopt a degradation strategy, retaining the supported operations and recording the unsupported operations so that they can be restored when conditions permit.

[0064] The mapping engine can also use historical mapping data for self-learning and optimization, continuously improving the accuracy and efficiency of mapping.

[0065] Step 1.4, implementation of the session state persistence mechanism;

[0066] This application provides a session state preservation mechanism for saving and restoring a user's operational context during permission transfer.

[0067] Session state information includes four main categories:

[0068] The list of currently open or active resources, the cursor or operation position in each resource, the interface view status, and temporary data cache.

[0069] By serializing this information and transmitting it between devices, users can continue their previous workflows on new devices without having to rebuild their work environment.

[0070] In some implementations, to handle differences in screen size and interaction methods across devices, the session state maintenance mechanism may include a layout adaptation algorithm that automatically adjusts the size, position, and arrangement of interface elements based on the characteristics of the target device. For example, when migrating from a large-screen PC to a small-screen mobile phone, the system will reorganize the interface layout, prioritizing the display of content relevant to the current operation.

[0071] The system can also predict the resources and operations that users may need on new devices based on their historical usage habits, and preload relevant content to further improve the smoothness of cross-device work.

[0072] When network bandwidth is limited, the system can adopt an incremental synchronization strategy to prioritize the transmission of the most important session state information, ensuring the rapid recovery of core functions.

[0073] The permission authorization service module is deployed on terminal devices to support permission verification, granting, and revocation operations in offline mode;

[0074] Specifically, the following steps are included:

[0075] Step 2.1, Deploy the lightweight permission authorization service;

[0076] This application provides a method for deploying a Lightweight Authorization Service (LAS) on a terminal device, enabling it to perform offline permission verification and authorization. The LAS receives periodic updates to permission policies and rule sets from a central permission server and can independently perform operations such as permission verification, permission granting, and permission revocation while the device is offline.

[0077] LAS mainly consists of three functional modules: verification module, authorization module, and synchronization module.

[0078] The verification module is responsible for verifying the legitimacy of permission requests;

[0079] The authorization module is responsible for handling the granting and revocation of permissions;

[0080] The synchronization module is responsible for synchronizing the permission status with the central server after the network connection is restored.

[0081] LAS is designed with the resource limitations of mobile devices in mind, employing lightweight algorithms and data structures to ensure efficient operation even on resource-constrained mobile terminals. Furthermore, LAS utilizes secure boot and runtime integrity verification mechanisms to prevent malicious tampering of access services.

[0082] Step 2.2, apply conflict-free copy data types;

[0083] According to embodiments of this application, an improved Conflict-free Replicated Data Type (CRDT) algorithm is used to manage distributed permission states, ensuring that changes are automatically merged and conflicts are resolved when permission operations are performed across multiple devices. The permission state consists of a series of permission items and their corresponding timestamps or version numbers.

[0084] The core idea of ​​CRDT is to use carefully designed data structures and update operations to ensure that even with concurrent modifications in a distributed environment, all nodes eventually converge to the same state without the need for central coordination.

[0085] The CRDT in this embodiment is implemented using a state-based CRDT, which has been specifically optimized for permission management scenarios.

[0086] In the specific implementation, a complete state structure is defined for each permission item, which includes attributes such as authorization time, authorizer, validity period, and operation restrictions.

[0087] The merge operation employs an attribute-based semantic merge method, such as taking the minimum value of the two copies for permission validity period, the most stringent restriction of the two copies for operation restrictions, and the highest priority of the two copies for priority. This semantic merge ensures that the final merge result satisfies the security priority principle regardless of how the permission status changes on each device.

[0088] In real-world applications, when user A grants document editing permissions to user B while offline, and an administrator simultaneously revokes all of user B's permissions while online, the CRDT algorithm automatically resolves the conflict once user A's device regains network connectivity, based on predefined merging rules (such as administrator operations having higher priority than ordinary users). Ultimately, all nodes in the system reach a consensus: user B's permissions are revoked. This automatic conflict resolution capability enables the system to maintain consistent permission states in complex distributed environments without manual intervention.

[0089] Step 2.3, maintenance of permission operation logs;

[0090] This application provides a permission operation log system for recording all permission-related operations, including permission request, grant, use, denial, and revocation events. Each operation log contains multiple information fields, including but not limited to: operation type, operation time, operation subject, operation object, operation result, and context information. The system stores logs in a local secure area when offline and uploads them to a central server for merging and analysis after network recovery.

[0091] To prevent logs from being tampered with, this implementation uses a secure hash chain structure to store logs. Each new log record contains the hash value of the previous record, forming an immutable chain structure.

[0092] In addition, the system encrypts and stores the logs, and only authorized components can decrypt and read the log content.

[0093] Step 2.4, implementation of safety boundary control;

[0094] According to an embodiment of this application, a security boundary control algorithm is constructed, which dynamically adjusts the scope of permissions based on the duration of offline status and the permission risk level.

[0095] Specifically, the security boundary control algorithm takes the offline duration and permission risk level as input and outputs adjusted permission parameters, including the scope of permission, validity period, and usage limit.

[0096] As offline time increases, the system will gradually tighten the scope of permissions and reduce the permissions for high-risk operations to ensure security control in the offline environment.

[0097] For example, low-risk document viewing permissions may remain valid for a longer period even when the system is offline for an extended period; while high-risk data deletion permissions may be automatically downgraded to read-only or completely disabled after a period of offline operation. Through this dynamic adjustment mechanism, the system achieves a good balance between ensuring business continuity and data security.

[0098] The scene perception module is used to construct a multi-dimensional scene feature space and identify key safety-related features in the current scene through a multi-head attention network.

[0099] Specifically, the following steps are included:

[0100] Step 3.1, Construction of multi-dimensional scene feature space;

[0101] This application provides a method for constructing a multi-dimensional scene feature space to capture various features of the user's environment. This feature space contains multiple dimensions, primarily including: location type (e.g., inside a company, in a public place), network security level (e.g., private enterprise network, public Wi-Fi), device status (e.g., battery level, storage space), surrounding environmental context (e.g., presence of other devices, personnel density), and user behavior patterns (e.g., operation frequency, usage habits).

[0102] The system collects multi-source data, including sensor data, network information, and user interaction behavior, to comprehensively analyze the user's current work scenario.

[0103] In some implementations, the feature space can be customized and expanded according to the specific needs of the enterprise. For example, financial institutions can add a "data sensitivity" dimension, medical institutions can add a "patient privacy level" dimension, and manufacturing enterprises can add a "production area security level" dimension, etc.

[0104] The system can also reduce the dimensionality of multidimensional feature vectors by using techniques such as principal component analysis (PCA) or t-distributed random neighborhood embedding (t-SNE) to extract the most representative combination of scene features, simplifying the subsequent calculation process.

[0105] Step 3.2, Application of multi-head attention networks;

[0106] According to embodiments of this application, the system applies a multi-head attention network to automatically identify key safety-related features in the current scene. The core computational process of the multi-head attention network can be represented as follows:

[0107] MultiHeadAttention(S,W q W k W v = Concat(head1, ..., head) h W O ;

[0108] Where MultiHeadAttention represents the multi-head attention mechanism; S represents the input scene feature vector; W q W represents the weight matrix of the query; k W represents the weight matrix of the keys. v Weight matrices representing values; head1, head h represents the output of the 1st and hth attention heads respectively; h represents the number of attention heads; Concat represents the operation of concatenating multiple vectors into a longer vector; W O This represents the final output weight matrix.

[0109] This network receives scene features S as input and processes them in parallel through multiple attention heads. Each attention head independently focuses on different aspects of the input features, working together to extract key security features from the scene. Through this network, the system can calculate a scene security score, which can be used for subsequent adjustment of permission and security boundaries.

[0110] In this embodiment, the multi-head attention network is implemented using a multi-layer structure, including a feature embedding layer, a multi-head self-attention layer, and a fully connected output layer.

[0111] The feature embedding layer converts different types of scene features (such as location, network, device status, etc.) into vector representations of a unified dimension;

[0112] The multi-head self-attention layer contains eight attention heads, each of which uses a different set of parameters to focus on different aspects of the scene features.

[0113] The fully connected output layer maps the results of multi-head attention to a scene safety score.

[0114] In practical applications, when users move from a company's internal network to a public Wi-Fi environment, network-related features are given higher weight by the multi-head attention network. The system automatically identifies network security as a key factor influencing access control policies in the current scenario. Similarly, when multiple unknown devices are detected nearby, device environmental features are highlighted, and the system accordingly increases the security level. This dynamic attention mechanism enables the system to intelligently identify the most critical security risk factors in different scenarios, achieving more precise access control.

[0115] On mobile devices with limited computing resources, lightweight attention model variants, such as MobileAttention or linear attention models, can be used to reduce computational complexity while maintaining the model's expressive power.

[0116] In some implementations, knowledge distillation techniques can be introduced to transfer the complete attention model knowledge to a lightweight model, further optimizing performance.

[0117] Step 3.3: Dynamically adjust the permission security boundary parameters;

[0118] This application provides a method for dynamically adjusting permission security boundary parameters. According to this method, the system dynamically adjusts the permission security boundary parameters based on a scenario security score. These parameters mainly include four aspects: the scope of the permission, its effective duration, operational restrictions, and audit level.

[0119] When the scenario security score is high, the system will relax the scope of permissions, extend the validity period, and reduce operational restrictions;

[0120] When the scenario security score is low, the system will tighten the scope of permissions, shorten the validity period, and increase operational restrictions.

[0121] This dynamic adjustment enables a continuous access control strategy that ranges from strictly restricted to highly free.

[0122] For example, when a user is working in a secure company intranet environment, file editing permissions may be set to full access mode, valid for 8 hours; while when a user is using insecure Wi-Fi in a public place, the same permissions may be restricted to read-only mode, requiring re-authentication every 30 minutes.

[0123] In some implementations, the system can employ a fuzzy logic controller to achieve smoother security boundary adjustments, avoiding frequent switching of permission policies due to slight changes in the scenario.

[0124] The system can also combine historical data analysis to preset permission security boundary templates for different user roles and business scenarios, improving the efficiency and consistency of the adjustment process.

[0125] Step 3.4, Permission reassessment triggered by scene transition

[0126] According to embodiments of this application, a scene transition detection and permission reassessment mechanism is provided. This mechanism can immediately trigger a reassessment of permission security boundaries when the user environment undergoes significant changes (such as location changes, network environment switching, changes in surrounding devices, etc.).

[0127] Specifically, the system determines whether environmental changes exceed a predetermined threshold by calculating the distance between the scene features at the current moment and the scene features at the previous moment.

[0128] When changes exceed a threshold, the system triggers a permission reassessment process, adjusting permission boundary parameters based on the degree and direction of the change in the scenario.

[0129] For high-risk scenario changes, the system may require users to re-authenticate or temporarily freeze some high-risk permissions until security is confirmed.

[0130] Feature distance calculation can be implemented in various ways, such as Euclidean distance, Manhattan distance, or Mahalanobis distance.

[0131] In some implementations, the system can use different distance calculation methods for different types of features, such as using Hamming distance for discrete features and Euclidean distance for continuous features.

[0132] Furthermore, to avoid the system burden caused by frequent scene transition detection and evaluation, an adaptive sampling strategy can be adopted to dynamically adjust the detection frequency based on the user's activity frequency and the rate of environmental change. For example, when the user is moving, the system will increase the scene detection frequency; when the user is stationary for a long time, the system will decrease the detection frequency to conserve resources.

[0133] The permission adjustment module dynamically adjusts the security boundary parameters of permissions based on the scenario security score, realizing a continuous permission control strategy from strictly restricted to highly flexible.

[0134] Specifically, the following steps are included:

[0135] Step 4.1, Constructing a gradual release mechanism for permissions;

[0136] This application provides a progressive release mechanism for permissions, which gradually expands the scope of permission operations based on the passage of time, user behavior, and trust assessment.

[0137] This mechanism takes initial permissions, a time factor, and behavioral trust level as input, and outputs adjusted permission parameters. The system initially grants the minimum necessary permissions, and gradually releases more permissions as the user's secure usage history increases and time progresses.

[0138] The release process follows the principle of security first, releasing low-risk permissions first and then high-risk permissions, ensuring the security and controllability of the entire process.

[0139] It's worth noting that this mechanism effectively addresses the limitations of the "one-size-fits-all" permission granting method in traditional permission management systems, avoiding either security risks due to over-authorization or inefficiency due to insufficient permissions. Through the dynamic and gradual release of permissions, the system ensures both data security and a good user experience.

[0140] Step 4.2, User Behavior Trust Assessment;

[0141] According to an embodiment of this application, the system implements a user behavior trust evaluation algorithm, which calculates the behavior trust level based on the user's historical behavior patterns and current behavior characteristics.

[0142] This assessment considers three main factors: a trust score based on the user's historical behavior, a trust score based on current behavioral characteristics, and a trust score based on the current context. These three factors are combined using a weighted average to arrive at the final trust score. The trust assessment result directly affects the speed and scope of permission granting.

[0143] For example, users with consistently good performance and stable operating patterns will receive a higher historical behavior trust score; while users with frequently changing behavior patterns or a history of abnormal behavior will have their trust score lowered. Furthermore, operations in sensitive environments (such as public places) will lower the contextual trust score, thus limiting the scope and speed of permission granting.

[0144] Step 4.3, Environmental Change Detection and Response;

[0145] This application provides an environmental change detection and response mechanism to monitor key environmental factors in real time. The environmental factors monitored by the system mainly include: location, network status, surrounding equipment, time period, and activity type.

[0146] When the system detects a significant change in environmental factors (such as the location changing from inside the company to a public place, the network switching from a private corporate network to public Wi-Fi, or the detection of an unknown device approaching), it immediately triggers a permission reassessment process to adjust permission parameters according to the changed environmental factors.

[0147] The detection of environmental changes employs a difference comparison method, which compares the current environmental factor with the previously recorded state. When the current value of an environmental factor differs from the previously recorded value, the system marks it as a changed factor and adjusts the corresponding access control policy based on the degree of security impact of these changed factors.

[0148] Step 4.4, Multi-factor authentication is dynamically triggered;

[0149] According to embodiments of this application, the system implements a multi-factor authentication dynamic triggering mechanism, which requires additional authentication at critical moments based on environmental risks and operational sensitivity.

[0150] Specifically, the system calculates the risk score of the current operation in the current environment. When the risk score exceeds a preset threshold, it automatically triggers a multi-factor authentication request, such as biometrics, SMS verification code, or security questions, to ensure the security of the operation.

[0151] For example, when a user attempts to delete important documents outside of work hours, on a device they've never used, or via a public network, the system detects this as a high-risk operation and automatically triggers dual authentication via fingerprint verification and SMS verification code to ensure the authenticity of the operator's identity. For low-risk operations in a normal work environment, the system avoids frequently interrupting the user's workflow, providing a smoother user experience.

[0152] The behavior monitoring module is used to record permission usage behavior in offline mode and compare it with the expected behavior pattern after the network is restored to detect potential abnormal operations.

[0153] Specifically, the following steps are included:

[0154] Step 5.1: Record offline permission usage behavior;

[0155] This application provides an offline permission usage behavior recording mechanism that stores detailed permission usage logs locally on the device. Each activity log contains multiple information fields, including but not limited to: operation time, operation type, operation object, operation result, and context information. The system employs a secure storage mechanism to protect these logs from tampering or deletion.

[0156] In some implementations, logging can employ a tiered strategy, using different recording granularities for operations of varying sensitivity levels. For example, for highly sensitive operations (such as deleting important files or accessing confidential data), the system records complete operation details; while for routine operations (such as viewing public documents), only basic information is recorded to save storage space.

[0157] The system also implements a log compression mechanism to aggregate and represent similar operations that occur consecutively over a long period, further reducing storage burden. For example, "viewing the same file 10 times consecutively" can be compressed into a single record with a count. Furthermore, the system can employ differential privacy technology to process log data, ensuring the effectiveness of analysis while protecting user privacy.

[0158] Step 5.2, Application of behavior pattern matching algorithm;

[0159] According to an embodiment of this application, the system applies a behavior pattern matching algorithm to compare the permission usage behavior during offline periods with the expected behavior pattern.

[0160] The algorithm compares the behavioral sequences collected during offline periods with the expected behavioral model built by the system based on the user's historical behavioral data, and calculates a similarity score between the two to evaluate the legitimacy of the offline behavior.

[0161] The behavior pattern matching algorithm in this embodiment is implemented by combining sequence alignment and hidden Markov models.

[0162] For the sequence of permission usage behaviors collected during offline periods, the system first applies the Dynamic Time Warping (DTW) algorithm to align it with the standard behavior pattern in time, and handles the time sequence differences caused by changes in behavior speed.

[0163] Hidden Markov Models are used to calculate the state transition probabilities of a sequence and assess its consistency with the expected behavioral pattern.

[0164] The algorithm considers various behavioral features, including: operation type distribution (such as the proportion of read, modify, and delete operations), operation time patterns (such as working time distribution and operation intervals), operation object preferences (such as common file types and access frequency), and operation sequence features (such as the sequential relationship of specific operations and common operation combinations). These features are organized into multi-dimensional vectors, and the final matching score is calculated through weighted similarity.

[0165] In practical applications, when sales personnel use the customer relationship management system offline while on business trips, the system records all their actions.

[0166] Once the network connection is restored, the behavior matching algorithm will analyze the user's operating patterns. If it finds that a user downloads a large amount of customer information in a short period of time late at night (which is significantly inconsistent with their usual behavior), the system will mark these behaviors as potential anomalies and trigger further security audits.

[0167] Conversely, if the operating pattern is highly consistent with the user's historical behavior, it is considered normal use and no additional verification is required.

[0168] This behavior-based verification method provides more accurate anomaly detection capabilities than traditional rule-based methods.

[0169] In environments with limited computing power, the system can employ lightweight matching algorithms, such as n-gram models or simplified Markov models, to reduce computational complexity.

[0170] In some implementations, the system can also incorporate seasonal time factors, such as weekdays / rest days, mornings / afternoons / evenings, etc., to construct a time-aware behavioral pattern model, further improving matching accuracy.

[0171] Step 5.3, Detection of Abnormal Permission Usage Behavior;

[0172] According to an embodiment of this application, the system implements an abnormal permission usage behavior detection algorithm to identify potential abnormal operations based on behavioral deviations and risk assessments.

[0173] The algorithm takes the activity information to be detected and the normal behavior model as input, and outputs the detection results including the anomaly judgment result, confidence level and risk level.

[0174] The system classifies detected abnormal behaviors into levels, from low-risk warnings to high-risk freezes, and generates detailed anomaly reports for security administrators to review.

[0175] In some implementations, anomaly detection can employ a multi-model fusion strategy, combining the detection results of multiple algorithms such as Isolation Forest, One-Class SVM, and Autoencoder to reduce the false positive rate. For example, the system can require at least two algorithms to determine that the behavior is abnormal before marking it as suspicious.

[0176] The system can also introduce a hybrid detection strategy based on rules and statistics, which leverages domain expert knowledge to define explicit violation patterns while using statistical methods to capture implicit abnormal behaviors. For example, it can explicitly define "more than 5 consecutive failed login attempts within 30 minutes" as an abnormal rule, while simultaneously using statistical methods to detect operations that "significantly deviate from historical behavior patterns."

[0177] Step 5.4, permission policy feedback optimization;

[0178] This application provides a permission policy feedback optimization mechanism that feeds back offline behavior analysis results to the permission policy module to continuously optimize permission control policies for specific users and scenarios.

[0179] This mechanism receives user information, context information, and behavioral analysis results as input, and outputs an optimized permission policy. Through this closed-loop feedback mechanism, the system continuously improves the accuracy and adaptability of permission management, reducing false positives and false negatives.

[0180] For example, if the system repeatedly and incorrectly marks certain actions of a specific user as abnormal (but which are confirmed as normal behavior by the security administrator), the system will automatically adjust the user's behavior model parameters to better suit the user's unique work pattern.

[0181] In some implementations, the system may employ an incremental learning strategy to continuously integrate new behavioral data into the existing model, allowing the model to be updated as user behavior naturally evolves.

[0182] The system can also enable cross-user knowledge transfer, extracting common patterns from user groups with similar behavioral patterns, thus accelerating the model building process for new users.

[0183] Application example of this implementation method:

[0184] Application scenarios:

[0185] The access control management method described in this implementation has been practically applied in the mobile office system of a multinational consulting firm. This firm has approximately 5,000 consultants who frequently need to work in different locations using different devices and collaborate with team members on highly sensitive business data at client sites. Before implementing this method, the company faced the following challenges:

[0186] When consultants are working offline at the client's site, they are unable to obtain the necessary permissions or transfer permissions to colleagues, resulting in low work efficiency.

[0187] When using the company's system in public places, the fixed permission policies cannot be adjusted according to environmental security risks, which poses a risk of data leakage.

[0188] Consultants frequently switch between PCs, tablets, and mobile phones to work, and each switch requires setting up a new work environment, wasting a lot of time.

[0189] The company is unable to effectively audit permission usage in offline environments, making it difficult to meet industry compliance requirements.

[0190] According to an embodiment of this application, the company deployed an office access control system based on this method, covering four major platforms: Windows, MacOS, iOS, and Android, supporting access control for core business systems used internally by the company, such as document management, customer relationship management, financial statements, and knowledge base.

[0191] Implementation process example:

[0192] Unified permission representation and mapping example:

[0193] The company implemented a Unified Permission Description Language (UPDL) to standardize the representation of permissions across various business systems. For example, the "Full Control Permission" in the document management system is translated into the following UPDL representation:

[0194] {

[0195] "action": ["read", "write", "delete", "share", "print", "export"],

[0196] "resource": {"type": "document", "classification": "confidential"},

[0197] "constraint": {"expiry": "24h", "location": ["office", "client_site"]},

[0198] "context": {"network_security": "medium_above", "device_type": "company_issued"}

[0199] };

[0200] The permission mapping engine dynamically calculates mapping relationships across different platforms. When a consultant switches from a Windows laptop to an iOS tablet, the system performs the following mapping:

[0201] Parse the native permissions of the source platform (Windows) and extract the core set of operations and resource scope of the permissions;

[0202] Analyze the permission characteristics and restrictions of the target platform (iOS), such as iOS's lack of support for direct editing of certain file formats;

[0203] Apply mapping rules to convert "document editing permissions" on Windows into an equivalent combination of permissions on iOS;

[0204] Generate permission configurations adapted to the iOS platform to ensure that permission semantics remain as consistent as possible despite platform differences.

[0205] During the mapping process, the system also saves the user's session state, including information such as open documents, cursor position, and view state, to ensure that the user can continue working from the breakpoint on the new device.

[0206] Offline permission management example:

[0207] In scenarios where consultants travel to client sites for work, the system deploys a Lightweight Authorization Service (LAS). When a senior consultant needs to collaborate with team members offline to process client financial data, the system performs the following operations:

[0208] On the advisor device, the LAS verification module checks its offline permission authorization request to verify the advisor's identity and permission level;

[0209] The authorization module grants temporary document sharing and editing permissions based on the consultant's historical trust level (no abnormal operation records in the past 90 days) and the current environment (located in the certified client's office);

[0210] The permission operation log system records all permission usage information, including authorization time, authorization scope, and usage details.

[0211] The security boundary control mechanism dynamically adjusts the permission scope based on the duration of offline access. For example, the editing permission for sensitive financial data is set to have an 8-hour validity period, and after 8 hours it is automatically downgraded to read-only permission.

[0212] During the offline period, the consultant successfully temporarily transferred some document permissions to team members, enabling the team to collaborate on urgent tasks. Once the network connection was restored, the LAS synchronization module uploaded the offline operation logs to the central server. The conflict-free copy data type algorithm automatically merged the permission changes made during the offline period, resolving potential permission state conflicts.

[0213] Example of scene awareness and permission adjustment:

[0214] When a consultant moves from the company office to a public coffee shop to continue working, the system captures the environmental change through multi-dimensional scene feature analysis:

[0215] The location type has been changed from "Company Office" to "Public Place";

[0216] The network changed from a "corporate secure network" to "public Wi-Fi";

[0217] Multiple unknown devices were detected in the vicinity.

[0218] The multi-head attention network automatically identifies "cybersecurity" and "surrounding environment" as key risk factors in the current scene, calculating a lower scene security score. The system then dynamically adjusts permission security boundaries accordingly.

[0219] Downgrade the permissions of highly sensitive documents from "editable and shareable" to "viewable only";

[0220] Shorten the validity period of permissions to 30 minutes and require periodic re-verification of identity;

[0221] Enable screen privacy protection to prevent onlookers from spying on you;

[0222] Increase the audit level and record more detailed operation logs.

[0223] When consultants attempt to share sensitive client reports in this environment, the system automatically triggers multi-factor authentication, requiring fingerprint verification and one-time password verification to ensure operational security.

[0224] Examples of behavioral analysis and anomaly detection:

[0225] In one real-world case, the system detected unusual behavior from a consultant who was using the customer relationship management system offline while on a business trip:

[0226] The offline access permission usage behavior recording system captured a large amount of customer contact information being downloaded late at night (2:00 AM to 4:00 AM local time);

[0227] The behavioral pattern matching algorithm calculated a low similarity score (0.32, below the normal threshold of 0.60) because the consultant typically only accesses the system during working hours (9 a.m. to 8 p.m.) and rarely downloads large amounts of contact information.

[0228] The anomaly detection algorithm marks this behavior as a "high-risk anomaly" with a confidence level of 92%.

[0229] Once the network connection is restored, the system immediately sends a report to the security administrator and temporarily freezes the consultant's access to client data.

[0230] Further investigation revealed that this was an unauthorized access incident (the consultant's device was used by someone else without permission), and the system's early warning successfully prevented a large-scale leak of customer data. The handling results of this incident were fed back to the permission policy optimization module, further improving the anomaly detection model, such as adjusting the weight of time patterns and optimizing the behavior similarity calculation method.

[0231] Technical effectiveness verification:

[0232] After implementing the method for 12 months, the consulting firm conducted a comprehensive technical effectiveness evaluation, focusing on verifying two core technical effects: improved efficiency in cross-device collaboration and enhanced security capabilities.

[0233] Improved efficiency across devices:

[0234] The company conducted a three-month performance tracking study on 300 consultants, comparing the time and steps required to complete the same tasks before and after implementation. The results showed:

[0235] Equipment changeover time was reduced: from an average of 6.8 minutes to 2.2 minutes, a decrease of 67.6%;

[0236] Permission acquisition time decreased: from an average of 15.3 minutes to 3.6 minutes, a reduction of 76.5%;

[0237] The number of work environment reconstruction operations decreased from an average of 12.7 times to 3.5 times, a reduction of 72.4%.

[0238] Work interruptions due to permission issues decreased from an average of 4.2 times per week to 0.8 times, a reduction of 81.0%.

[0239] The percentage of work tasks that can be completed offline increased from 31.5% to 78.9%, an increase of 47.4 percentage points.

[0240] A survey revealed that 93.6% of consultants reported a significant improvement in their work experience, particularly in productivity at client sites and while traveling. Data analysis showed that consultants saved an average of 4.7 hours of unproductive time per week (mainly time spent waiting for authorization approvals and rebuilding the work environment), equivalent to an 11.8% increase in effective working time.

[0241] System log analysis further demonstrates that the permission mapping accuracy reaches 95.7%, and the session state recovery success rate reaches 94.9%, providing a reliable guarantee for seamless cross-device collaboration. Especially in permission migration scenarios between heterogeneous platforms (such as between Windows and iOS), the average completion time is only 2.1 seconds, which is 3 times faster than the industry average.

[0242] Enhanced security protection capabilities:

[0243] The company conducted a comprehensive assessment of the system's security capabilities, including security audits, penetration testing, and simulated attack drills.

[0244] The detection rate of abnormal permission usage behavior increased from 42.3% to 91.8%, an increase of 49.5 percentage points.

[0245] Average risk detection lead time: Improved from post-event reporting to 4.3 hours in advance, achieving a shift from reactive response to proactive prevention;

[0246] Success rate of blocking high-risk operations increased from 62.7% to 96.4%, an increase of 33.7 percentage points;

[0247] Accuracy of scene-aware security policy adjustment: 93.2%, which is 21.5 percentage points higher than industry best practices;

[0248] Total number of security incidents: decreased from an average of 37 per year to 8, a reduction of 78.4%;

[0249] In simulated unauthorized access tests, the system successfully blocked 94.3% of malicious operation attempts, far exceeding the 56.8% before implementation. The system performed exceptionally well, particularly in offline security protection, providing effective oversight of the entire lifecycle of access privileges.

[0250] The company's data security team reported a significant reduction in the risk of sensitive data breaches. Based on the risk assessment model, the potential data breach risk index dropped from 78 (high risk) to 32 (low to medium risk). Simultaneously, the system's dynamic security boundary adjustment mechanism achieved a good balance between employee productivity and data security, reducing the permission denial rate by 38.6%, while simultaneously improving the effectiveness of security controls.

[0251] like Figures 2 to 5The figures show the accuracy comparison of cross-platform permission migration scenarios; permission availability trends in offline working environments; comprehensive performance evaluation of the permission management system; and distribution of permission usage anomaly detection effects.

[0252] Furthermore, the system's permission behavior consistency verification function provides strong support for the company to meet industry regulatory requirements. In a recent compliance audit, the company's permission management practices were rated as "industry-leading," reaching the highest level of compliance maturity. The embodiments of the present invention have been described above, but these embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments based on the guidance of these embodiments, all of which are within the protection scope of these embodiments.

Claims

1. An office access control management system for mobile office use, characterized in that, Includes the following modules: The permission abstraction layer module is used to convert the native permission representation of various terminal platforms into a unified and standardized intermediate representation; The permission authorization service module is deployed on terminal devices to support permission verification, granting, and revocation operations in offline mode; The scene perception module is used to construct a multi-dimensional scene feature space and identify key safety-related features in the current scene through a multi-head attention network. The permission adjustment module dynamically adjusts the security boundary parameters of permissions based on the scenario security score, realizing a continuous permission control strategy from strictly restricted to highly flexible. The behavior monitoring module records permission usage behavior in offline mode and compares it with expected behavior patterns after the network is restored to detect potential abnormal operations.

2. The office access control system for mobile office as described in claim 1, characterized in that, The permission abstraction layer module includes three components: a permission parser, a permission converter, and a permission verifier. The permission parser is used to identify and parse the native permission formats of various platforms, the permission converter is used to convert the native permissions into a unified representation, and the permission verifier is used to ensure that the converted permissions meet the requirements of consistency and integrity.

3. The office access control system for mobile office as described in claim 1, characterized in that, The unified and standardized intermediate state representation includes four basic elements: action, resource, constraint, and context. Action represents the operation that the permission allows to be performed, resource represents the object of the operation, constraint represents the restriction conditions of the permission, and context represents the effective use scenario of the permission.

4. The office access control system for mobile office as described in claim 1, characterized in that, The permission authorization service module uses a conflict-free copy data type to manage distributed permission status, ensuring that permission operations can be automatically merged and conflicts resolved when performed across multiple devices. The conflict-free copy data type defines a complete status structure for permission items, including authorization time, authorizer, validity period, and operation restrictions.

5. The office access control system for mobile office as described in claim 1, characterized in that, The multi-dimensional scene feature space includes multiple dimensions such as location type, network security level, device status, surrounding environmental context, and user behavior patterns. It comprehensively analyzes the user's current work scene through multi-source data such as sensor data, network information, and user interaction behavior.

6. The office access control system for mobile office as described in claim 1, characterized in that, Multi-head attention networks consist of a feature embedding layer, a multi-head self-attention layer, and a fully connected output layer. The feature embedding layer converts different types of scene features into vector representations of a uniform dimension. The multi-head self-attention layer contains multiple attention heads, each focusing on different aspects of the input features. The fully connected output layer maps the results of the multi-head attention to a scene safety score.

7. The office access control system for mobile office as described in claim 1, characterized in that, Security boundary parameters include the scope of permissions, validity period, operational restrictions, and audit level. When the scenario security score is high, the scope of permissions is broadened, the validity period is extended, and operational restrictions are reduced. When the scenario security score is low, the scope of permissions is tightened, the validity period is shortened, and operational restrictions are increased.

8. The office access control system for mobile office as described in claim 1, characterized in that, It also includes a gradual release mechanism for permissions, which gradually expands the scope of permission operations based on the passage of time, user behavior, and trust assessment. The system initially grants the minimum necessary permissions, and gradually releases more permission operations as the user's secure use of permissions increases over time.

9. The office access control system for mobile office as described in claim 1, characterized in that, The comparison uses a behavior pattern matching algorithm, which compares the behavior sequences collected during offline periods with the expected behavior model built by the system based on the user's historical behavior data, calculates a similarity score, and evaluates the legality of the offline behavior. The expected behavior model includes three features: operation frequency, operation sequence, and time distribution.

10. A computer-readable storage medium, characterized in that, It is used to store computer-readable instructions, which, when read by a computer, enable the operation of an office access transfer management system for mobile office as described in any one of claims 1-9.

Images