Authority management method and device for resource access and storage medium

Abstract

The invention discloses an authority management method and device for resource access and a storage medium, and the method comprises the steps: calling a corresponding to-be-verified resource in a database according to an access request under the condition that a user initiates the access request; judging public attributes of the to-be-verified resource, wherein the public attributes comprise a private type and a public type; under the condition that the public attribute of the to-be-verified resource is a private type, determining a role type of the user according to the access request; querying a permission resource list matched with the role type in a database, wherein the permission resource list comprises resources with the role type having access permission; and traversing the permission resource list, allowing the user to perform access operation on the to-be-verified resources and perform role permission filtering on the non-public resources under the condition that the to-be-verified resources exist in the permission resource list, and realizing access control of the resources by allocating roles to the user and allocating permissions to the roles. Only authorized users can access sensitive data, and data security and privacy are effectively protected.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of access permission management, in particular to a permission management method and device for resource access and a storage medium. BACKGROUND

[0002] With the rapid development of artificial intelligence and machine learning technologies, RAG in AIGC platforms is widely used in data retrieval and content generation fields. However, how to realize flexible and fine-grained permission control in RAG to protect data security and privacy has become an important challenge faced by current technologies. Existing permission control technologies can usually only control the permissions of the entire data set or plug-in, and it is difficult to meet the fine-grained permission management needs of data sets, documents, plug-ins and their APIs in complex business scenarios. Moreover, there is a lack of effective simplified permission filtering mechanism, resulting in low system efficiency. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a permission management method, device and storage medium for resource access, to solve the problem that the prior art is difficult to adapt to the diversified permission management needs of different resources in complex business scenarios.

[0004] To achieve the above-mentioned purpose, the first aspect of the present application provides a permission management method for resource access, the method comprising: In the case that a user initiates an access request, calling a corresponding to-be-verified resource in the database according to the access request; Judging the public attribute of the to-be-verified resource, the public attribute including a private type and a public type; In the case that the public attribute of the to-be-verified resource is the private type, determining the role type of the user according to the access request; Querying a permission resource list matching the role type in the database, the permission resource list including resources that the role type has access permissions to; Traversing the permission resource list, in the case that the to-be-verified resource exists in the permission resource list, allowing the user to perform an access operation on the to-be-verified resource.

[0005] In the embodiments of the present application, calling a corresponding to-be-verified resource in the database according to the access request includes: performing intent recognition according to the access request to determine whether the access request needs to call a tool; in the case that the access request needs to call a tool, judging the tool type needed to be called by the access request; calling the to-be-verified resource corresponding to the access request in the database corresponding to the tool type.

[0006] In the embodiments of the present application, the tool type includes an API type and / or a data set type.

[0007] In the embodiments of the present application, the method further comprises: inputting the access request into the large language model to return first answer data output by the large language model without calling the tool.

[0008] In the embodiments of the present application, the method further comprises: training the large language model by the to-be-verified resource to obtain a trained large language model; and outputting the access request to the trained large language model to return second answer data output by the trained large language model.

[0009] In the embodiments of the present application, the method further comprises: determining a label type matching the role type; searching for a label resource list matching the label type in the database; and traversing the label resource list and the permission resource list to allow the user to perform the access operation on the to-be-verified resource in a case where the to-be-verified resource exists in the permission resource list or the label resource list.

[0010] In the embodiments of the present application, the resource in the permission resource list is at least one of a data set, a document, a plug-in, and an API of the plug-in.

[0011] In the embodiments of the present application, the method further comprises: allowing the user to perform the access operation on the to-be-verified resource in a case where the public attribute of the to-be-verified resource is of the public type.

[0012] The second aspect of the present application provides a permission management apparatus for resource access, comprising: a memory configured to store instructions; a processor configured to call the instructions from the memory and capable of realizing the permission management method for resource access according to the above description when executing the instructions.

[0013] The third aspect of the present application provides a machine-readable storage medium having instructions stored thereon, the instructions being used to cause a machine to execute the permission management method for resource access according to the above description.

[0014] Through the above technical solution, in a case where the user initiates an access request, the corresponding to-be-verified resource is called in the database according to the access request; the public attribute of the to-be-verified resource is judged, the public attribute including a private type and a public type; in a case where the public attribute of the to-be-verified resource is of the private type, the role type of the user is determined according to the access request; a permission resource list matching the role type is queried in the database, the permission resource list including resources having access permissions of the role type; the permission resource list is traversed, and the user is allowed to perform the access operation on the to-be-verified resource in a case where the to-be-verified resource exists in the permission resource list. The role permission filtering is performed on the non-public resource, the access control on the resource is realized by assigning the role to the user and assigning the permission to the role, and it is ensured that only authorized users can access sensitive data, thereby effectively protecting data security and privacy.

[0015] Other features and advantages of the embodiments of the present application will be described in the following detailed description of the embodiments of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings are included to provide a further understanding of the embodiments of the present application, and constitute a part of the specification, and are used to explain the embodiments of the present application together with the following detailed description, but do not limit the embodiments of the present application. In the drawings: Figure 1 A flowchart schematically showing a method for resource access according to an embodiment of the present application is shown; Figure 2 A flowchart schematically showing a large model question and answer process according to an embodiment of the present application is shown; Figure 3 A flowchart schematically showing a method for resource access according to an embodiment of the present application is shown; Figure 4 A structural block diagram of a device for resource access according to an embodiment of the present application is shown schematically; Figure 5 A structural diagram of a computer device according to an embodiment of the present application is shown schematically. DETAILED DESCRIPTION

[0017] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the specific embodiments described herein are only used to explain and illustrate the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0018] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative positional relationship, movement condition, etc. between components in a certain specific posture (as shown in the drawings), and if the specific posture changes, the directional indications also change accordingly.

[0019] In addition, if the description of "first", "second" and the like is involved in the embodiments of the present application, the description of "first", "second" and the like is only for the purpose of description, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features. Therefore, the features limited by "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of various embodiments can be combined with each other, but it must be based on the realization of ordinary skilled in the art, when the combination of technical solutions appears contradictory or cannot be realized, it should be considered that the combination of technical solutions does not exist, nor in the protection scope required by the present application.

[0020] Figure 1 The flowchart of the method for resource access permission management according to the embodiments of the present application is schematically shown. As shown in the figure, Figure 1 The embodiments of the present application provide a method for resource access permission management, which can include the following steps.

[0021] S102, in the case of user initiating an access request, calling the corresponding to-be-verified resource in the database according to the access request.

[0022] S104, judging the public attribute of the to-be-verified resource, the public attribute including private type and public type; S106, in the case of the public attribute of the to-be-verified resource being private type, determining the role type of the user according to the access request.

[0023] S108, querying the permission resource list matched with the role type in the database, the permission resource list including the resources with access permission of the role type.

[0024] S110, traversing the permission resource list, in the case of the to-be-verified resource existing in the permission resource list, allowing the user to perform access operation on the to-be-verified resource.

[0025] Specifically, the information carried by the user-initiated access request includes but is not limited to personal information of the user and a question raised by the user, etc. Specifically, the personal information of the user includes a role type of the user. In a specific embodiment, the role type includes but is not limited to an administrator, a common user, an auditor, etc. The system can define multiple different roles and assign accessible resources to each role. The resources include but are not limited to a data set, a document, a plug-in and an API. The API refers to an application program interface, which can allow interaction between different software systems. The data set refers to a collection of a group of related data, which is used for retrieval and generation tasks of the RAG system. The plug-in refers to a module that extends the function of the system and can provide additional API interfaces or data processing capabilities. The processor can call a corresponding to-be-verified resource in the database according to the access request of the user. It can be understood that the to-be-verified resource is determined by analyzing the access request of the user, but the to-be-verified resource has not been verified whether it is allowed to be accessed by the user. Then, the processor can first judge the public attribute of the to-be-verified resource. If the public attribute of the to-be-verified resource is of a private type, it is further necessary to query the resources allowed to be accessed by the role in the database according to the role type of the user, and generate a corresponding permission resource list. Next, the permission resource list can be traversed to check whether the to-be-verified resource exists in the permission resource list, and in the case of existence, the user is allowed to access the to-be-verified resource.

[0026] Through the above technical solution, in the case that the user initiates an access request, the corresponding to-be-verified resource is called in the database according to the access request; the public attribute of the to-be-verified resource is judged, the public attribute including a private type and a public type; in the case that the public attribute of the to-be-verified resource is of a private type, the role type of the user is determined according to the access request; a permission resource list matched with the role type is queried in the database, the permission resource list including resources to which the role type has access rights; the permission resource list is traversed, and in the case that the to-be-verified resource exists in the permission resource list, the user is allowed to access the to-be-verified resource. The role permission filtering is performed on the non-public resource, the access control of the resource is realized by assigning a role to the user and assigning a permission to the role, and it is ensured that only authorized users can access sensitive data, thereby effectively protecting data security and privacy.

[0027] In the embodiments of the present application, calling the corresponding to-be-verified resource in the database according to the access request includes: performing intent recognition according to the access request to determine whether the access request needs to call a tool; in the case that the access request needs to call a tool, judging a tool type required to be called by the access request; calling the to-be-verified resource corresponding to the access request in the database corresponding to the tool type.

[0028] Reference Figure 2, the user initiates an access request by asking questions, and the processor can perform intent recognition on the access request. Specifically, intent recognition can utilize natural language processing (NLP) techniques to analyze user input (such as text, voice) to parse its core purpose or action request, and map the user input to a predefined intent label through semantic analysis. For example, "book a ticket" "query balance", and possibly extract key entities such as time, place to assist decision-making. In embodiments of the present application, it can be determined by intent recognition whether the tool needs to be called to solve the access request. In the case where the access request needs to call the tool, the type of tool called by the access request is determined. In embodiments of the present application, the tool type includes API type and / or dataset type. If it is API type, the corresponding plug-in is called according to API interface. If it is dataset type, the dataset is called in the way of document recall. Further, the to-be-verified resource is called from the database corresponding to the tool type. It can be understood that the to-be-verified resource is usually external knowledge. Further, the processor can determine the public attribute of the to-be-verified resource. If the public attribute of the to-be-verified resource is of a private type, the resource allowed to be accessed by the role needs to be further queried in the database according to the role type of the user, and a corresponding permission resource list is generated. Next, the permission resource list can be traversed to find out whether the to-be-verified resource exists in the permission resource list, and in the case where it exists, the user is allowed to access the to-be-verified resource.

[0029] Further, with reference to Figure 2 In embodiments of the present application, the method further comprises: training the large language model by the to-be-verified resource to obtain a trained large language model; and outputting the access request to the trained large language model to return second answer data output by the trained large language model. Specifically, the to-be-verified resource as external knowledge can be used as a training set to train the large language model, so as to answer the user's question. In embodiments of the present application, the method further comprises: in the case where the access request does not need to call the tool, directly inputting the access request into the large language model to return first answer data output by the large language model.

[0030] In embodiments of the present application, the method further comprises: determining a label type matched with the role type; finding a label resource list matched with the label type in the database; and traversing the label resource list and the permission resource list to allow the user to perform an access operation on the to-be-verified resource in the case where the to-be-verified resource exists in the permission resource list or the label resource list.

[0031] With reference to Figure 3The ID of the resource to be verified can be used for permission filtering. Specifically, the type of the resource to be verified is determined according to the ID of the resource to be verified, which is either public or private. Further, the role type of the user is queried to query the resources under the role, which can be presented according to the permission resource list. In an embodiment of the present application, the resources can also be managed by tagging. Therefore, the processor can query the label type allowed to be accessed by the role type to find the label resource list matching the label type in the database. The resources included in the label resource list are matched with the role type and the label type corresponding to the role type. The label resource list includes but is not limited to datasets, datasets, documents, plug-ins and APIs. If the resource to be verified exists in the permission resource list or the label resource list, the user is allowed to access the resource to be verified. If it is not in the above list, the user is prohibited from accessing the resource to be verified.

[0032] Reference Figure 2 In an embodiment, if the resource to be verified is a public attribute, the resource of the public attribute can be set to allow any user to access it. The resource of the public attribute directly skips the permission filtering when accessed, simplifying the access process and improving system performance.

[0033] Through the above technical solution, the access of users to resources is controlled through role assignment and resource tagging management, which can realize fine-grained permission management of datasets and plug-in APIs, and meet the diversified needs of complex business scenarios. By introducing the custom label mechanism, users can flexibly define and manage permissions according to business needs, and the system is also easier to extend and adapt to new business scenarios. For resources of public attributes, direct skip of permission filtering reduces unnecessary permission verification steps and significantly improves system performance. Through multi-granularity permission control, only authorized users can access sensitive data, effectively protecting data security and privacy.

[0034] Figure 1 The flowchart of the permission management method for resource access in an embodiment. It should be understood that although Figure 1 The steps in the flowchart are displayed in sequence according to the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, Figure 1At least one of the steps in the method can include a plurality of sub-steps or a plurality of stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of the sub-steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least one part of other steps or sub-steps or stages of other steps.

[0035] Figure 4 An illustrative structural block diagram of an apparatus for resource access permission management according to an embodiment of the application is shown. As shown in Figure 4 The apparatus for resource access permission management according to an embodiment of the application can include: a memory configured to store instructions; a processor configured to call instructions from the memory and implement the above-mentioned method for resource access permission management when executing the instructions.

[0036] Specifically, in the embodiment of the application, the processor can be configured to: In the case that the user initiates an access request, the corresponding to-be-verified resource in the database is called according to the access request; the public attribute of the to-be-verified resource is judged, the public attribute including a private type and a public type; in the case that the public attribute of the to-be-verified resource is the private type, the role type of the user is determined according to the access request; the permission resource list matching the role type is queried in the database, the permission resource list including resources that the role type has access to; the permission resource list is traversed, and in the case that the to-be-verified resource exists in the permission resource list, the user is allowed to perform an access operation on the to-be-verified resource.

[0037] In the embodiment of the application, the processor can also be configured to: According to the access request, the corresponding to-be-verified resource in the database is called, including: performing intent recognition according to the access request to determine whether the access request needs to call a tool; in the case that the access request needs to call a tool, the tool type required by the access request is judged; the to-be-verified resource corresponding to the access request in the database corresponding to the tool type is called.

[0038] In the embodiment of the application, the tool type includes an API type and / or a dataset type.

[0039] In the embodiment of the application, the processor can also be configured to: In the case that the access request does not need to call a tool, the access request is input into a large language model to return first answer data output by the large language model.

[0040] In the embodiment of the application, the processor can also be configured to: The large language model is trained by the to-be-verified resource to obtain a trained large language model; and the access request is output to the trained large language model to return second answer data output by the trained large language model.

[0041] In the embodiment of the present application, the processor can be further configured to: determine a label type matching the role type; find a label resource list matching the label type in the database; and traverse the label resource list and the permission resource list to allow the user to perform the access operation on the to-be-verified resource in a case where the to-be-verified resource exists in the permission resource list or the label resource list.

[0042] In the embodiment of the present application, the resource in the permission resource list is at least one of a data set, a document, a plug-in, and an API of the plug-in.

[0043] In the embodiment of the present application, the processor can be further configured to: allow the user to perform the access operation on the to-be-verified resource in a case where the public attribute of the to-be-verified resource is of a public type.

[0044] The embodiment of the present application also provides a machine readable storage medium, which stores instructions for causing a machine to execute the above-mentioned permission management method for resource access.

[0045] In one embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in Figure 5 The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. The processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operating system B01 and the computer program B02 in the non-volatile storage medium A04 to run. The database of the computer device is used to store permission management data for resource access. The network interface A02 of the computer device is used to communicate with an external terminal through network connection. The computer program B02 is executed by the processor A01 to implement a permission management method for resource access.

[0046] Those skilled in the art can understand that, Figure 5The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0047] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage etc.) containing computer-usable program code.

[0048] The present application is described with reference to flowcharts and / or block diagrams of the methods, devices (systems), computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device implemented in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the function specified in one or more flows or blocks.

[0049] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction apparatus, which implements the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the function specified in one or more flows or blocks.

[0050] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the function specified in one or more flows or blocks.

[0051] In a typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces and memories.

[0052] Memory can include non-persistent memory, Random Access Memory (RAM), and / or non-volatile memory, such as Read Only Memory (ROM) or flash memory, in a computer readable medium. Memory is an example of computer readable media.

[0053] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0054] It should also be noted that the terms "comprising", "including", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0055] The above merely provides an example of the present application and is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A method for managing access permissions for resources, characterized in that, The method includes: When a user initiates an access request, the corresponding resource to be verified is retrieved from the database based on the access request; Determine the public attributes of the resource to be verified, wherein the public attributes include private type and public type; If the public attribute of the resource to be verified is of the private type, the user's role type is determined based on the access request; Query the database for a list of permission resources that match the role type, the list of permission resources including resources that the role type has access to; The system iterates through the list of authorized resources. If the resource to be verified exists in the list, the user is allowed to access the resource to be verified.

2. The access control method for resource access according to claim 1, characterized in that, The method further includes: Determine the tag type that matches the character type; Search the database for a list of tag resources that match the tag type; The tag resource list and the permission resource list are traversed, so that if the resource to be verified exists in the permission resource list or the tag resource list, the user is allowed to access the resource to be verified.

3. The access control method for resource access according to claim 1, characterized in that, The step of retrieving the corresponding resource to be verified from the database based on the access request includes: Intent identification is performed based on the access request to determine whether the access request requires the invocation of a tool; If the access request requires the invocation of a tool, determine the type of tool that the access request requires to be invoked; Call the resource to be verified in the database corresponding to the access request, which is the same as the tool type.

4. The access control method for resource access according to claim 3, characterized in that, The tool types include API types and / or dataset types.

5. The access control method for resource access according to claim 2, characterized in that, The method further includes: Without requiring the invocation of any tools, the access request is input into a large language model to return the first response data output by the large language model.

6. The access control method for resource access according to claim 1, characterized in that, The method further includes: The large language model is trained using the resources to be verified to obtain the trained large language model. The access request is output to the trained large language model to return the second response data output by the trained large language model.

7. The access control method for resource access according to claim 1, characterized in that, The resources in the permission resource list are at least one of the following: datasets, documents, plugins, and the API of the plugins.

8. The access control method for resource access according to claim 1, characterized in that, The method further includes: If the public attribute of the resource to be verified is public, the user is allowed to access the resource to be verified.

9. A permission management device for resource access, characterized in that, include: The memory is configured to store instructions; A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the access control method for resource access according to any one of claims 1 to 8.

10. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform the access control method for resource access as claimed in any one of claims 1 to 8.

Images