Cross-module permission intelligent configuration system and method based on role permission matrix

Abstract

The application belongs to the technical field of project management, and discloses a cross-module permission intelligent configuration system and method based on a role permission matrix; the method comprises the following steps: constructing a three-dimensional permission matrix of roles, data entities and business states and assigning values, then configuring a decay function for the data entities, and calculating real-time permissions in combination with real-time business events; obtaining a data bloodline graph through a module directed graph, obtaining inherited permissions and updating linkage weights; detecting permission conflicts and arbitrating to obtain a current matrix; outputting a prediction matrix and a risk value through sandbox simulation, adjusting the current permission matrix according to the prediction matrix and the risk value, and realizing intelligent management of cross-module permissions; the application realizes the structured definition of permission rules, the dynamic and automatic calculation of permission values, the accurate linkage and instant arbitration of cross-module permissions, and the automatic adjustment based on risks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of project management, more particularly, the present application relates to a cross-module permission intelligent configuration system and method based on a role permission matrix. BACKGROUND

[0002] In traditional cross-module permission management, permission configuration is mostly dependent on static matrix or manual maintenance, which is difficult to adapt to the dynamic changes of business status and has many limitations. On the one hand, the permission matrix is usually fixed, and when the business status of the data entity changes, the administrator needs to manually find the permission relationship between the corresponding role and the data entity and update the permission value, which is not only tedious and inefficient, but also prone to out of sync between permission and business status due to human error, causing response delay. On the other hand, the cross-module permission linkage lacks unified correlation rules, and the permission configuration of different business modules is independent of each other. When the business status of a module changes and needs to be linked to adjust the permissions of other modules, the administrator needs to manually sort out the influence relationship between modules and judge the correlation strength, which not only cannot guarantee the accuracy of linkage, but also causes the permission adjustment to lag behind the business needs due to reliance on manual intervention.

[0003] Chinese patent application with publication number CN120030565A discloses a database dynamic permission management system, which includes a subsystem management module that communicates with each permission management subsystem to obtain permission association information, menu and button information of each permission management subsystem; a menu management module that receives each menu and button information and generates a comprehensive permission management interface based on each menu and button information, and receives an administrator's permission management action on the comprehensive permission management interface; and a role management module that generates a user role based on the administrator's permission management action, and the generated user role involves permission configuration information of multiple permission management subsystems, and the subsystem management module sends the permission configuration information to the corresponding permission management subsystem.

[0004] Although the existing technology can meet most scenarios, research and practical application have found that the existing technology at least has the following defects:

[0005] The existing technology only focuses on dynamic adjustment of permissions within a single database and relies on real-time behavior monitoring to trigger permission changes, which cannot link to adjust the permissions in other business modules.

[0006] In view of this, the present application proposes a cross-module permission intelligent configuration system and method based on a role permission matrix to solve the above problems. SUMMARY

[0007] In order to overcome the above-mentioned defects of the prior art and achieve the above-mentioned purposes, the present application provides the following technical solutions: a cross-module permission intelligent configuration method based on a role permission matrix, comprising:

[0008] Obtain user roles, data entities and business states, build a three-dimensional permission matrix, and assign values according to preset user permissions to obtain a role permission matrix;

[0009] Configure a decay function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions according to the decay function;

[0010] Establish a directed graph between modules, obtain a data bloodline map, and analyze the inheritance permissions corresponding to each data entity according to the real-time permissions; update the real-time permissions in combination with the inheritance permissions to obtain linkage weights;

[0011] Obtain real-time permissions and linkage weights, determine whether a permission conflict occurs, and if so, perform conflict arbitration to obtain a current permission matrix;

[0012] Take the event to be adjusted, the current permission matrix and the data bloodline map as inputs of a sandbox simulation engine, obtain output data including a predicted permission change matrix and a risk assessment value, and adjust the current permission matrix according to the output data.

[0013] Further, the method for obtaining a three-dimensional permission matrix comprises:

[0014] According to the positions and responsibilities of platform users, the users are divided into different role categories, and inheritance relationships between roles are established, such as the leader inheriting all the permissions of the staff;

[0015] Define data entities in the project, and define key attributes for each data entity;

[0016] Define the corresponding business states for each data entity, and define the legal transfer path between states;

[0017] Cross the three dimensions of roles, data entities and business states, and each intersection point corresponds to a permission value to obtain a three-dimensional permission matrix;

[0018] The method for configuring a decay function comprises:

[0019] Obtain the current business state duration, and build a decay function according to a preset decay period;

[0020] The real-time business events include state change events, time trigger events and operation events;

[0021] The method for obtaining real-time permissions comprises:

[0022] Obtaining real-time business events, extracting real-time roles and real-time data entities, obtaining basic permissions of real-time roles to real-time data entities through a role permission matrix, calculating an attenuation coefficient according to a current business state and a duration according to an attenuation function, and calculating real-time permissions according to the basic permissions and the attenuation coefficient.

[0023] Further, the method for obtaining the data bloodline map comprises:

[0024] Obtaining module nodes and data entities as nodes of a directed graph;

[0025] Determining the direction of a directed edge according to an influence relationship;

[0026] Analyzing and obtaining the weight of each directed edge according to the correlation degree of inter-module business correlation;

[0027] Integrating the nodes of the directed graph and the weight of the directed edge into a graph to obtain a directed graph and summarize a data bloodline map.

[0028] Further, the method for obtaining the weight of the directed edge comprises:

[0029] Quantitatively scoring the directed edge based on three indexes of business dependency degree, data interaction frequency and influence range to obtain a basic weight;

[0030] Obtaining the actual interaction frequency of Vi and Vj in the last H days and the average interaction frequency in the last R months to calculate a real-time correlation strength factor; Vi and Vj are different module nodes in the inter-module directed graph;

[0031] Obtaining the number of times of non-conflict after permission linkage adjustment of Vi to Vj in the last U months and the total number of permission linkage, calculating a linkage accuracy rate, and calculating a historical linkage effect correction factor according to the linkage accuracy rate;

[0032] Combining the real-time correlation strength factor, the historical linkage effect correction factor and the basic weight to calculate the weight of the directed edge.

[0033] Further, the method for obtaining the basic weight comprises:

[0034] Obtaining the field list of Vi and Vj, screening the fields obtained by Vj from Vi, counting the number of fields obtained by Vj from Vi, and counting the total number of fields of Vj to calculate a data dependency degree;

[0035] Obtaining the interaction data of Vi and Vj in the last E months to calculate a monthly average interaction frequency;

[0036] Extracting the monthly average total interaction frequency of all modules of the same period platform, and calculating an interaction tightness according to the monthly average interaction frequency and the monthly average total interaction frequency;

[0037] Obtaining a function list of Vj and a total number of corresponding functions, when Vi is unavailable, counting the number of functions that cannot be used in Vj, and calculating a function influence degree according to the total number of functions and the number of functions that cannot be used in Vj when Vi is unavailable;

[0038] Obtaining a basic weight according to the data dependence degree, the interaction tightness and the function influence degree.

[0039] Further, the method for obtaining the inheritance right corresponding to each data entity comprises:

[0040] Obtaining a real-time right corresponding to each data entity and a weight of a directed edge inherited from N source entities;

[0041] When N = 1, the inheritance right is calculated based on the real-time right and the weight of the corresponding directed edge;

[0042] When N > 1, the weight of the directed edge inherited from the N source entities is obtained in a weighted fusion manner to obtain a fusion weight, and the fusion weight is taken as the inheritance right.

[0043] Further, the method for judging whether a right conflict occurs comprises:

[0044] The right conflict condition refers to that an absolute value of a difference between the real-time right and the linkage weight is greater than a preset threshold;

[0045] If the right conflict condition is met, it is determined that a right conflict occurs.

[0046] The method for performing conflict arbitration comprises:

[0047] Respectively obtaining a minimum value and a maximum value in the real-time right and the linkage weight, calculating a product of the maximum value and a compliance coefficient to obtain a compliance value, obtaining a maximum value in the minimum value and the compliance value as an arbitration right, and replacing the linkage weight with the arbitration right.

[0048] Further, the method for obtaining a predicted right change matrix and a risk assessment value comprises:

[0049] Taking an event to be adjusted, a current right matrix and a data blood relation map as inputs of a data analysis model to obtain a structured signal;

[0050] Taking the structured signal and a decay function as inputs of a right transmission model to obtain a right set after transmission;

[0051] Taking the right set after transmission and a preset business constraint as inputs of a risk assessment model to obtain a risk assessment result;

[0052] Integrating the right after transmission and the risk assessment result to obtain a predicted right change matrix and a risk assessment value.

[0053] Further, the method of adjusting the current authority matrix according to the predicted authority change matrix comprises:

[0054] Comparing the predicted authority change matrix with the current authority matrix, if the predicted authority value is lower than the preset minimum authority of the core operation, returning the optimized decay function or edge weight;

[0055] Based on the directed edges in the data bloodline graph, checking whether the authority inheritance in the predicted matrix conforms to the preset edge weight inheritance rule: if it conforms, it passes; if it does not conform, it is determined as inheritance anomaly, and the modified edge weight is returned;

[0056] Separately verifying whether the predicted authority change value corresponding to the preset sensitive role and the preset sensitive data is within the preset sensitive threshold interval, if yes, passing, otherwise returning to adjust the corresponding authority value.

[0057] Further, the method of adjusting the current authority matrix according to the risk assessment value comprises:

[0058] According to the risk assessment value, the risk level is determined, and the corresponding authority adjustment operation is performed according to the risk level; the risk level includes low risk, medium risk and high risk;

[0059] When the risk level is low risk, the authority value in the predicted authority change matrix is synchronized to the three-dimensional authority matrix of the production environment, covering the original authority;

[0060] When the risk level is medium risk, the root cause is investigated, and the authority is adjusted according to the investigation result;

[0061] When the risk level is high risk, the current authority matrix is maintained unchanged, and the predicted authority change matrix is investigated for root cause, and is simulated again after optimization according to the root cause investigation result.

[0062] Further, the method of root cause investigation comprises:

[0063] If the authority value of the preset core operation is not lower than the minimum authority, but the authority value of other operations is less than the demand threshold, the decay period is adjusted, and the current authority matrix is regenerated;

[0064] If the conflict rate is determined to be within the preset conflict rate range, the basic weight of the link with conflict is recalculated, and the current authority matrix is updated and generated;

[0065] If the authority value of the preset sensitive data is within the exposure range, the decay period is adjusted, the decay function is updated, and the current authority matrix is regenerated.

[0066] The cross-module authority intelligent configuration system based on the role authority matrix implements the cross-module authority intelligent configuration method based on the role authority matrix, comprising:

[0067] Base building module: obtain user roles, data entities and business states, build a three-dimensional permission matrix; and assign values according to the preset user permissions to obtain a role permission matrix;

[0068] Permission attenuation module: configure an attenuation function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions according to the attenuation function;

[0069] Permission linkage module: establish a directed graph between modules, obtain a data bloodline graph, and obtain the inheritance permissions corresponding to each data entity according to real-time permissions; update the real-time permissions in combination with the inheritance permissions to obtain linkage weights;

[0070] Conflict arbitration module: obtain real-time permissions and linkage weights, judge whether a permission conflict is generated, and if so, perform conflict arbitration to obtain a current permission matrix;

[0071] Permission adjustment module: take the event to be adjusted, the current permission matrix and the data bloodline graph as inputs of a sandbox simulation engine, obtains output data including a predicted permission change matrix and a risk assessment value; and adjusts the current permission matrix according to the output data.

[0072] The technical effects and advantages of the cross-module permission intelligent configuration system and method based on the role permission matrix of the present application are as follows:

[0073] The present application builds a three-dimensional permission matrix of roles, data entities and business states to clearly define the permission rule basis, combines an attenuation function to automatically calculate the permission attenuation with the business state duration, extracts roles and data entities according to real-time business events and automatically calculates real-time permissions, clearly defines the module association and strength with the help of a data bloodline graph and dynamically calculated directed edge weights, automatically obtains inheritance permissions through single-source direct calculation and multi-source weighted fusion, detects permission conflicts through a preset threshold and automatically arbitrates, and finally performs permission synchronization, optimization or re-measurement according to the risk level based on the predicted permission matrix and risk assessment value of the sandbox simulation, without relying on administrators to manually update the permission matrix, adjust the attenuation function, set the association strength or handle conflicts throughout the process, effectively solving the response delay problem caused by the dependence of traditional permission management on manual operation. The present application realizes the structured definition of permission rules, the dynamic and automatic calculation of permission values, the precise linkage of cross-module permissions, the immediate arbitration of conflicts and the automatic adjustment based on risks, ensures that permissions can be adapted in real time and accurately with the change of business states, guarantees business continuity, improves the efficiency and security of permission management, and forms a full-process automated cross-module permission intelligent management mechanism. BRIEF DESCRIPTION OF DRAWINGS

[0074] Figure 1 It is a flowchart of the cross-module permission intelligent configuration method based on the role permission matrix of the present application.

[0075] Figure 2 This is a schematic diagram of the data flow in this invention;

[0076] Figure 3 This is a schematic diagram of the rule-based self-evolution method of the present invention;

[0077] Figure 4 This is a schematic diagram of the cross-module intelligent permission configuration system based on the role permission matrix of the present invention. Detailed Implementation

[0078] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0079] Example 1:

[0080] Please see Figure 1 , Figure 2 As shown, this embodiment provides a cross-module permission intelligent configuration method based on a role-permission matrix, including the following steps:

[0081] Obtain user roles, data entities, and business status to construct a three-dimensional permission matrix; and obtain the role permission matrix by assigning values ​​according to preset user permissions.

[0082] Methods for obtaining a three-dimensional permission matrix include:

[0083] Based on the platform users' positions and responsibilities, users are divided into different role categories, such as enterprise-level administrators, enterprise-level visitors, office staff, office managers, finance department staff, finance department managers, early development department staff, early development department managers, user unit managers, property company managers, investment and operations department staff, investment and operations department managers, project management department staff, project management department managers, legal supervision department staff, cost and contract department staff, cost and contract department managers, and maintenance unit staff; and an inheritance relationship is established between roles, such as managers inheriting all permissions of employees;

[0084] Define the data entities in the project, such as asset class, which includes assets, shops, etc.; investment class, which includes asset appraisal reports, merchants, investment plans, etc.; property class, which includes work orders and inspections, etc., and define key attributes for each data entity, such as the lease status of shops and the maintenance status of equipment.

[0085] Define the corresponding business state for each data entity, and define the legal transfer path between states, such as the legal transfer path of the device: normal operation → maintenance pending → maintenance in progress → maintenance overdue → scrap, and stipulate that the device maintenance overdue can only switch to maintenance in progress or scrap;

[0086] Cross the three dimensions of roles, data entities and business states, and each intersection point corresponds to a permission value to obtain a three-dimensional permission matrix.

[0087] The above method classifies the roles of platform users according to job responsibilities and establishes clear role inheritance relationships, classifies project data entities according to business types and defines key attributes, specifies business states and legal transfer paths for each data entity, and finally cross-relates roles, data entities and business states three dimensions and quantifies the permission value of each intersection point, forming a structured and quantifiable permission rule system. This system clearly defines the permission boundaries of different roles for various data entities in different business states, enabling the system to automatically locate the corresponding role, data entity and business state when a business event occurs, without relying on manual search and assignment by administrators. At the same time, through the pre-set role inheritance relationship, it reduces repeated configuration, and through the clear state transfer path, it ensures the legality of state changes, providing a precise rule basis for automatic matching and dynamic adjustment of permissions, thereby solving the problem of manual update of the permission matrix and the response delay caused by relying on administrator operations in traditional methods, and realizing the automatic association and rapid adaptation of permissions and business state changes.

[0088] Configure a decay function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions according to the decay function; real-time business events include state change events, time trigger events and operation events.

[0089] The method of configuring the decay function includes:

[0090] Obtain the current business state duration, and construct the decay function according to the preset decay period. For example, the decay function is wherein, is a mathematical constant; is the decay coefficient; is the duration of the current business state; is the preset decay period, generally pre-configured by the administrator, such as 7 days;

[0091] The method of configuring the attenuation function automatically builds the function by obtaining the current business state duration and combining the preset attenuation period, so that the system can automatically calculate the permission attenuation coefficient according to the duration of the business state, without the need for the administrator to manually adjust the attenuation function or the permission value. The above process is completely executed by the system according to the time parameter, avoiding the lag of relying on manual setting of the permission attenuation range after the change of the business state, ensuring that the permission can be automatically adjusted in real time and accurately as the duration of the business state changes, thereby solving the problem of response delay caused by the dependence of permission update on administrator operation in the traditional way, and realizing the automation and timeliness of permission attenuation.

[0092] The method of obtaining real-time permissions includes:

[0093] Obtaining real-time business events, extracting real-time roles and real-time data entities, obtaining the basic permissions of real-time roles to real-time data entities through the role permission matrix, calculating the attenuation coefficient according to the current business state and duration according to the attenuation function, that is, the attenuation function value, and calculating the real-time permissions according to the basic permissions and the attenuation coefficient. For example, real-time permissions , wherein, is the basic permission; is the attenuation coefficient;

[0094] The above method automatically extracts real-time roles and real-time data entities by obtaining real-time business events, quickly obtains the basic permissions of real-time roles to real-time data entities based on the role permission matrix, automatically calculates the attenuation coefficient in combination with the current business state duration and the attenuation function, and finally calculates the real-time permissions in real time by the system. The above method is automatically executed by the system according to real-time business data and preset rules throughout the process, without the need for administrators to manually query basic permissions, calculate attenuation ranges, or input real-time permission values, avoiding the lag of relying on manual processing of permission updates after the occurrence of business events, ensuring that permissions can be adjusted in real time as the business state changes, thereby effectively solving the problem of response delay caused by the dependence of permission update on administrator operation in the traditional way.

[0095] A directed graph between modules is established, a data bloodline map is obtained, and the inheritance permissions corresponding to each data entity are analyzed according to the real-time permissions; the real-time permissions are updated in combination with the inheritance permissions to obtain linkage weights;

[0096] The method of obtaining a data bloodline map includes:

[0097] Obtaining module nodes and data entities as nodes of a directed graph;

[0098] The direction of the directed edge is determined according to the influence relationship: if the business state change of module A directly leads to the adjustment of the permissions or data of module B, then the directed edge from A to B is connected, such as "device management → work order management" and "shop management → business plan";

[0099] According to the correlation degree of the inter-module business correlation, the weight of each directed edge is analyzed and obtained;

[0100] The nodes of the directed graph and the weights of the directed edges are integrated into a graph to obtain a directed graph, and the data bloodline graph is obtained by summarizing.

[0101] The above method takes the module nodes and data entities as nodes, determines the direction of the directed edges according to the influence relationship between the modules, analyzes the correlation degree to obtain the edge weight, and finally summarizes the graph to clearly present the influence path and correlation strength between the modules. When a certain module changes in business state, the system does not need to rely on the administrator to manually determine which modules need to be synchronized to adjust the permissions, but can directly locate the associated modules, identify the influence direction and strength according to the graph, provide a clear path basis for the automatic linkage of cross-module permissions, and avoid the lag of manual correlation relationship analysis, thereby solving the problem of response delay caused by the dependence of permission changes on administrator operations in the traditional way, and realizing the automation and precision of permission linkage.

[0102] The method for obtaining the weight of the directed edge includes:

[0103] Based on three indexes of business dependence degree, data interaction frequency and influence range, the directed edge is quantitatively scored to obtain a basic weight;

[0104] The method for obtaining the basic weight includes:

[0105] Obtain the field list of Vi and Vj, where Vi and Vj are different module nodes in the directed graph between the modules; filter the fields obtained by Vj from Vi, count the number of fields obtained by Vj from Vi, and count the total number of fields of Vj to calculate the data dependence degree; such as data dependence degree , wherein, is the number of fields obtained by Vj from Vi; is the total number of fields of Vj;

[0106] Obtain the interaction data of Vi and Vj in the last E months, and calculate the average monthly interaction frequency; such as average monthly interaction frequency , wherein, is the total number of interactions between Vi and Vj in the last E months; is the number of months;

[0107] Extract the average monthly total interaction frequency of all modules of the platform in the same period; calculate the interaction tightness according to the average monthly interaction frequency and the average monthly total interaction frequency; such as interaction tightness , wherein, is the average monthly total interaction frequency of all modules of the platform in the same period;

[0108] obtain a function list of Vj and a total number of corresponding functions, simulate the number of functions that cannot be used in Vj when Vi is unavailable, and calculate a function influence degree according to the total number of functions and the number of functions that cannot be used in Vj when Vi is unavailable; if the function influence degree is greater than a preset threshold, the function influence degree is set to the preset threshold; otherwise, the function influence degree is retained wherein, is the number of functions that cannot be used in Vj when Vi is unavailable; is the total number of functions of Vj;

[0109] obtain a basic weight according to the data dependence degree, the interaction closeness degree and the function influence degree; the weighted weight can be obtained based on a natural heuristic optimization algorithm; if the basic weight is greater than a preset threshold, the basic weight is set to the preset threshold; otherwise, the basic weight is retained wherein, , and is a weighting coefficient, which can be obtained by a natural heuristic optimization algorithm;

[0110] obtain the actual interaction times of Vi and Vj in the last H days and the average interaction times in the last R months, and calculate a real-time correlation strength factor; if the real-time correlation strength factor is greater than a preset threshold, the real-time correlation strength factor is set to the preset threshold; otherwise, the real-time correlation strength factor is retained wherein, is the actual interaction times of Vi and Vj in the last H days; is the average interaction times of Vi and Vj in the last R months; is the number of days;

[0111] obtain the number of times of non-conflict and the total number of times of permission linkage adjustment of Vi to Vj in the last U months, and calculate a linkage accuracy rate; if the linkage accuracy rate is greater than a preset threshold, the linkage accuracy rate is set to the preset threshold; otherwise, the linkage accuracy rate is retained wherein, is the number of times of non-conflict of Vi to Vj in the last U months; is the total number of times of permission linkage of Vi to Vj in the last U months; calculate a historical linkage effect correction factor according to the linkage accuracy rate; if the historical linkage effect correction factor is greater than a preset threshold, the historical linkage effect correction factor is set to the preset threshold; otherwise, the historical linkage effect correction factor is retained

[0112] calculate a weight of the directed edge in combination with the real-time correlation strength factor, the historical linkage effect correction factor and the basic weight. If the weight of the directed edge is greater than a preset threshold, the weight of the directed edge is set to the preset threshold; otherwise, the weight of the directed edge is retained

[0113] ​​The above method quantitatively calculates the basic weight by data dependence, interactive closeness and function influence, dynamically adjusts by combining the real-time interaction intensity in the last H days and the linkage accuracy correction factor in the last U months, and automatically completes the weight calculation based on business data throughout the process without manual assignment or periodic update by administrators. The quantification of the correlation strength between modules not only fits the historical business rules, but also can adapt to the current interaction intensity and linkage effect in real time. When the system performs cross-module permission linkage, it can directly transmit the permission influence according to the automatically calculated weight, avoiding the weight lag or deviation caused by manual setting of the correlation strength in the traditional way, thereby reducing the dependence of permission linkage on manual operation, solving the problem of response delay caused by manual intervention in permission adjustment, and realizing the automatic and dynamic quantification of the correlation strength between modules, which provides a reliable basis for the rapid and accurate linkage of cross-module permissions.

[0114] The method for obtaining the inherited permissions corresponding to each data entity comprises:

[0115] Obtaining the real-time permissions corresponding to each data entity and the weights of the directed edges inherited from N source entities;

[0116] When N = 1, the inherited permissions are obtained based on the real-time permissions and the weights of the corresponding directed edges; for example, the inherited permissions are , wherein, is the real-time permission; is the weight of the corresponding directed edge;

[0117] When N > 1, the weights of the directed edges inherited from N source entities are obtained by weighted fusion to obtain a fusion weight, and the fusion weight is taken as the inherited permissions, wherein the weighted weight can be obtained by natural heuristic optimization algorithm. For example, the inherited permissions are ; wherein, is the weighted weight of the first directed edge, which can be obtained by natural heuristic optimization algorithm; is the weight of the first directed edge; is the weight of the second directed edge;

[0118] ​The method automatically obtains real-time permissions of a data entity and directed edge weights inherited from N source entities, directly calculates inherited permissions based on real-time permissions and corresponding edge weights when N=1, obtains inherited permissions by weighted fusion of edge weights of multiple source entities when N>1, and automatically completes calculation of inherited permissions by the system according to preset rules and algorithms throughout the process, without manual processing of permission inheritance logic of a single or multiple source entities by an administrator. The data entity can automatically and accurately inherit permissions from associated source entities, avoiding the operation complexity and hysteresis caused by manual sorting of multi-source permission inheritance relationships and calculation of inherited permissions in the traditional way, reducing the dependence of permission inheritance on manual operation, thereby solving the problem of delayed response of permission adjustment caused by manual intervention, realizing automatic and accurate calculation of permission inheritance in multiple scenarios, and providing efficient support for rapid update of data entity permissions.

[0119] obtaining real-time permissions and linkage weights, judging whether a permission conflict is generated, performing conflict arbitration if the conflict is generated, and obtaining a current permission matrix;

[0120] The method for judging whether a permission conflict is generated includes:

[0121] The permission conflict condition refers to that an absolute value of a difference between the real-time permissions and the linkage weights is greater than a preset threshold value; and the permission conflict condition can be obtained according to historical data statistics.

[0122] If the permission conflict condition is met, it is determined that the permission conflict is generated.

[0123] The method for performing conflict arbitration includes:

[0124] The minimum value and the maximum value in the real-time permissions and the linkage weights are obtained respectively, a product of the maximum value and a compliance coefficient is calculated, a compliance value is obtained, the maximum value of the minimum value and the compliance value is obtained as an arbitration permission, and the arbitration permission is used to replace the linkage weights.

[0125] After the real-time permissions and the linkage weights are obtained, whether a difference between the real-time permissions and the linkage weights exceeds a range to identify a permission conflict is automatically judged by a preset threshold value, if the conflict is generated, the maximum and minimum values of the real-time permissions and the linkage weights are automatically taken, an arbitration permission is calculated by combining a compliance coefficient and is used to replace the linkage weights to obtain a current permission matrix, and the conflict detection and arbitration are automatically completed by the system according to preset rules throughout the process, without manual comparison of permission values, determination of conflicts or adjustment of permissions by an administrator. The above method avoids permission adjustment hysteresis caused by manual intervention of conflict processing in the traditional way, enables the system to respond and automatically reconcile in real time when a permission conflict occurs, reduces the dependence of permission matrix update on manual operation, thereby solving the problem of delayed response of permission adjustment caused by manual processing of conflicts, ensuring real-time and consistency of the current permission matrix, and providing an automatic conflict resolution mechanism for dynamic governance of permissions.

[0126] The event to be adjusted, the current permission matrix and the data bloodline graph are taken as inputs of the sandbox simulation engine to obtain output data, including a predicted permission change matrix and a risk assessment value; and the current permission matrix is adjusted according to the output data.

[0127] The method for obtaining the predicted permission change matrix and the risk assessment value comprises:

[0128] The event to be adjusted, the current permission matrix and the data bloodline graph are taken as inputs of the data analysis model to obtain a structured signal.

[0129] The structured signal and a decay function are taken as inputs of the permission transmission model to obtain a transmitted permission set.

[0130] The transmitted permission set and a preset business constraint are taken as inputs of the risk assessment model to obtain a risk assessment result.

[0131] The transmitted permission and the risk assessment result are integrated to obtain a predicted permission matrix and a risk assessment value.

[0132] The training method of the data analysis model comprises:

[0133] Q sets of training data are collected in advance, and the training data comprise the event to be adjusted, the current permission matrix, the data bloodline graph and the structured signal.

[0134] The event to be adjusted, the current permission matrix and the data bloodline graph are taken as inputs of the data analysis model, and the structured signal is taken as the output of the data analysis model, so as to minimize the error between the output structured signal and the actual structured signal, and the network parameters of the data analysis model are optimized through a natural heuristic optimization algorithm to obtain the network parameters corresponding to the minimum error between the output structured signal and the actual structured signal, and the data analysis model constructed by the corresponding network parameters is taken as the trained data analysis model.

[0135] The training methods of the permission transmission model and the risk assessment model are similar to the training method of the data analysis model, and only the inputs and outputs are different.

[0136] The above method automatically generates a structured signal by inputting the event to be adjusted, the current permission matrix and the data bloodline map into the data analysis model, and then obtains the conducted permission set through the permission conduction model combined with the attenuation function. Finally, the output results of the risk assessment model are integrated into the prediction matrix, report and evaluation value. The whole process is automatically completed by the system from input to result generation based on business data and preset models, without the need for administrators to manually simulate permission changes, analyze the impact range or assess risks. This process allows the system to predict possible permission changes, scope of impact and risk levels in advance before the actual adjustment of permissions, enabling administrators to plan adjustment strategies in advance based on the prediction results, avoiding the lag caused by relying on manual analysis of the impact and risks after permission adjustment, reducing the dependence on manual real-time operations for permission adjustment, and thus solving the problem of delayed response to permission adjustment caused by manual intervention, providing a pre-judgment and decision basis for precise and timely adjustment of permissions.

[0137] The method for adjusting the current permission matrix according to the predicted permission change matrix includes:

[0138] Comparing the predicted permission change matrix with the current permission matrix, if the predicted permission value is lower than the preset minimum permission for core operations, return the optimized attenuation function or edge weight;

[0139] Based on the directed edges in the data bloodline map, check whether the permission inheritance in the prediction matrix conforms to the preset edge weight inheritance rule: if it conforms, pass; if it does not conform, determine it as an inheritance anomaly and return the modified edge weight;

[0140] Separately verify whether the predicted permission change value corresponding to the preset sensitive roles (such as the legal supervision department) and the preset sensitive data (such as the rent details and tenant contracts) is within the preset sensitive threshold interval. If it is, pass; otherwise, return the adjusted corresponding permission value.

[0141] The above method automatically compares the prediction matrix with the current matrix to check whether the core operation permission meets the standard, checks whether the permission inheritance conforms to the edge weight rule based on the data bloodline map, and separately verifies whether the permissions of sensitive roles and data conform to the threshold. For items that do not meet the standard, the system automatically returns the optimized attenuation function, modified edge weight or adjusted sensitive permission value. The whole process is automatically completed by the system based on preset standards for verification and problem positioning, without the need for administrators to manually check permission deviations, inheritance anomalies or sensitive permission risks. This process automatically triggers the verification and optimization before permission adjustment, avoiding the operation lag caused by relying on administrators to manually check and adjust permissions in the traditional way, reducing the dependence on manual intervention for permission matrix updates, and thus solving the problem of delayed response to permission adjustment caused by manual intervention, ensuring that the adjustment of the current permission matrix is accurate and meets business needs, and quickly responds to problems in the prediction results, achieving an automatic verification and optimization closed loop for permission adjustment.

[0142] The method for adjusting the current permission matrix according to the risk assessment value comprises:

[0143] The risk level is determined according to the risk assessment value, and the corresponding permission adjustment operation is performed according to the risk level; the risk level comprises low risk, medium risk and high risk;

[0144] When the risk level is low risk, the permission value in the predicted permission change matrix is synchronized to the three-dimensional permission matrix of the production environment, and the original permission is covered;

[0145] When the risk level is medium risk, the root cause is investigated, and the permission is adjusted according to the investigation result;

[0146] The method for investigating the root cause comprises:

[0147] If the permission value of the preset core operation is not lower than the minimum permission, but the permission value of other operations is less than the demand threshold, the decay period is adjusted, and the current permission matrix is regenerated;

[0148] The conflict rate is counted, and if it is determined that the conflict rate is within the preset conflict rate range, the basic weight of the link with conflict is recalculated, and the current permission matrix is updated and generated;

[0149] If the permission value of the preset sensitive data is within the exposure range, the decay period is adjusted, the decay function is updated, and the current permission matrix is regenerated.

[0150] When the risk level is high risk, the current permission matrix is maintained unchanged, the predicted permission change matrix is investigated for the root cause, and the rules are optimized according to the root cause investigation result and then simulated again.

[0151] The above method divides the risk level into low, medium and high, and drives the corresponding automatic operation. When the risk level is low, the predicted permission is directly synchronized to the production environment. When the risk level is medium, the problems such as insufficient permission of non-core operation, excessive conflict rate or exposure of sensitive data are automatically investigated, and the rules such as decay period and basic weight are adjusted. When the risk level is high, the current situation is maintained, and the root cause is automatically investigated and simulated again. The whole process is automatically completed by the system according to the risk level and the preset logic to make decisions and execute the permission adjustment. It is not necessary for the administrator to manually judge the risk level, formulate adjustment strategies or operate permission update. This process enables the permission adjustment to accurately adapt to different processing schemes according to the risk level, avoids the operation lag caused by relying on manual risk assessment and planning adjustment steps in the traditional way, reduces the dependence on manual intervention for permission matrix update, solves the problem of slow response of permission adjustment caused by manual operation delay, realizes the whole process automation of permission adjustment based on risk level, ensures that the permission matrix can be quickly updated when the risk level is low, and accurately optimized when the risk level is medium or high, and guarantees the efficiency and reliability of the permission adjustment.

[0152] Embodiment 2

[0153] Referring to Figure 3 As shown in the figure, the embodiment provides a rule self-evolution method applied to Embodiment 1, including the following steps:

[0154] Parameterize the core rule parameters as the action space of the RL agent; the core rule parameters can be customized by the user, such as the decay period, the edge weight basic coefficient, and the arbitration compliance times, etc.

[0155] Statistical core operation success rate and sensitive data exposure rate, and design a reward function according to the core operation success rate and the sensitive data exposure rate; when the core operation success rate is not lower than the preset success threshold and there is no sensitive data exposure after the permission adjustment, a positive reward is given; otherwise, a penalty is given. Design the reward function with the effectiveness and security of the permission as the goal, and preset the time interval, such as one hour, and the agent updates the strategy based on the latest business data every hour, and dynamically adjusts the core rule parameters.

[0156] Parameterize the core rule parameters as the action space of the RL agent, design a reward function combining the core operation success rate and the sensitive data exposure rate, and let the agent dynamically update the strategy based on the latest business data every hour to adjust the parameters. This process makes the optimization of the permission rules completely automatic by the system according to the business feedback, without the need for the administrator to manually modify the core parameters or regularly adjust the rules. The agent can adapt to the dynamic changes of the business by continuously learning the rules in the business data, and can optimize the rule parameters in real time to balance the effectiveness and security of the permission, avoiding the parameter lag or insufficient adaptation caused by the manual adjustment of the rules in the traditional way, thereby reducing the dependence of the optimization of the permission rules on manual operation, solving the problem of delay in rule adjustment caused by manual intervention, realizing the self-evolution and dynamic adaptation of the core rules of the permission, and ensuring that the rules always keep synchronized with the business needs.

[0157] Embodiment 3

[0158] Referring to Figure 4 As shown in the figure, the embodiment provides a cross-module permission intelligent configuration system based on a role permission matrix, including:

[0159] Basic building module: obtain user roles, data entities, and business states, and construct a three-dimensional permission matrix; and assign values according to the preset user permissions to obtain a role permission matrix;

[0160] Permission decay module: configure a decay function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions according to the decay function;

[0161] The permission linkage module: a directed graph between modules is established, a data bloodline graph is obtained, and the inheritance permission corresponding to each data entity is obtained according to real-time permission analysis; the real-time permission is updated in combination with the inheritance permission to obtain a linkage weight;

[0162] The conflict arbitration module: the real-time permission and the linkage weight are obtained, whether a permission conflict is generated is judged, if a conflict is generated, conflict arbitration is performed, and a current permission matrix is obtained;

[0163] The permission adjustment module: taking the event to be adjusted, the current permission matrix and the data bloodline graph as inputs of a sandbox simulation engine, output data including a predicted permission change matrix and a risk assessment value are obtained; and the current permission matrix is adjusted according to the output data.

[0164] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0165] Finally: the above is only a preferred embodiment of the present application and is not used to limit the present application, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A cross-module permission intelligent configuration method based on a role permission matrix, characterized in that, The method comprises the following steps: Obtain user roles, data entities and business states, and build a three-dimensional permission matrix; According to the preset user permissions, the role permission matrix is obtained by assigning values; Configure a decay function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions according to the decay function; The method for configuring the decay function comprises: Obtain a current service state duration, and construct an attenuation function according to a preset attenuation period wherein, is a mathematical constant; is an attenuation coefficient; is a duration of the current service state; is the preset attenuation period; The method for obtaining real-time permissions comprises: The real-time service event is acquired, real-time roles and real-time data entities are extracted, basic permissions of the real-time roles on the real-time data entities are acquired through a role permission matrix, an attenuation coefficient is calculated according to a current service state and a duration according to an attenuation function, and real-time permissions are calculated according to the basic permissions and the attenuation coefficient wherein, is the basic permission; is the attenuation coefficient; Establish a directed graph between modules, obtain a data bloodline graph, and analyze the inheritance permissions corresponding to each data entity according to the real-time permissions; Update the real-time permissions by combining the inheritance permissions to obtain a linkage weight; Obtain the real-time permissions and the linkage weight, and judge whether a permission conflict occurs; if a permission conflict occurs, perform conflict arbitration to obtain a current permission matrix; The method for judging whether a permission conflict occurs comprises: The permission conflict condition is that the absolute value of the difference between the real-time permissions and the linkage weight is greater than a preset threshold value; If the permission conflict condition is met, it is determined that a permission conflict occurs; The method for performing conflict arbitration comprises: Obtain the minimum value and the maximum value in the real-time permissions and the linkage weight respectively, calculate the product of the maximum value and a compliance coefficient to obtain a compliance value, obtain the maximum value between the minimum value and the compliance value as an arbitration permission, and replace the linkage weight with the arbitration permission; Take the event to be adjusted, the current permission matrix and the data bloodline graph as inputs of a sandbox simulation engine, obtain output data including a predicted permission change matrix and a risk assessment value, and adjust the current permission matrix according to the output data; The method for adjusting the current permission matrix according to the predicted permission change matrix comprises: Compare the predicted permission change matrix with the current permission matrix; if the predicted permission value is lower than a preset minimum permission of a core operation, return to optimize the decay function or the edge weight; Check whether the permission inheritance in the predicted matrix conforms to a preset edge weight inheritance rule based on the directed edges in the data bloodline graph; if the permission inheritance conforms to the preset edge weight inheritance rule, pass; if the permission inheritance does not conform to the preset edge weight inheritance rule, determine that the permission inheritance is abnormal, and return to modify the edge weight; Individually verify whether the predicted permission change value corresponding to a preset sensitive role and a preset sensitive data is within a preset sensitive threshold interval; if yes, pass; otherwise, return to adjust the corresponding permission value; The method for adjusting the current permission matrix according to the risk assessment value comprises: Determine a risk level according to the risk assessment value, and perform a corresponding permission adjustment operation according to the risk level; the risk level comprises low risk, medium risk and high risk; When the risk level is low risk, the permission value in the predicted permission change matrix is synchronized to the three-dimensional permission matrix in the production environment to cover the original permission; When the risk level is medium risk, perform root cause analysis on non-core operations, and adjust the permissions according to the analysis result; When the risk level is high risk, the current permission matrix remains unchanged, the predicted permission change matrix is subjected to root cause analysis, and the predicted permission change matrix is simulated again after optimization according to the root cause analysis result.

2. The role-based permission matrix cross-module permission intelligent configuration method according to claim 1, characterized in that, The method for obtaining the three-dimensional permission matrix comprises: According to the posts and responsibilities of platform users, the users are divided into different role categories, and an inheritance relationship between the roles is established; Define data entities in the project, and define key attributes for each data entity; Define the business states corresponding to each data entity, and define the legal transfer paths between the states; Crossing the three dimensions of roles, data entities and business states, each intersection point corresponds to a permission value, and a three-dimensional permission matrix is obtained; The real-time business event includes a state change event, a time trigger event and an operation event.

3. The role-based permission matrix cross-module permission intelligent configuration method according to claim 1, characterized in that, The method for obtaining a data bloodline graph includes: Obtaining module nodes and data entities as nodes of a directed graph; Determining the direction of a directed edge according to an influence relationship; Analyzing and obtaining the weight of each directed edge according to the correlation degree of the inter-module business correlation; Integrating the nodes of the directed graph and the weight of the directed edge into a graph to obtain a directed graph and summarize a data bloodline graph.

4. The role-based permission matrix cross-module permission intelligent configuration method according to claim 3, characterized in that, The method for obtaining the weight of a directed edge includes: Quantitatively scoring the directed edge based on three indexes of business dependency degree, data interaction frequency and influence range to obtain a basic weight; Obtaining the actual interaction frequency of Vi and Vj in the last H days and the average interaction frequency in the last R months to calculate a real-time correlation strength factor; Vi and Vj are different module nodes in the inter-module directed graph; Obtaining the number of times of non-conflict after the permission linkage adjustment of Vi to Vj in the last U months and the total number of permission linkages, calculating a linkage accuracy rate, and calculating a historical linkage effect correction factor according to the linkage accuracy rate; Combining the real-time correlation strength factor, the historical linkage effect correction factor and the basic weight to calculate the weight of the directed edge.

5. The role-based permission matrix-based cross-module permission intelligent configuration method according to claim 4, characterized in that, The method for obtaining the basic weight includes: Obtaining the field list of Vi and Vj, filtering the fields obtained by Vj from Vi, counting the number of fields obtained by Vj from Vi, and counting the total number of fields of Vj to calculate a data dependency degree; Obtaining the interaction data of Vi and Vj in the last E months to calculate a monthly average interaction frequency; Extracting the monthly average total interaction frequency of all modules of the platform in the same period; calculating an interaction tightness according to the monthly average interaction frequency and the monthly average total interaction frequency; Obtaining the function list of Vj and the corresponding total number of functions, simulating the case that Vi is unavailable, and counting the number of functions that cannot be used in Vj; calculating a function impact degree according to the total number of functions and the number of functions that cannot be used in Vj when Vi is unavailable; Weighting the data dependency degree, the interaction tightness and the function impact degree to obtain the basic weight.

6. The role-based permission matrix-based cross-module permission intelligent configuration method according to claim 1, characterized in that, The method for obtaining the inherited permission corresponding to each data entity includes: Obtaining the real-time permission corresponding to each data entity and the weight of the directed edge inherited from N source entities; When N = 1, the inherited permission is calculated based on the real-time permission and the weight of the corresponding directed edge; When N > 1, the weight of the directed edge inherited from N source entities is obtained by weighted fusion to obtain a fusion weight, and the fusion weight is taken as the inherited permission.

7. The role-based permission matrix-based cross-module permission intelligent configuration method according to claim 1, characterized in that, The method for obtaining the predicted permission change matrix and the risk assessment value includes: Taking the event to be adjusted, the current permission matrix and the data bloodline graph as inputs of a data analysis model to obtain a structured signal; Taking the structured signal and a decay function as inputs of a permission transmission model to obtain a transmitted permission set; Taking the transmitted permission set and a preset business constraint as inputs of a risk assessment model to obtain a risk assessment result; Integrating the transmitted permission and the risk assessment result to obtain the predicted permission change matrix and the risk assessment value.

8. The role-based permission matrix cross-module permission intelligent configuration method according to claim 1, characterized in that, The method for root cause analysis includes: If the permission value of the preset core operation is not lower than the minimum permission, but the permission value of other operations is less than the demand threshold, the decay period is adjusted, and the current permission matrix is regenerated; Statistical conflict rate, if the conflict rate is within the preset conflict rate range, the basic weight of the link with conflict is recalculated, and the current permission matrix is updated; If the permission value of the preset sensitive data is within the exposure range, the decay period is adjusted, the decay function is updated, and the current permission matrix is regenerated.

9. A cross-module intelligent permission configuration system based on a role-based permission matrix, implementing the cross-module intelligent permission configuration method based on a role-based permission matrix as described in any one of claims 1-8, characterized in that, It includes: Basic building module: obtain user roles, data entities and business status, and build a three-dimensional permission matrix; And according to the preset user permission, the role permission matrix is obtained by assigning values; Permission decay module: configure decay function for each data entity in the three-dimensional permission matrix, obtain real-time business events, and calculate real-time permissions according to the decay function; Permission linkage module: establish a directed graph between modules, obtain a data bloodline map, and obtain the inheritance permissions corresponding to each data entity according to real-time permissions; Update the real-time permissions combined with the inheritance permissions to obtain the linkage weight; Conflict arbitration module: obtain real-time permissions and linkage weight, judge whether there is a permission conflict, if there is, perform conflict arbitration, and obtain the current permission matrix; Permission adjustment module: take the event to be adjusted, the current permission matrix and the data bloodline map as the input of the sandbox simulation engine, obtain the output data, including the predicted permission change matrix and the risk assessment value; adjust the current permission matrix according to the output data.

Images