Cross-module permission intelligent configuration system and method based on role permission matrix

Abstract

The invention belongs to the technical field of project management, and discloses a cross-module permission intelligent configuration system and method based on a role permission matrix. The method comprises the steps that a three-dimensional permission matrix of roles, data entities and service states is constructed and assigned, then an attenuation function is configured for the data entities, and real-time permissions are calculated in combination with real-time service events; obtaining a data consanguinity map through a module directed graph, obtaining inheritance authority and updating linkage weight; detecting permission conflicts and performing arbitration to obtain a current matrix; a prediction matrix and a risk value are output through sandbox simulation, a current permission matrix is adjusted according to the prediction matrix and the risk value, and cross-module permission intelligent management is achieved; according to the method, structured definition of permission rules, dynamic automatic calculation of permission values, accurate linkage of cross-module permissions, immediate arbitration of conflicts and risk-based automatic adjustment are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of project management, more particularly, the present application relates to a cross-module permission intelligent configuration system and method based on a role permission matrix. BACKGROUND

[0002] In traditional cross-module permission management, permission configuration is mostly dependent on static matrix or manual maintenance, which is difficult to adapt to the dynamic changes of business status and has many limitations. On the one hand, the permission matrix is usually fixed, and when the business status of the data entity changes, the administrator needs to manually find the permission relationship between the corresponding role and the data entity and update the permission value, which is not only tedious and inefficient, but also prone to out of sync between permission and business status due to human error, causing response delay. On the other hand, the cross-module permission linkage lacks unified correlation rules, and the permission configuration of different business modules is independent of each other. When the business status of a module changes and needs to be linked to adjust the permissions of other modules, the administrator needs to manually sort out the influence relationship between modules and judge the correlation strength, which not only cannot guarantee the accuracy of linkage, but also causes the permission adjustment to lag behind the business needs due to reliance on manual intervention.

[0003] Chinese patent application with publication number CN120030565A discloses a database dynamic permission management system, which includes a subsystem management module that communicates with each permission management subsystem to obtain permission association information, menu and button information of each permission management subsystem; a menu management module that receives each menu and button information and generates a comprehensive permission management interface based on each menu and button information, and receives an administrator's permission management action on the comprehensive permission management interface; and a role management module that generates a user role based on the administrator's permission management action, and the generated user role involves permission configuration information of multiple permission management subsystems, and the subsystem management module sends the permission configuration information to the corresponding permission management subsystem.

[0004] Although the existing technology can meet most scenarios, research and practical application have found that the existing technology at least has the following defects:

[0005] The existing technology only focuses on dynamic adjustment of permissions within a single database and relies on real-time behavior monitoring to trigger permission changes, which cannot link to adjust the permissions in other business modules.

[0006] In view of this, the present application proposes a cross-module permission intelligent configuration system and method based on a role permission matrix to solve the above problems. SUMMARY

[0007] In order to overcome the above-mentioned defects of the prior art and achieve the above-mentioned purposes, the present application provides the following technical solutions: a cross-module permission intelligent configuration method based on a role permission matrix, comprising:

[0008] Obtain user roles, data entities and business states, build a three-dimensional permission matrix, and assign values according to preset user permissions to obtain a role permission matrix;

[0009] Configure a decay function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions according to the decay function;

[0010] Establish a directed graph between modules, obtain a data bloodline map, and analyze the inheritance permissions corresponding to each data entity according to the real-time permissions; update the real-time permissions in combination with the inheritance permissions to obtain linkage weights;

[0011] Obtain real-time permissions and linkage weights, determine whether a permission conflict occurs, and if so, perform conflict arbitration to obtain a current permission matrix;

[0012] Take the event to be adjusted, the current permission matrix and the data bloodline map as inputs of a sandbox simulation engine, obtain output data including a predicted permission change matrix and a risk assessment value, and adjust the current permission matrix according to the output data.

[0013] Further, the method for obtaining a three-dimensional permission matrix comprises:

[0014] According to the positions and responsibilities of platform users, the users are divided into different role categories, and inheritance relationships between roles are established, such as the leader inheriting all the permissions of the staff;

[0015] Define data entities in the project, and define key attributes for each data entity;

[0016] Define the corresponding business states for each data entity, and define the legal transfer path between states;

[0017] Cross the three dimensions of roles, data entities and business states, and each intersection point corresponds to a permission value to obtain a three-dimensional permission matrix;

[0018] The method for configuring a decay function comprises:

[0019] Obtain the current business state duration, and build a decay function according to a preset decay period;

[0020] The real-time business events include state change events, time trigger events and operation events;

[0021] The method for obtaining real-time permissions comprises:

[0022] Acquire real-time business events, extract real-time roles and real-time data entities, obtain the basic permissions of real-time roles for real-time data entities through the role permission matrix, calculate the attenuation coefficient based on the attenuation function according to the current business status and duration, and calculate the real-time permissions based on the basic permissions and attenuation coefficient.

[0023] Furthermore, methods for obtaining data lineage maps include:

[0024] Obtain module nodes and data entities as nodes in a directed graph;

[0025] Determine the direction of the directed edge based on the influence relationship;

[0026] Based on the degree of association between business relationships between modules, the weight of each directed edge is obtained through analysis.

[0027] The weights of the nodes and directed edges of the directed graph are integrated into a graph to obtain a directed graph, and the data lineage graph is obtained by summarizing them.

[0028] Furthermore, methods for obtaining the weights of directed edges include:

[0029] The basic weights are obtained by quantifying and scoring directed edges based on three indicators: business dependence, data interaction frequency, and scope of influence.

[0030] Obtain the actual number of interactions between Vi and Vj in the past H days, and the average number of interactions in the past R months, and calculate the real-time association strength factor; Vi and Vj are nodes of different modules in the directed graph between modules;

[0031] Obtain the number of times there were no conflicts after the permission linkage adjustment from Vi to Vj in the past U months and the total number of permission linkages. Calculate the linkage accuracy rate and calculate the historical linkage effect correction factor based on the linkage accuracy rate.

[0032] The weights of directed edges are calculated by combining real-time correlation strength factors, historical linkage effect correction factors, and basic weights.

[0033] Furthermore, methods for obtaining the basic weights include:

[0034] Obtain the field lists of Vi and Vj, filter the fields that Vj obtains from Vi, count the number of fields that Vj depends on Vi for, and the total number of fields in Vj, and calculate the data dependency.

[0035] Obtain the interaction data of Vi and Vj over the past E months and calculate the average number of interactions per month;

[0036] Extract the average total number of interactions per month for all modules on the platform during the same period; calculate the interaction density based on the average number of interactions per month and the total number of interactions per month;

[0037] Obtain the feature list of Vj and the corresponding total number of features. Simulate when Vi is unavailable and count the number of unusable features in Vj. Calculate the feature impact based on the total number of features and the number of unusable features in Vj when Vi is unavailable.

[0038] The basic weight is obtained by weighting data dependence, interaction tightness, and functional impact.

[0039] Furthermore, the methods for obtaining inheritance permissions for each data entity include:

[0040] Obtain the real-time permissions corresponding to each data entity and the weights of the directed edges inherited from N source entities;

[0041] When N=1, the inherited permissions are calculated based on the real-time permissions and the weights of the corresponding directed edges.

[0042] When N>1, the weights of the directed edges inherited by the N source entities are obtained by weighted fusion, and the fusion weights are used as the inheritance permissions.

[0043] Furthermore, methods for determining whether a permission conflict has occurred include:

[0044] The permission conflict condition refers to the absolute value of the difference between the real-time permission and the linkage weight being greater than a preset threshold;

[0045] If the conditions for a permission conflict are met, then a permission conflict is determined to have occurred.

[0046] Methods of conflict arbitration include:

[0047] Obtain the minimum and maximum values ​​of real-time permissions and linkage weights respectively. Calculate the product of the maximum value and the compliance coefficient to obtain the compliance value. Obtain the maximum value between the minimum value and the compliance value as the arbitration permission. Use the arbitration permission to replace the linkage weight.

[0048] Furthermore, methods for obtaining the predicted permission change matrix and risk assessment values ​​include:

[0049] The events to be adjusted, the current permission matrix, and the data lineage graph are used as inputs to the data parsing model to obtain structured signals;

[0050] By using structured signals and attenuation functions as inputs to the permission transmission model, the transmission-enhanced permission set is obtained.

[0051] The risk assessment results are obtained by using the transferred permission set and preset business constraints as inputs to the risk assessment model.

[0052] By integrating the resulting permissions and risk assessment results, a predicted permission change matrix and risk assessment values ​​are obtained.

[0053] Furthermore, the method for adjusting the current permission matrix based on the predicted permission change matrix includes:

[0054] Compare the predicted permission change matrix with the current permission matrix. If the predicted permission value is lower than the preset minimum permission for core operations, return the optimized decay function or edge weight.

[0055] Based on the directed edges in the data lineage graph, check whether the permission inheritance in the prediction matrix conforms to the preset edge weight inheritance rules: if it conforms, it passes; if it does not conform, it is determined to be an inheritance anomaly, and the corrected edge weights are returned.

[0056] The system individually verifies whether the predicted permission change values ​​corresponding to the preset sensitive roles and preset sensitive data are within the preset sensitive threshold range. If so, it passes; otherwise, it returns an adjustment to the corresponding permission value.

[0057] Furthermore, methods for adjusting the current permission matrix based on risk assessment values ​​include:

[0058] The risk level is determined based on the risk assessment value, and corresponding permission adjustments are made according to the risk level; the risk levels include low risk, medium risk, and high risk.

[0059] When the risk level is low, the permission values ​​in the predicted permission change matrix will be synchronized to the three-dimensional permission matrix in the production environment, overwriting the original permissions.

[0060] When the risk level is medium risk, root cause investigation is conducted on non-core operations, and permissions are adjusted based on the investigation results.

[0061] When the risk level is high, the current permission matrix remains unchanged, and the root cause of the predicted permission change matrix is ​​investigated. The rules are optimized based on the root cause investigation results, and then the simulation is repeated.

[0062] Furthermore, root cause analysis methods include:

[0063] If the preset core operation permission value is not lower than the minimum permission, but the permission value of other operations is less than the required threshold, then adjust the decay period and regenerate the current permission matrix.

[0064] The conflict rate is calculated. If the conflict rate is determined to be within the preset conflict rate range, the basic weights of the links that have conflicted are recalculated and the current permission matrix is ​​updated.

[0065] If the preset permission values ​​for sensitive data are within the exposure range, then adjust the decay period, update the decay function, and regenerate the current permission matrix.

[0066] The cross-module intelligent permission configuration system based on a role-based permission matrix, implementing the cross-module intelligent permission configuration method based on a role-based permission matrix, includes:

[0067] Basic setup module: Obtain user roles, data entities, and business status; construct a three-dimensional permission matrix; and assign values ​​according to preset user permissions to obtain a role permission matrix;

[0068] The permission decay module configures a decay function for each data entity in the three-dimensional permission matrix, obtains real-time business events, and calculates and obtains real-time permissions based on the decay function.

[0069] Permission linkage module: Establish a directed graph between modules to obtain a data lineage graph, obtain the inherited permissions corresponding to each data entity based on real-time permission analysis, and update the real-time permissions in combination with the inherited permissions to obtain linkage weights;

[0070] Conflict Arbitration Module: Obtains real-time permissions and linkage weights, determines whether a permission conflict has occurred, and if so, performs conflict arbitration to obtain the current permission matrix;

[0071] Permission Adjustment Module: The module takes the event to be adjusted, the current permission matrix, and the data lineage graph as input to the sandbox simulation engine, and obtains output data, including the predicted permission change matrix and risk assessment value; it then adjusts the current permission matrix based on the output data.

[0072] The technical effects and advantages of the cross-module intelligent permission configuration system and method based on role-permission matrix of this invention are as follows:

[0073] This invention establishes a clear foundation for permission rules by constructing a three-dimensional permission matrix comprising roles, data entities, and business states. It automatically calculates permission decay based on the duration of business states using a decay function. Based on real-time business events, it extracts roles and data entities and automatically calculates real-time permissions. Utilizing data lineage graphs and dynamically calculated directed edge weights, it clarifies module relationships and strength. Inherited permissions are automatically obtained through single-source direct calculation and multi-source weighted fusion. Permission conflicts are detected and automatically arbitrated using preset thresholds. Finally, based on a predicted permission matrix and risk assessment values ​​from sandbox simulation, permission synchronization, optimization, or retesting is automatically performed according to risk level. The entire process eliminates the need for administrators to manually update the permission matrix, adjust the decay function, set association strength, or handle conflicts, effectively solving the response delay problem caused by manual operation in traditional permission management. This invention achieves structured definition of permission rules, dynamic automatic calculation of permission values, precise linkage of cross-module permissions, instant arbitration of conflicts, and automatic adjustment based on risk. It ensures that permissions adapt to changes in business states in real time and accurately, guaranteeing business continuity while improving the efficiency and security of permission management, forming a fully automated cross-module intelligent permission management mechanism. Attached Figure Description

[0074] Figure 1 This is a schematic diagram of the cross-module permission intelligent configuration method based on role permission matrix of the present invention;

[0075] Figure 2 This is a schematic diagram of the data flow in this invention;

[0076] Figure 3 This is a schematic diagram of the rule-based self-evolution method of the present invention;

[0077] Figure 4 This is a schematic diagram of the cross-module intelligent permission configuration system based on the role permission matrix of the present invention. Detailed Implementation

[0078] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0079] Example 1:

[0080] Please see Figure 1 , Figure 2 As shown, this embodiment provides a cross-module permission intelligent configuration method based on a role-permission matrix, including the following steps:

[0081] Obtain user roles, data entities, and business status to construct a three-dimensional permission matrix; and obtain the role permission matrix by assigning values ​​according to preset user permissions.

[0082] Methods for obtaining a three-dimensional permission matrix include:

[0083] Based on the platform users' positions and responsibilities, users are divided into different role categories, such as enterprise-level administrators, enterprise-level visitors, office staff, office managers, finance department staff, finance department managers, early development department staff, early development department managers, user unit managers, property company managers, investment and operations department staff, investment and operations department managers, project management department staff, project management department managers, legal supervision department staff, cost and contract department staff, cost and contract department managers, and maintenance unit staff; and an inheritance relationship is established between roles, such as managers inheriting all permissions of employees;

[0084] Define the data entities in the project, such as the asset category, which includes assets, shops, etc.; the investment attraction category, which includes asset appraisal reports, merchants, investment attraction plans, etc.; and the property category, which includes work orders and inspections, etc., and define key attributes for each data entity, such as the lease status of shops and the maintenance status of equipment.

[0085] Define a corresponding business status for each data entity and define the legal transition paths between statuses, such as the legal transition path for equipment: normal operation → pending maintenance → maintenance in progress → maintenance expired → scrapped. It is also stipulated that equipment maintenance expired can only be switched to maintenance in progress or scrapped.

[0086] By intersecting the three dimensions of role, data entity, and business status, and assigning a permission value to each intersection point, a three-dimensional permission matrix is ​​obtained.

[0087] The above method categorizes platform users by job responsibilities and establishes clear role inheritance relationships. It also categorizes project data entities by business type and defines key attributes. For each data entity, it standardizes business status and legal transfer paths. Finally, it cross-links roles, data entities, and business statuses, quantifying the permission values ​​at each intersection point to form a structured and quantifiable permission rule system. This system clearly defines the permission boundaries for different roles under different business states on various data entities. This allows the system to automatically locate the corresponding roles, data entities, and business states when business events occur, eliminating the need for manual lookup and assignment by administrators. Furthermore, the pre-defined role inheritance relationships reduce redundant configuration, and the clear state transfer paths ensure the legality of state changes. This provides a precise rule foundation for automatic permission matching and dynamic adjustment, thus solving the response delay problem caused by manual updates to the permission matrix and reliance on administrator operations in traditional methods. It achieves automatic association and rapid adaptation of permissions to changes in business status.

[0088] Configure a decay function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions based on the decay function; real-time business events include state change events, time-triggered events, and operation events.

[0089] Methods for configuring the decay function include:

[0090] Obtain the duration of the current business state and construct a decay function based on a preset decay period. (Example: decay function) ,in, It is a mathematical constant; The attenuation coefficient; The duration of the current business status; The preset decay period is usually pre-configured by the administrator, such as 7 days;

[0091] The method of configuring the decay function automatically constructs the function by obtaining the duration of the current business state and combining it with a preset decay period. This allows the system to automatically calculate the permission decay coefficient based on the duration of the business state, eliminating the need for administrators to manually adjust the decay function or permission values. The entire process is dynamically executed by the system based on time parameters, avoiding the lag of manually setting the permission decay rate after business state changes. This ensures that permissions are automatically adjusted in real-time and accurately as the duration of the business state progresses, thus solving the response delay problem caused by administrator operations in traditional permission updates and achieving automation and timeliness of permission decay.

[0092] Methods to obtain real-time permissions include:

[0093] Real-time business events are acquired, and real-time roles and data entities are extracted. The basic permissions of real-time roles for real-time data entities are obtained through the role-permission matrix. Based on the current business status and duration, a decay coefficient is calculated using a decay function, which is the decay function value. Real-time permissions are then calculated based on the basic permissions and the decay coefficient. (Example: Real-time permissions) ,in, Basic permissions; The attenuation coefficient;

[0094] The above method automatically extracts real-time roles and data entities by acquiring real-time business events. Based on the role-permission matrix, it quickly obtains the basic permissions of real-time roles for real-time data entities. Then, it automatically calculates the decay coefficient by combining the current business state duration and decay function, ultimately calculating the real-time permissions in real time. This method is executed automatically by the system based on real-time business data and preset rules, eliminating the need for administrators to manually query basic permissions, calculate decay rates, or input real-time permission values. This avoids the lag caused by manual permission updates after a business event occurs, ensuring that permissions are adjusted instantly according to changes in business status. This effectively solves the response delay problem caused by administrator operations in traditional methods that rely on permission updates.

[0095] Establish a directed graph between modules to obtain a data lineage graph, and obtain the inherited permissions corresponding to each data entity based on real-time permission analysis; combine the inherited permissions to update the real-time permissions to obtain the linkage weight;

[0096] Methods for obtaining pedigree data include:

[0097] Obtain module nodes and data entities as nodes in a directed graph;

[0098] The direction of the directed edge is determined based on the influence relationship: if the change in the business status of module A directly leads to the adjustment of the permissions or data synchronization of module B, then a directed edge from A to B is obtained, such as "Equipment Management → Work Order Management" or "Shop Management → Investment Promotion Plan".

[0099] Based on the degree of association between business relationships between modules, the weight of each directed edge is obtained through analysis.

[0100] The weights of the nodes and directed edges of the directed graph are integrated into a graph to obtain a directed graph, and the data lineage graph is obtained by summarizing them.

[0101] The above method uses module nodes and data entities as nodes, determines the direction of directed edges based on the influence relationships between modules, analyzes the degree of association to obtain edge weights, and finally summarizes them into a graph, clearly presenting the permission influence paths and association strengths between modules. This allows the system to automatically locate related modules and identify the direction and strength of influence directly based on the graph when a module's business status changes, eliminating the need for administrators to manually determine which modules require synchronized permission adjustments. This provides a clear path basis for automatic cross-module permission linkage, avoiding the lag of manually sorting out relationships. It solves the response delay problem caused by administrator operations in traditional methods, achieving automation and accuracy in permission linkage.

[0102] Methods for obtaining the weight of a directed edge include:

[0103] The basic weights are obtained by quantifying and scoring directed edges based on three indicators: business dependence, data interaction frequency, and scope of influence.

[0104] Methods for obtaining basic weights include:

[0105] Obtain the field lists of Vi and Vj, where Vi and Vj are nodes of different modules in the directed graph between modules; filter the fields that Vj obtains from Vi, count the number of fields that Vj depends on for obtaining from Vi, and the total number of fields in Vj, and calculate the data dependency; such as data dependency. ,in, The number of fields that Vj retrieves from Vi; This represents the total number of fields in Vj.

[0106] Obtain the interaction data of Vi and Vj over the past E months, and calculate the average monthly interaction count; for example, the average monthly interaction count... ,in, This represents the total number of interactions between Vi and Vj over the past E months. The number of months for which statistics are collected;

[0107] Extract the average total monthly interaction count for all modules on the platform during the same period; calculate the interaction density based on the average monthly interaction count and the total monthly interaction count; such as interaction density... ,in, This represents the average total number of interactions across all modules on the platform during the same period.

[0108] Obtain the feature list of Vj and the total number of corresponding features. Simulate when Vi is unavailable and count the number of unusable features in Vj. Calculate the feature impact based on the total number of features and the number of unusable features in Vj when Vi is unavailable. ,in, The number of features that Vj cannot use when Vi is unavailable; This represents the total number of functions in Vj.

[0109] The basic weights are obtained by weighting data dependency, interaction tightness, and functional impact; the weighted weights can be obtained through natural heuristic optimization algorithms; such as the basic weights. ,in, , and The weighting coefficients can be obtained through natural heuristic optimization algorithms.

[0110] Obtain the actual number of interactions between Vi and Vj over the past H days, and the average number of interactions over the past R months, and calculate the real-time association strength factor; such as the real-time association strength factor. ,in, This represents the actual number of interactions between Vi and Vj over the past H days. This represents the average number of interactions between Vi and Vj over the past R months. For the number of days counted;

[0111] Obtain the number of times there were no conflicts after the permission linkage adjustment from Vi to Vj in the past U months, and the total number of permission linkages. Calculate the linkage accuracy rate. ,in, This represents the number of times in the past month that there have been no conflicts in the permission linkage between Vi and Vj. This represents the total number of permission-based linkages from Vi to Vj in the past U months; a historical linkage effect correction factor is calculated based on the linkage accuracy; such as the historical linkage effect correction factor. ;

[0112] The weights of directed edges are calculated by combining real-time correlation strength factors, historical linkage effect correction factors, and basic weights. (The text then abruptly shifts to a seemingly unrelated topic: the weights of directed edges.) .

[0113] The aforementioned method quantifies the basic weights based on data dependency, interaction tightness, and functional impact. It dynamically adjusts these weights using real-time interaction intensity over the past H days and linkage accuracy correction factors over the past U months. The entire weight calculation is automatically completed based on business data, eliminating the need for manual assignment or periodic updates by administrators. This ensures that the quantification of inter-module association strength aligns with historical business patterns while adapting to current interaction activity and linkage effects in real time. This allows the system to accurately transmit permission impacts directly based on automatically calculated weights during cross-module permission linkage, avoiding the weight lag or deviation caused by manual setting of association strength in traditional methods. This reduces reliance on manual operation for permission linkage, solves the problem of delayed response to permission adjustments due to manual intervention, and achieves automated and dynamic quantification of inter-module association strength, providing a reliable basis for rapid and accurate cross-module permission linkage.

[0114] The methods for obtaining inheritance permissions for each data entity include:

[0115] Obtain the real-time permissions corresponding to each data entity and the weights of the directed edges inherited from N source entities;

[0116] When N=1, inherited permissions are calculated based on real-time permissions and the weights of the corresponding directed edges; for example, inherited permissions... ,in, Real-time permissions; This represents the weight of the corresponding directed edge;

[0117] When N > 1, the weights of the directed edges inherited from the N source entities are obtained by weighted fusion, and the fusion weight is used as the inheritance permission. The weighted weight can be obtained through a natural heuristic optimization algorithm. (Inheritance permission...) ;in, For the first The weighted weights of directed edges can be obtained by using a natural heuristic optimization algorithm. For the first The weight of a directed edge;

[0118] The above method automatically obtains the real-time permissions of data entities and the weights of directed edges inherited from N source entities. When N=1, it directly calculates the inherited permissions based on the real-time permissions and corresponding edge weights. When N>1, it obtains the inherited permissions by weighted fusion of the edge weights of multiple source entities. The entire process is automatically completed by the system according to preset rules and algorithms, without requiring administrators to manually handle the permission inheritance logic of single or multiple source entities. This allows data entities to automatically and accurately inherit permissions from associated source entities, avoiding the cumbersome and delayed operations caused by administrators manually sorting out multi-source permission inheritance relationships and calculating inherited permissions in traditional methods. It reduces the dependence on manual operation for permission inheritance, thereby solving the problem of delayed response to permission adjustment caused by manual intervention. It realizes automated and accurate calculation of permission inheritance in multiple scenarios, providing efficient support for the rapid update of data entity permissions.

[0119] Obtain real-time permissions and linkage weights, determine whether permission conflicts occur, and if so, perform conflict arbitration to obtain the current permission matrix.

[0120] Methods for determining whether a permission conflict has occurred include:

[0121] The permission conflict condition refers to the absolute value of the difference between the real-time permission and the linkage weight being greater than a preset threshold; this can be obtained based on historical data statistics.

[0122] If the conditions for a permission conflict are met, then a permission conflict is determined to have occurred.

[0123] Methods of conflict arbitration include:

[0124] Obtain the minimum and maximum values ​​of real-time permissions and linkage weights respectively. Calculate the product of the maximum value and the compliance coefficient to obtain the compliance value. Obtain the maximum value between the minimum value and the compliance value as the arbitration permission. Use the arbitration permission to replace the linkage weight.

[0125] After acquiring real-time permissions and associated weights, the system automatically determines whether the difference between the two exceeds a preset threshold to identify permission conflicts. If a conflict occurs, it automatically takes the maximum value of the real-time permissions and associated weights, calculates the arbitration permissions based on the compliance coefficient, and replaces the associated weights to obtain the current permission matrix. The entire process of conflict detection and arbitration is automatically completed by the system according to preset rules, without requiring administrators to manually compare permission values, determine conflicts, or adjust permissions. This method avoids the lag in permission adjustments caused by manual intervention in conflict resolution in traditional methods, allowing the system to respond instantly and automatically reconcile when permission conflicts occur. It reduces the reliance on manual operation for permission matrix updates, thereby solving the problem of delayed response to permission adjustments caused by manual conflict handling, ensuring the real-time nature and consistency of the current permission matrix, and providing an automated conflict resolution mechanism for dynamic permission governance.

[0126] The event to be adjusted, the current permission matrix, and the data lineage graph are used as inputs to the sandbox simulation engine to obtain output data, including the predicted permission change matrix and risk assessment value; the current permission matrix is ​​adjusted based on the output data.

[0127] Methods for obtaining the predicted permission change matrix and risk assessment values ​​include:

[0128] The events to be adjusted, the current permission matrix, and the data lineage graph are used as inputs to the data parsing model to obtain structured signals;

[0129] By using structured signals and attenuation functions as inputs to the permission transmission model, the transmission-enhanced permission set is obtained.

[0130] The risk assessment results are obtained by using the transferred permission set and preset business constraints as inputs to the risk assessment model.

[0131] By integrating the transmitted permissions and risk assessment results, a predicted permission matrix and risk assessment values ​​are obtained.

[0132] Training methods for data parsing models include:

[0133] Q sets of training data are collected in advance. The training data includes events to be adjusted, the current permission matrix, data lineage graph and structured signals.

[0134] The event to be adjusted, the current permission matrix, and the data lineage graph are used as inputs to the data parsing model, and the structured signal is used as the output of the data parsing model. With the goal of minimizing the error between the output structured signal and the actual structured signal, the network parameters of the data parsing model are optimized through a natural heuristic optimization algorithm. The network parameters that minimize the error between the output structured signal and the actual structured signal are obtained, and the data parsing model constructed with the corresponding network parameters is used as the trained data parsing model.

[0135] The training methods for the permission transfer model and the risk assessment model are similar to those for the data parsing model, differing only in their inputs and outputs.

[0136] The aforementioned method automatically generates structured signals by inputting the event to be adjusted, the current permission matrix, and the data lineage graph into a data analysis model. These signals are then combined with a decay function and processed through a permission transmission model to obtain the transmitted permission set. Finally, preset business constraints are associated with the results, which are then output by a risk assessment model and integrated into a prediction matrix, report, and evaluation value. The entire process, from input to result generation, is automatically completed by the system based on business data and preset models, eliminating the need for administrators to manually simulate permission changes, analyze the scope of impact, or assess risks. This process allows the system to predict potential permission changes, their impact, and risk levels before actual permission adjustments. Administrators can then plan adjustment strategies in advance based on these predictions, avoiding the lag caused by manual analysis of impacts and risks after permission adjustments, as is common in traditional methods. This reduces reliance on real-time manual operations for permission adjustments, thus solving the problem of delayed response to permission adjustments caused by manual intervention. It provides advance prediction and decision-making basis for accurate and timely permission adjustments.

[0137] Methods for adjusting the current permission matrix based on the predicted permission change matrix include:

[0138] Compare the predicted permission change matrix with the current permission matrix. If the predicted permission value is lower than the preset minimum permission for core operations, return the optimized decay function or edge weight.

[0139] Based on the directed edges in the data lineage graph, check whether the permission inheritance in the prediction matrix conforms to the preset edge weight inheritance rules: if it conforms, it passes; if it does not conform, it is determined to be an inheritance anomaly, and the corrected edge weights are returned.

[0140] The system independently verifies whether the predicted permission change values ​​corresponding to preset sensitive roles (such as the legal supervision department) and preset sensitive data (such as rent details and tenant contracts) are within the preset sensitive threshold range. If so, the system passes; otherwise, it returns an adjustment to the corresponding permission value.

[0141] The aforementioned method automatically compares the predicted matrix with the current matrix to check whether core operation permissions meet the standards, verifies whether permission inheritance conforms to edge weight rules based on the data lineage graph, and individually verifies whether the permissions of sensitive roles and data meet the thresholds. For non-compliant items, it automatically returns an optimized decay function, corrects the edge weights, or adjusts the sensitive permission values. The entire process is automatically completed by the system according to preset standards, eliminating the need for administrators to manually check for permission deviations, inheritance anomalies, or sensitive permission risks. This process allows for automatic triggering of verification and optimization before permission adjustments, avoiding the operational delays caused by manual checks and adjustments by administrators in traditional methods. It reduces the reliance on manual intervention for permission matrix updates, thereby solving the problem of delayed response to permission adjustments caused by manual intervention. This ensures that the adjustment of the current permission matrix accurately meets business needs and can quickly respond to problems in the prediction results, achieving an automated verification and optimization closed loop for permission adjustments.

[0142] Methods for adjusting the current permission matrix based on risk assessment values ​​include:

[0143] The risk level is determined based on the risk assessment value, and corresponding permission adjustments are made according to the risk level; the risk levels include low risk, medium risk, and high risk.

[0144] When the risk level is low, the permission values ​​in the predicted permission change matrix will be synchronized to the three-dimensional permission matrix in the production environment, overwriting the original permissions.

[0145] When the risk level is medium risk, root cause investigation is conducted on non-core operations, and permissions are adjusted based on the investigation results.

[0146] Root cause analysis methods include:

[0147] If the preset core operation permission value is not lower than the minimum permission, but the permission value of other operations is less than the required threshold, then adjust the decay period and regenerate the current permission matrix.

[0148] The conflict rate is calculated. If the conflict rate is determined to be within the preset conflict rate range, the basic weights of the links that have conflicted are recalculated and the current permission matrix is ​​updated.

[0149] If the preset permission values ​​for sensitive data are within the exposure range, then adjust the decay period, update the decay function, and regenerate the current permission matrix.

[0150] When the risk level is high, the current permission matrix remains unchanged, and the root cause of the predicted permission change matrix is ​​investigated. The rules are optimized based on the root cause investigation results, and then the simulation is repeated.

[0151] The aforementioned method categorizes risk levels into low, medium, and high and drives corresponding automated operations. In low-risk scenarios, predicted permissions are directly synchronized to the production environment. In medium-risk scenarios, the system automatically identifies issues such as insufficient non-core operation permissions, excessive conflict rates, or sensitive data exposure, and adjusts rules such as decay cycles and basic weights. In high-risk scenarios, the system maintains the status quo, automatically identifies root causes, and re-simulates the process. The entire process is automated, with the system making decisions and executing permission adjustments based on risk levels and preset logic, eliminating the need for administrators to manually assess risk levels, formulate adjustment strategies, or update operation permissions. This process allows permission adjustments to accurately adapt to different handling schemes based on risk levels, avoiding the operational delays caused by administrators manually assessing risks and planning adjustment steps in traditional methods. It reduces the reliance on manual intervention for permission matrix updates, thus solving the problem of untimely permission adjustment responses due to human delays. This achieves full automation of the permission adjustment process based on risk levels, ensuring that the permission matrix can be updated quickly in low-risk scenarios and accurately optimized in medium- and high-risk scenarios, guaranteeing the efficiency and reliability of permission adjustments.

[0152] Example 2:

[0153] Please see Figure 3 As shown, this embodiment provides a rule-based self-evolution method applied to Embodiment 1, including the following steps:

[0154] The core rule parameters are parameterized and used as the action space of the RL agent; the core rule parameters can be defined by the user, such as decay period, edge weight base coefficient, and number of arbitration compliance times;

[0155] The system calculates the success rate of core operations and the exposure rate of sensitive data, and designs a reward function based on these rates. Specifically, a positive reward is given when the success rate of core operations after permission adjustments is not lower than a preset success threshold and no sensitive data is exposed; otherwise, a penalty is imposed. The reward function is designed with permission effectiveness and security as its objectives, with a preset time interval, such as one hour. Every hour, the agent dynamically adjusts the core rule parameters based on the latest business data update strategy.

[0156] By parameterizing core rule parameters as the action space of the RL agent, and designing a reward function based on the success rate of core operations and the exposure rate of sensitive data, the agent dynamically updates its strategy and adjusts parameters hourly based on the latest business data. This process allows the optimization of permission rules to be completed automatically by the system based on business feedback, without the need for administrators to manually modify core parameters or periodically adjust rules. By continuously learning patterns in business data, the agent can autonomously adapt to dynamic business changes and optimize rule parameters in real time to balance the effectiveness and security of permissions. This avoids the parameter lag or insufficient adaptation caused by manual rule adjustments by administrators in traditional methods, thereby reducing the dependence on manual operation for permission rule optimization, solving the problem of rule adjustment response delay caused by manual intervention, realizing the self-evolution and dynamic adaptation of core permission rules, and ensuring that the rules are always synchronized with business needs.

[0157] Example 3:

[0158] Please see Figure 4 As shown, this embodiment provides a cross-module intelligent permission configuration system based on a role-based permission matrix, including:

[0159] Basic setup module: Obtain user roles, data entities, and business status; construct a three-dimensional permission matrix; and assign values ​​according to preset user permissions to obtain a role permission matrix;

[0160] The permission decay module configures a decay function for each data entity in the three-dimensional permission matrix, obtains real-time business events, and calculates and obtains real-time permissions based on the decay function.

[0161] Permission linkage module: Establish a directed graph between modules to obtain a data lineage graph, obtain the inherited permissions corresponding to each data entity based on real-time permission analysis, and update the real-time permissions in combination with the inherited permissions to obtain linkage weights;

[0162] Conflict Arbitration Module: Obtains real-time permissions and linkage weights, determines whether a permission conflict has occurred, and if so, performs conflict arbitration to obtain the current permission matrix;

[0163] Permission Adjustment Module: The module takes the event to be adjusted, the current permission matrix, and the data lineage graph as input to the sandbox simulation engine, and obtains output data, including the predicted permission change matrix and risk assessment value; it then adjusts the current permission matrix based on the output data.

[0164] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0165] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A cross-module permission intelligent configuration method based on a role permission matrix, characterized in that, The application relates to a three-dimensional permission matrix construction method and system. The application comprises the following steps: Obtaining user roles, data entities and business states, and constructing a three-dimensional permission matrix; According to the preset user permissions, the role permission matrix is obtained by assignment; For each data entity in the three-dimensional permission matrix, an attenuation function is configured, real-time business events are obtained, and real-time permissions are calculated according to the attenuation function; A directed graph between modules is established, a data bloodline graph is obtained, and the corresponding inheritance permissions of each data entity are analyzed according to the real-time permissions; The real-time permissions are updated in combination with the inheritance permissions to obtain linkage weights; The real-time permissions and the linkage weights are obtained, and it is judged whether a permission conflict is generated; if a permission conflict is generated, conflict arbitration is performed to obtain a current permission matrix; 2. The role-based permission matrix cross-module permission intelligent configuration method according to claim 1, characterized in that, The event to be adjusted, the current permission matrix and the data bloodline graph are taken as inputs of a sandbox simulation engine to obtain output data, including a predicted permission change matrix and a risk assessment value; and the current permission matrix is adjusted according to the output data. The method for obtaining the three-dimensional permission matrix comprises the following steps: According to the post and responsibility of the platform user, the user is divided into different role categories, and an inheritance relationship between the roles is established; Data entities in the project are defined, and key attributes of each data entity are defined; The corresponding business states of each data entity are defined, and the legal transfer path between the states is defined; The three dimensions of roles, data entities and business states are crossed, each cross point corresponds to a permission value, and a three-dimensional permission matrix is obtained; The method for configuring the attenuation function comprises the following steps: The current business state duration is obtained, and the attenuation function is constructed according to the preset attenuation period; The real-time business events include state change events, time trigger events and operation events; The method for obtaining the real-time permissions comprises the following steps:

3. The role-based permission matrix cross-module permission intelligent configuration method according to claim 1, characterized in that, Real-time roles and real-time data entities are obtained by extracting real-time business events, the basic permissions of the real-time roles to the real-time data entities are obtained through the role permission matrix, the attenuation coefficient is calculated according to the current business state and the duration according to the attenuation function, and the real-time permissions are calculated according to the basic permissions and the attenuation coefficient. The method for obtaining the data bloodline graph comprises the following steps: Module nodes and data entities are obtained as nodes of a directed graph; The direction of a directed edge is determined according to an influence relationship; According to the correlation degree of the business correlation between the modules, the weight of each directed edge is analyzed and obtained; 4. The role-based permission matrix cross-module permission intelligent configuration method according to claim 3, characterized in that, The nodes of the directed graph and the weight of the directed edge are integrated into a graph to obtain a directed graph, and a data bloodline graph is obtained by summarizing. The method for obtaining the weight of the directed edge comprises the following steps: The basic weight of the directed edge is obtained by quantitatively scoring based on three indexes of business dependence degree, data interaction frequency and influence range; The actual interaction frequency of Vi and Vj in the last H days and the average interaction frequency in the last R months are obtained, and the real-time correlation strength factor is calculated; Vi and Vj are different module nodes in the directed graph between the modules; The number of times of non-conflict after the permission linkage adjustment of Vi to Vj in the last U months and the total number of times of permission linkage are obtained, the linkage accuracy rate is calculated, and the historical linkage effect correction factor is calculated according to the linkage accuracy rate; 5. The role-based permission matrix-based cross-module permission intelligent configuration method according to claim 4, characterized in that, The weight of the directed edge is calculated in combination with the real-time correlation strength factor, the historical linkage effect correction factor and the basic weight. The method for obtaining the basic weight comprises the following steps: Obtain the field list of Vi and Vj, filter the fields obtained by Vj from Vi, count the number of fields obtained by Vj from Vi, and the total number of fields of Vj, calculate the data dependency degree; Obtain the interaction data of Vi and Vj in the last E months, and calculate the average monthly interaction times; Extract the average monthly total interaction times of all modules of the platform in the same period; calculate the interaction tightness according to the average monthly interaction times and the average monthly total interaction times; Obtain the function list of Vj and the corresponding total number of functions, simulate the case where Vi is unavailable, and count the number of functions that cannot be used in Vj; calculate the function impact degree according to the total number of functions and the number of functions that cannot be used in Vj when Vi is unavailable; Obtain the basic weight according to the data dependency, interaction tightness and function impact degree.

6. The role-based permission matrix-based cross-module permission intelligent configuration method according to claim 1, characterized in that, The method for obtaining the inheritance permission corresponding to each data entity comprises: Obtain the real-time permission corresponding to each data entity and the weight of the directed edge inherited from N source entities; When N=1, the inheritance permission is calculated based on the real-time permission and the weight of the corresponding directed edge; When N>1, the weight of the directed edge inherited from N source entities is obtained by using a weighted fusion method to obtain a fusion weight, and the fusion weight is used as the inheritance permission.

7. The role-based permission matrix-based cross-module permission intelligent configuration method according to claim 1, characterized in that, The method for judging whether a permission conflict occurs comprises: The permission conflict condition refers to that the absolute value of the difference between the real-time permission and the linkage weight is greater than a preset threshold value; If the permission conflict condition is met, it is determined that a permission conflict occurs; The method for performing conflict arbitration comprises: Respectively obtain the minimum value and the maximum value in the real-time permission and the linkage weight, calculate the product of the maximum value and the compliance coefficient to obtain a compliance value, obtain the maximum value of the minimum value and the compliance value as the arbitration permission, and replace the linkage weight with the arbitration permission.

8. The role-based permission matrix-based cross-module permission intelligent configuration method according to claim 1, characterized in that, The method for obtaining the predicted permission change matrix and the risk assessment value comprises: Take the event to be adjusted, the current permission matrix and the data blood relationship map as inputs of a data analysis model to obtain a structured signal; Take the structured signal and a decay function as inputs of a permission transmission model to obtain a transmitted permission set; Take the transmitted permission set and a preset business constraint as inputs of a risk assessment model to obtain a risk assessment result; Integrate the transmitted permission and the risk assessment result to obtain the predicted permission change matrix and the risk assessment value.

9. The role-based permission matrix-based cross-module permission intelligent configuration method according to claim 8, characterized in that, The method for adjusting the current permission matrix according to the predicted permission change matrix comprises: Compare the predicted permission change matrix with the current permission matrix, if the predicted permission value is lower than the preset minimum permission of the core operation, return the optimized decay function or edge weight; Based on the directed edge in the data blood relationship map, check whether the permission inheritance in the predicted matrix conforms to the preset edge weight inheritance rule: if it conforms, it is passed; if it does not conform, it is determined as an inheritance anomaly, and the modified edge weight is returned; Individually verify whether the predicted permission change value corresponding to the preset sensitive role and the preset sensitive data is within the preset sensitive threshold interval, and if so, it is passed, otherwise, the corresponding permission value is returned.

10. The role-based permission matrix-based cross-module permission intelligent configuration method of claim 9, wherein, The method for adjusting the current permission matrix according to the risk assessment value comprises: Determine the risk level according to the risk assessment value, and perform corresponding permission adjustment operation according to the risk level; the risk level includes low risk, medium risk and high risk; When the risk level is low, the permission value in the predicted permission change matrix is synchronized to the three-dimensional permission matrix of the production environment, covering the original permission; When the risk level is medium, the root cause is investigated for non-core operations, and the permission is adjusted according to the investigation results; When the risk level is high, the current permission matrix is maintained unchanged, and the predicted permission change matrix is investigated for root cause, and the rules are optimized according to the root cause investigation results and then simulated again.

11. The role-based permission matrix-based cross-module permission intelligent configuration method of claim 10, wherein, The method for root cause investigation includes: If the permission value of the preset core operation is not lower than the minimum permission, but the permission value of other operations is less than the demand threshold, adjust the decay period, and regenerate the current permission matrix; Statistical conflict rate, if the conflict rate is within the preset conflict rate range, the basic weight of the link with conflict is recalculated, and the current permission matrix is updated; If the permission value of the preset sensitive data is within the exposure range, adjust the decay period, update the decay function, and regenerate the current permission matrix.

12. A cross-module intelligent permission configuration system based on a role-based permission matrix, implementing the cross-module intelligent permission configuration method based on a role-based permission matrix as described in any one of claims 1-11, characterized in that, It includes: Basic building module: obtain user roles, data entities and business status, and build a three-dimensional permission matrix; And according to the preset user permission, the role permission matrix is obtained by assigning values; Permission decay module: configure decay function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions according to the decay function; Permission linkage module: establish a directed graph between modules, obtain a data bloodline map, and obtain the inheritance permission corresponding to each data entity according to the real-time permission analysis; Update the real-time permission in combination with the inheritance permission to obtain the linkage weight; Conflict arbitration module: obtain real-time permissions and linkage weights, and judge whether there is a permission conflict, if so, perform conflict arbitration to obtain the current permission matrix; Permission adjustment module: take the event to be adjusted, the current permission matrix and the data bloodline map as the input of the sandbox simulation engine, obtain the output data, including the predicted permission change matrix and the risk assessment value; adjust the current permission matrix according to the output data.

Images