Remote office-based permission determination method and device

Abstract

The invention discloses a remote office-based permission determination method and device, relates to the technical field of information management, and mainly aims to reduce business operation risks caused by forced disconnection of connection. According to the main technical scheme, the method comprises the following steps: receiving a remote access request sent by a user account through remote login equipment; after the remote access request passes verification, an operation target declaration prompt is initiated to the remote login device, so that a user fills in an operation target; obtaining a pre-operation behavior list and an operation keyword list of the user account in the target business system according to the operation target; and according to the pre-operation behavior list, the operation keyword list, the post information corresponding to the user account and a preset high-risk operation rule, determining a remote operation authority of the user account in the target service system, so that the user account executes an operation corresponding to the remote operation authority in the target service system.

Description

Technical Field

[0001] This invention relates to the field of information management technology, and in particular to a method and apparatus for determining permissions based on remote work. Background Technology

[0002] In remote work scenarios, user identity is typically verified. Once verified, the user is granted permission to remotely log in to the enterprise's business systems. After access, the system continuously monitors for high-risk actions, such as exceeding access limits for sensitive files or executing unauthorized scripts. Upon detecting such behavior, a remote connection circuit breaker is immediately triggered, forcibly severing the user's interaction with the enterprise's business systems.

[0003] However, in practice, some operations, while formally triggering risk rules, have clear business necessity and rationale. For example, auditors frequently need to access critical documents for work purposes, or technical personnel execute temporary high-authority instructions during emergency troubleshooting. In such cases, a rigid circuit breaker mechanism not only fails to effectively distinguish between genuine risks and reasonable operations, but may also lead to critical business interruptions, delays in handling emergency matters, and even serious business losses. Summary of the Invention

[0004] In view of the above problems, the present invention provides a method and apparatus for determining permissions based on remote work, the main purpose of which is to reduce the business operation risks caused by forced disconnection.

[0005] To solve the above-mentioned technical problems, the present invention proposes the following solution:

[0006] In a first aspect, the present invention provides a method for determining permissions based on remote work, the method comprising:

[0007] Receive remote access requests sent by user accounts through remote login devices;

[0008] After the remote access request is verified, an operation target declaration prompt is sent to the remote login device so that the user can fill in the operation target on the remote login device according to the user account.

[0009] Based on the stated operational objective, obtain a list of pre-operation behaviors and a list of operational keywords for the user account in the target business system;

[0010] Based on the pre-operation behavior list, the operation keyword list, the job information corresponding to the user account, and the preset high-risk operation rules, the remote operation permissions of the user account in the target business system are determined so that the user account can perform operations corresponding to the remote operation permissions in the target business system.

[0011] Secondly, the present invention provides a permission determination device based on remote office work, the device comprising:

[0012] The access request unit is used to receive remote access requests sent by user accounts through remote login devices;

[0013] The prompt sending unit is used to send an operation target declaration prompt to the remote login device after the remote access request obtained by the request access unit has been verified, so that the user can fill in the operation target on the remote login device according to the user account;

[0014] The operation parsing unit is used to obtain a list of pre-operation behaviors and a list of operation keywords of the user account in the target business system based on the operation target obtained by the prompt sending unit;

[0015] The permission determination unit is used to determine the remote operation permissions of a user account in the target business system based on the pre-operation behavior list, the operation keyword list, the job information corresponding to the user account, and the preset high-risk operation rules obtained by the operation parsing unit, so that the user account can perform the operation corresponding to the remote operation permission in the target business system.

[0016] To achieve the above objectives, according to a third aspect of the present invention, a storage medium is provided, the storage medium including a stored program, wherein, when the program is executed, the device where the storage medium is located is controlled to execute the remote office-based permission determination method of the first aspect.

[0017] To achieve the above objectives, according to a fourth aspect of the present invention, a processor is provided for running a program, wherein the program executes the remote work-based permission determination method of the first aspect described above.

[0018] By employing the above technical solution, this invention provides a method and apparatus for determining permissions based on remote work. It first receives a remote access request sent by a user account through a remote login device. After verifying the remote access request, it sends an operation target declaration prompt to the remote login device, allowing the user to fill in the operation target based on their account on that device. This design achieves pre-collection of user operation intentions, enabling the acquisition of specific business purposes before operation execution, thereby determining permissions and effectively avoiding accidental triggering of high-risk rules and connection termination due to unclear operation intentions, thus improving the stability and security of remote work. Subsequently, based on the operation target filled in by the user, a list of pre-operation behaviors and a list of operation keywords for the user account in the target business system are generated. Finally, based on the list of pre-operation behaviors and the list of operation keywords, combined with the job information corresponding to the user account and preset high-risk operation rules, the remote operation permissions of the user in the target business system are comprehensively evaluated and determined, allowing the user to execute operations matching the authorized permissions. This step achieves permission decision-making by integrating operation intentions (pre-operation behaviors, operation keywords), user identity attributes (job information), and security policies (high-risk operation rules) for multi-dimensional judgment. Compared to the rigid "action-triggered circuit breaker" control mechanism of traditional technologies, this invention moves the permission determination step forward, from "during operation execution" to "after operation intent declaration and before operation execution." This mechanism determines the appropriate permissions by integrating operation intent (such as pre-operation behavior, operation keywords), user identity attributes (such as job information), and security policies (such as high-risk operation rules). This shift fundamentally avoids the risk exposure caused by excessive permission granting, effectively prevents critical business shutdowns due to forced connection interruptions, and significantly reduces business operation risks.

[0019] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0020] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0021] Figure 1 A flowchart of a permission determination method based on remote office work provided by an embodiment of the present invention is shown;

[0022] Figure 2 A flowchart of another permission determination method based on remote office provided by an embodiment of the present invention is shown;

[0023] Figure 3 This diagram illustrates a block diagram of a remote office-based access control device according to an embodiment of the present invention.

[0024] Figure 4 This invention provides a block diagram of another permission determination device based on remote work, according to an embodiment of the present invention. Detailed Implementation

[0025] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0026] To address the shortcomings of rigid circuit breaker mechanisms in existing technologies, current remedial solutions mostly focus on re-verification or connection restoration after a circuit breaker has occurred. However, these methods essentially still presuppose that a circuit breaker has already occurred, failing to fundamentally prevent interruptions. In remote work scenarios, if users have not saved critical operational data, once the connection is forcibly cut off, even if access is subsequently restored through verification, the operations still need to be re-executed. This not only results in lost work progress but may also cause delays that could lead to missing the optimal processing opportunity, impacting business continuity.

[0027] Therefore, this invention does not perform partial optimizations or post-event remedies on the traditional circuit breaker mechanism. Instead, it proposes a completely new technical approach: taking the user's operational purpose as the starting point, it proactively avoids the false triggering of high-risk rules by recognizing intent and predicting permissions before the operation is executed, thereby preventing circuit breakers from occurring at the source. This solution breaks away from the traditional "trigger-is-block" technical path, reconstructing the permission control logic from the perspective of pre-emptive recognition of operational intent. It demonstrates a high degree of technical creativity and is an innovative achievement obtained through in-depth research and a great deal of creative work.

[0028] The remote office-based permission determination method described in this invention can be executed by either the target business system or a monitoring system or dedicated security gateway deployed in the enterprise's local environment. The target business system is a specific business system within the enterprise, such as ERP, CRM, financial systems, or R&D platforms.

[0029] Next, combine Figure 1 This invention provides a method for determining permissions based on remote work, and its specific execution steps are as follows: Figure 1 As shown, this includes steps 101-104.

[0030] 101. Receive remote access requests sent by user accounts through remote login devices.

[0031] 102. After the remote access request is verified, a prompt for operation target declaration is sent to the remote login device so that the user can fill in the operation target on the remote login device according to the user account.

[0032] 103. Based on the operational objectives, obtain a list of pre-operation behaviors and a list of operation keywords for the user account in the target business system.

[0033] In an enterprise environment, some employees need to remotely access target business systems deployed on the intranet due to business trips or special personal circumstances. Since the target business systems are usually located on the enterprise's internal network, mobile terminals on the external network cannot directly access them. Therefore, users can initiate a remote access request to the intranet terminal through a remote login device to achieve indirect access.

[0034] The remote access request may include: the user account identifier used by the user (such as username or employee number), the device information of the remote login device (such as device identifier and IP address), the identification information of the target business system, and the current network environment information (such as the access network type).

[0035] Upon receiving a remote access request, the system first verifies the access legitimacy based on the information in the request to determine if the request is valid. Specifically, the verification process may include: determining whether the device identifier of the remote login device belongs to the enterprise's pre-registered and certified list of trusted devices, or determining whether the currently accessed network is a designated remote access network recognized by the enterprise. If at least one of the above conditions is met, the remote access request is deemed to have passed verification.

[0036] After successful verification, in step 102, an operation target declaration prompt can be sent to the remote login device, guiding the user to fill in the specific operation target for this access based on the current account on the remote login device. For example, the user can enter descriptive content such as "update customer contracts" or "export sales reports". This step is the basis for determining whether the user account has access rights to the target business system.

[0037] After the user submits the operation objective, step 103 can be executed, which is to perform semantic parsing on the operation objective, extract the key operation verbs and business objects, and generate a corresponding list of operation keywords (such as "export", "sales", "report"); at the same time, based on the natural language description or operation keywords in the operation objective, an identifiable list of pre-operation behaviors (such as deleting data) is obtained as the input basis for subsequent dynamic permission assessment. Each pre-operation behavior in the list of pre-operation behaviors has corresponding execution conditions.

[0038] It should be noted that there is a correspondence between the pre-operation behaviors in the pre-operation behavior list and the operation keywords in the operation keyword list, and each pre-operation behavior is composed of one or more operation keywords.

[0039] For example, if the user enters the operation goal as "export customer data and analyze it", the operation keywords extracted by the system may include: "export", "customer", "data" and "analysis", forming a list of operation keywords.

[0040] Based on the combination and semantic understanding of these keywords, corresponding pre-operation behaviors can be generated, such as "export customer data" or "perform data analysis", and these behaviors can be included in the list of pre-operation behaviors.

[0041] Therefore, it can be seen that operation keywords are the basic elements constituting pre-operation behavior. The two are related and together serve as the input basis for subsequent permission assessment.

[0042] 104. Based on the list of pre-operation behaviors, the list of operation keywords, the job information corresponding to the user account, and the preset high-risk operation rules, determine the remote operation permissions of the user account in the target business system so that the user account can perform operations corresponding to the remote operation permissions in the target business system.

[0043] The core of this step is that after the user declares the operation target, the system combines the generated list of pre-operation behaviors and operation keywords, as well as the job information corresponding to the user account and the preset high-risk operation rules, to comprehensively determine the scope of remote operation permissions that should be granted for this remote access, thereby realizing context-based dynamic permission control and avoiding the interference of traditional rigid circuit breaker mechanisms on normal business operations.

[0044] The pre-defined high-risk operation rules are used to define high-risk operational behaviors that enterprises focus on controlling and their corresponding eligibility conditions (i.e., triggering conditions). For example, a high-risk operation may include "deleting more than 100 customer data records", and the corresponding eligibility condition may be "the operation is performed by a regular employee at 2:00 AM".

[0045] The job information can be used to characterize the user's scope of responsibilities, and may include job title, department, functional description, etc., as a basis for judging whether the operation behavior is in line with the job responsibilities.

[0046] When determining the remote operation permissions of a user account in the target business system, a list of functional keywords can be extracted first based on the job description in the job information. This list of functional keywords can then be compared with the list of operation keywords to determine the correlation between the operation objective and the job responsibilities. At the same time, based on each pre-operation behavior in the pre-operation behavior list, the execution conditions corresponding to each pre-operation behavior, and each high-risk operation defined in the preset high-risk operation rules, the corresponding compliance conditions, and the risk value, the conflict value between each pre-operation behavior and the preset high-risk operation can be calculated.

[0047] Based on the above correlation and conflict values, the remote operation permissions of a user account in the target business system can be determined in the following two ways:

[0048] One approach is to use correlation and conflict values ​​as parallel judgment criteria, comprehensively consider the results of both, and conduct a collaborative evaluation to determine the corresponding remote operation permissions. Specifically:

[0049] When the correlation and conflict values ​​of each operation are both below their respective preset basic thresholds, remote operation permissions for the corresponding operation are not granted. If the correlation and conflict values ​​of each operation exceed the basic security threshold but do not reach the maximum threshold, some permissions related to the operation can be granted. For example, for the operation of downloading data, only viewing permissions are granted. Only when the correlation and conflict values ​​of each operation simultaneously exceed their respective preset maximum thresholds are the corresponding remote operation permissions granted directly.

[0050] Another approach is to select one indicator from the correlation or conflict value as the primary decision-making basis, and the other indicator as the secondary decision-making basis to make the permission decision and determine the final scope of permissions.

[0051] It should be noted that the above two methods can be implemented as independent parallel methods.

[0052] Based on the above Figure 1As can be seen from the implementation method, the remote office-based permission determination method provided by this invention can first receive a remote access request sent by a user account through a remote login device; after the remote access request is verified, an operation target declaration prompt is sent to the remote login device, so that the user can fill in the operation target of this operation on the device based on their account. This design realizes the pre-collection of user operation intent, which can obtain the specific business purpose before the operation is executed, and then determine the permission, effectively avoiding the accidental triggering of high-risk rules and connection circuit breakers due to unclear operation intent, thus improving the stability and security of remote office. Subsequently, based on the operation target filled in by the user, a list of pre-operation behaviors and a list of operation keywords for the user account in the target business system are generated. Finally, based on the list of pre-operation behaviors and the list of operation keywords, combined with the job information corresponding to the user account and the preset high-risk operation rules, the remote operation permissions of the user in the target business system are comprehensively evaluated and determined, thereby allowing the user to execute operations that match the authorized permissions. This step realizes permission decision-making by integrating operation intent (pre-operation behaviors, operation keywords), user identity attributes (job information), and security policies (high-risk operation rules) for multi-dimensional judgment. Compared to the rigid "action-triggered circuit breaker" control mechanism of traditional technologies, this invention moves the permission determination step forward, from "during operation execution" to "after operation intent declaration and before operation execution." This mechanism determines the appropriate permissions by integrating operation intent (such as pre-operation behavior, operation keywords), user identity attributes (such as job information), and security policies (such as high-risk operation rules). This shift fundamentally avoids the risk exposure caused by excessive permission granting, effectively prevents critical business shutdowns due to forced connection interruptions, and significantly reduces business operation risks.

[0053] Furthermore, as a response to Figure 1 Further refinement and extension of the illustrated embodiments, this invention also provides another method for determining permissions based on remote work, such as... Figure 2 As shown, the specific steps are as follows:

[0054] 201. Receive remote access requests sent by user accounts through remote login devices.

[0055] 202. After the remote access request is verified, a prompt for operation target declaration is sent to the remote login device so that the user can fill in the operation target on the remote login device according to the user account.

[0056] 203. Based on the operation objective, obtain a list of pre-operation behaviors and a list of operation keywords for the user account in the target business system.

[0057] The implementation methods of steps 201-203 are the same as those of steps 101-103, and can achieve the same technical effect and solve the same technical problem, so they will not be repeated here.

[0058] 204. Based on the list of pre-operation behaviors, the list of operation keywords, the job information corresponding to the user account, and the preset high-risk operation rules, determine the remote operation permissions of the user account in the target business system so that the user account can perform operations corresponding to the remote operation permissions in the target business system.

[0059] In this embodiment, the job function table for the user account is first retrieved from the enterprise's internal organizational structure database based on the job information corresponding to the user account. The job function table records the standardized job description (e.g., "responsible for regional customer order management, data query and preliminary report preparation"), core responsibilities (e.g., "can query basic customer data, but cannot export sensitive information"), as well as a list of allowed operation types and a list of prohibited operation types (e.g., "query, enter, and modify data created by the user").

[0060] Subsequently, based on the standardized job descriptions in the job function table, the system extracts key verbs and business objects to generate a list of functional keywords corresponding to the job. For example, keywords such as "customer," "order," and "management" are extracted from "responsible for customer order management" to form a structured expression, which facilitates subsequent comparative analysis.

[0061] Next, based on the list of operational keywords and the list of functional keywords, the relevance between the operational objective and the job information is determined. The relevance characterizes the degree of connection between the operational objective and the user's job responsibilities; a higher relevance indicates that the operation is more in line with the user's normal work scope and has higher compliance. Quantifying the matching relationship between operations and jobs through keyword matching enables a preliminary assessment of the operation's rationality, helps identify unauthorized or abnormal access behavior, and improves the refinement and intelligence of access control.

[0062] Simultaneously, based on each pre-operation behavior in the pre-operation behavior list and its corresponding execution conditions, combined with a pre-set high-risk operation rule base (containing each high-risk operation, its corresponding compliance conditions, and risk value), the system determines whether each pre-operation behavior matches a high-risk operation and calculates its conflict value. The conflict value characterizes the degree of violation between the user's pre-operation behavior and the high-risk operation; the higher the degree of violation, the less the behavior conforms to the characteristics of a high-risk operation, and the higher the security level. Through the calculation of the conflict value, the system dynamically compares the user's operational intent with the enterprise's security policy, achieving a quantitative assessment of potential risks.

[0063] Finally, based on the correlation determined above and the conflict value corresponding to each pre-operation behavior, a comprehensive judgment is made on whether to grant the corresponding permissions, ensuring that the granting of permissions is in line with job responsibilities and does not cross the security red line.

[0064] Next, the steps for "determining the relevance between operational objectives and job information based on the list of operational keywords and the list of functional keywords" will be explained:

[0065] The system can count the number of times operational keywords in the operational keyword list match within the functional keyword list, and determine the target matching rate by the ratio of this number of matches to the total number of operational keywords. At the same time, it can count the number of times functional keywords in the functional keyword list are covered within the operational keyword list, and determine the functional coverage rate by the ratio of this coverage to the total number of functional keywords.

[0066] This is done because the target matching rate reflects whether the user's declared operation is within the scope of their job responsibilities—the higher the ratio, the more likely the user's operation keywords are related to their job functions, indicating strong operational rationality. Introducing the functional coverage rate shows whether responsibilities are fully reflected in the user's operation goals, providing supplementary information from the perspective of "the scope of job responsibility coverage." Although a single user operation usually only involves part of their responsibilities, this indicator, used in conjunction with the target matching rate, can help identify whether the scope of the operation has been abnormally expanded.

[0067] In this way, by combining two indicators, we can avoid the one-sided judgment caused by only looking at "how many hits", such as getting a high score for matching only one keyword, and also prevent the situation where the core responsibilities of the job are fully covered, thus improving the comprehensiveness and rationality of the relevance assessment.

[0068] In some embodiments, since different positions have different focuses on "whether the operation is within their responsibilities" and "whether their responsibilities are fully involved," corresponding weights can be assigned to the target matching rate and the functional coverage rate respectively. For example, approval positions pay more attention to the boundaries of authority and focus on the target matching rate; comprehensive management positions may pay more attention to the completeness of the process and can appropriately increase the weight of the functional coverage rate.

[0069] Based on this, a weighted score of target matching rate and functional coverage rate can be calculated according to preset weights, and this score can be used as the first score value to adapt to the management strategy needs of different positions.

[0070] Next, it is determined whether the list of operation keywords contains any specified operation keywords that are explicitly prohibited in the job information (such as "delete all data" or "export customer contact information"). If they exist, the product of the first score and the preset penalty coefficient is used as the final relevance score; if they do not exist, the first score is used directly as the relevance score.

[0071] The design is based on the principle that even with a high overall match rate, actions containing explicitly prohibited keywords should still be considered high-risk or violations. By setting penalty coefficients (such as 0.3 or 0.5), violations are significantly downgraded, reflecting a "red line mentality" and preventing users from using a large number of compliant keywords to mask their intentions for a single high-risk action. This mechanism provides a rule-based safety net based on quantitative scoring, balancing assessment flexibility with the rigid requirements of security management.

[0072] The difference between target matching rate and functional coverage rate will now be explained:

[0073] Definition differences:

[0074] Target match rate: refers to the percentage of operational keywords that appear in the list of job-related keywords, measuring whether "the user's operation is within the scope of their responsibilities".

[0075] Functional coverage rate: This refers to how many functional keywords appear in the list of operational keywords, measuring "how much of the job responsibility is involved in the current operation".

[0076] Differences in focus:

[0077] The target matching rate is based on "compliance from the perspective of operation," focusing on whether user behavior has exceeded the boundaries, and is the main basis for judging the rationality of the operation.

[0078] Functional coverage rate is based on "the scope of coverage from the perspective of responsibilities". It focuses on the extent to which job functions are touched and is mainly used to help identify whether the scope of operations has been abnormally expanded.

[0079] Next, the implementation steps for "determining the conflict value between each pre-operation behavior and the preset high-risk operation based on each pre-operation behavior in the pre-operation behavior list, the execution conditions corresponding to each pre-operation behavior, each high-risk operation, and the compliance conditions and risk values ​​corresponding to each high-risk operation" will be explained:

[0080] Each pre-operation behavior can be compared with each high-risk operation item by item. If they match, a first matching score is generated, which is the risk value of the corresponding high-risk operation at a first preset ratio. If they do not match, the first matching score is 0.

[0081] At the same time, the execution conditions corresponding to each pre-operation behavior are compared with the compliance conditions corresponding to each high-risk operation. If they match, a second matching score is generated, which is the risk value of the corresponding high-risk operation under the second preset ratio; if they do not match, the second matching score is 0.

[0082] In some embodiments, the second preset ratio is less than the first preset ratio. For example, the second preset ratio may be 0.3, and the first preset ratio may be 0.7.

[0083] The similarity between user pre-operation behavior and high-risk operation is assessed hierarchically through two dimensions: operation behavior matching and execution condition matching. Operation behavior matching determines the sensitivity of the behavior itself, reflecting whether the operation is high-risk, and is the core basis for risk assessment, thus receiving a high weight (e.g., 0.7). Execution condition matching identifies whether the context in which the behavior occurred is abnormal. While it can serve as a risk warning, it is insufficient to constitute a high-risk conclusion on its own, therefore receiving a relatively low weight (e.g., 0.3). By setting different weight ratios, the assessment logic of "behavior as the primary cause, condition as a secondary cause" is reflected, effectively avoiding misjudgments triggered by a single condition (such as abnormal execution time), and improving the accuracy and rationality of risk identification.

[0084] Subsequently, for each pre-operation behavior, the sum of its first matching score and second matching score with each high-risk operation is calculated, which serves as the first intermediate conflict value between the pre-operation behavior and each high-risk operation.

[0085] Furthermore, for each pre-operation behavior, the first intermediate conflict value corresponding to it and multiple high-risk operations are accumulated to obtain the conflict value between the pre-operation behavior and the preset high-risk operations.

[0086] By adding the first matching score (behavioral matching) to the second matching score (conditional matching), a first intermediate conflict value is formed, which can comprehensively reflect the degree of similarity between a certain pre-operation behavior and a single high-risk operation in both the "behavior itself" and "execution conditions" dimensions, thus avoiding the omission of any risk factor.

[0087] Since a pre-operation behavior may be close to multiple high-risk operations at the same time (for example, "exporting data" is similar to both "batch export" and "access during non-working hours"), by accumulating multiple first intermediate conflict values, the overall risk level of the behavior can be fully captured, preventing the risk from being underestimated due to matching only the most similar one.

[0088] Finally, the steps of "determining the remote operation permissions of the user account in the target business system based on the correlation degree and the conflict value corresponding to each pre-operation behavior" are explained:

[0089] The system retrieves pre-defined relevance thresholds, a first conflict safety threshold, and a second conflict safety threshold. When the relevance is greater than or equal to the relevance threshold, it indicates that the operational objective is sufficiently relevant to the job responsibilities. The system then grants the operational permissions for the first target pre-operation behavior in the pre-operation behavior list whose conflict value is greater than or equal to the second conflict safety threshold. For example, the system automatically opens the corresponding function entry for this operation, allowing the user to execute it directly without any additional confirmation. For instance, after a user clicks the "Query Customer Orders" button, the system immediately returns the data results without popping up a verification window or remaining in a pending state.

[0090] Simultaneously, for the second target pre-operation behavior in the pre-operation behavior list whose conflict value is greater than or equal to the first conflict security threshold and less than the second conflict security threshold, the system sends a verification prompt to the remote login device. After the user account completes the verification according to the prompt and the verification is successful, the corresponding operation permission is granted. This can manifest as the system displaying an identity verification prompt when the user initiates an operation, requiring the user to enter an SMS verification code or use a dynamic password tool to complete the authentication; after successful authentication, the system executes the operation and returns the result. For example, when a user attempts to "export a report," the system prompts "Please complete security verification." After the user enters the received mobile verification code and confirms, the export function is activated.

[0091] The conflict value characterizes the degree of discrepancy between a user's intended action and a high-risk operation; the higher the degree of discrepancy, the safer the user's intended action. The second conflict safety threshold is greater than the first conflict safety threshold, which restricts low-risk operations requiring additional confirmation. When the conflict value is greater than or equal to the first conflict safety threshold but less than the second conflict safety threshold, it indicates that the operation, while not meeting the highest safety standard, is still within a controllable range. In this case, the system may require secondary confirmation (e.g., a pop-up prompt window) instead of allowing direct access. For example, when a user attempts to export customer data in bulk, the system pops up a confirmation window asking the user to explain the purpose.

[0092] It is also clear that the second conflict security threshold is used to restrict completely safe operations, allowing them to be executed directly. When the conflict value is greater than or equal to the second conflict security threshold, it indicates that the operation violates high-risk behavior to a sufficiently high degree, meaning that the user's target operation itself is highly secure, and the system can directly allow it without any additional verification. For example, if a user clicks the "Query Customer Orders" button, only performing data reading with no risk of modification, the system will directly return the result without any interception or delay.

[0093] In this way, by implementing dual thresholds, we can know that in the case of high conflict value, direct approval can improve user experience; in the case of medium conflict value, secondary confirmation can reduce the probability of misoperation; of course, in the case of lower than the first conflict safety threshold, that is, high-risk operation, it can be prohibited by default to avoid security risks (such as data deletion).

[0094] It should be noted that if the relevance is less than the acceptable threshold, not all operations are rejected outright. This only indicates a low degree of relevance between the user's action and their job responsibilities, but there may be special circumstances. For example, in an organization's structure, the supervisor of the user account may temporarily authorize the employee to perform a specific task. In this case, the system can send a prompt to the designated terminal, requesting the corresponding authorization proof. After the authorization proof is submitted and approved, subsequent permission checks will be performed based on the conflict values ​​corresponding to each pre-operation behavior.

[0095] Thus, when the operational objective matches the job responsibilities (relevance meets the standard), and the pre-operation behavior significantly deviates from the high-risk operation (i.e., conflict value ≥ the second conflict security threshold), the system directly grants access. This indicates that the operation is both within the scope of responsibilities and far from high-risk characteristics, making it a highly reliable operation that requires no additional verification, thus improving the efficiency of remote operations.

[0096] Of course, for conflict values ​​that meet basic security requirements (i.e., are greater than or equal to the first conflict security threshold but less than the second conflict security threshold), the system sends a verification prompt to the remote device, granting access only after the user completes identity or permission verification. This design provides a pathway for reasonable but ambiguous operations while ensuring security.

[0097] Finally, if the relevance is below the acceptable threshold, although this indicates a low match between the operation and job responsibilities, the system does not directly reject the request. Instead, it prompts the user to submit authorization documentation. After confirmation from higher-level authorization, the system then determines the permission based on the conflict value. This approach avoids business interruptions due to temporary organizational authorizations, cross-functional collaborations, or other special circumstances, demonstrating the flexibility and adaptability of access control.

[0098] Among them, "sending a verification prompt to a remote device" and "prompting the submission of authorization proof" are two interaction mechanisms triggered under different conditions, targeting different objects, and achieving different purposes. They play different technical roles in the system's permission judgment process:

[0099] Sending a verification prompt to a remote device occurs when the user's action aligns well with their job responsibilities (i.e., the relevance is greater than or equal to the relevance threshold), but the action's violation of high-risk operations has not yet reached a sufficiently secure level (i.e., the conflict value is greater than or equal to the first conflict security threshold but less than the second conflict security threshold). At this point, the system considers the action basically reasonable, but further verification of the operator's identity or intent is required. Therefore, a verification request can be directly pushed to the remote login device (such as a personal computer or mobile phone) used by the current user, requiring the user to complete multi-factor authentication on their account, such as entering an SMS verification code, confirming a dynamic password, or clicking a confirmation button. The entire process is completed locally by the current user.

[0100] The "prompt to submit authorization proof" occurs when the operation has a low degree of relevance to job responsibilities (i.e., the relevance is less than the acceptable relevance threshold). In this case, the system initially judges that the operation deviates from the normal work scope and cannot be directly deemed compliant. Therefore, external evidence is required. Request relevant personnel to provide written or electronic materials that can prove the operation has been authorized, such as approval process records, authorization emails, or formal notifications.

[0101] As can be seen, the above scheme uses relevance as the primary decision-making basis, including further judging the conflict value when the relevance meets the condition, and the corresponding handling method when the relevance does not meet the condition; however, in some optional implementations, the present invention can also use the conflict value as the primary decision-making basis and the relevance as an auxiliary basis. In addition, when neither the relevance nor the conflict value meets the condition, it means that the user is trying to perform an operation that is neither within the scope of their responsibilities nor safe enough in terms of behavior pattern. In this case, the user account is not granted any permissions to prevent unauthorized and risky behavior.

[0102] Specifically, when using conflict value as the primary decision-making criterion and correlation degree as a secondary judgment condition, the following steps can be followed:

[0103] When the conflict value of an operation is greater than or equal to the second conflict security threshold, if the correlation degree is lower than the correlation degree qualification threshold, the user is granted the remote operation permission corresponding to the operation requested, but at the same time, the operation corresponding to the user account must be sent to the system administrator in the form of an alarm; of course, if the correlation degree is higher than the correlation degree qualification threshold, it is allowed directly.

[0104] When the conflict value of an operation is greater than or equal to the first conflict security threshold but less than the second conflict security threshold, verification must be completed regardless of the degree of relevance. However, if the degree of relevance is higher than the qualified relevance threshold, the number of verification rounds can be reduced. For example, if the original process requires SMS and facial verification, only SMS verification can be completed if the degree of relevance is high; conversely, if the degree of relevance is low, an additional verification layer is required. If each round of verification passes, remote operation permissions for the corresponding operation can be granted.

[0105] When the conflict value of an operation is less than the first conflict safety threshold, the operation is immediately terminated and a safety warning is triggered. The correlation is only used for alarm classification. If the correlation is low, it is upgraded to an emergency event, and if the correlation is high, it is a non-emergency alarm event.

[0106] Unlike the relevance-based decision-making, where relevance is highly correlated with the user's job responsibilities, if the relevance is below the acceptable threshold, but the conflict value of the operation is greater than or equal to the first conflict safety threshold but less than the second conflict safety threshold, or greater than the second conflict safety threshold, it indicates that the operation itself is safe enough. It may be additional work assigned by the user's superior within the enterprise, and additional verification opportunities can be given. The conflict value-based decision-making, however, is different; it indicates that the operation itself carries risk.

[0107] 205. Monitor whether the actual operations of user accounts in the target business system conform to the operation objectives, and initiate a review process if they do not.

[0108] It should be noted that although users cannot successfully execute unauthorized operations, in a real system environment, there may still be various reasons why a user might initiate an operation request beyond their authorized scope, even though these requests will ultimately be rejected by the system. Such behavior is still considered abnormal and should be logged and included in management controls. For example:

[0109] The system may have only hidden the relevant function buttons on the front-end interface, but the back-end does not perform strict permission verification for operation requests. In this case, users can directly call the API through browser debugging tools, Postman, or scripts to attempt to perform unauthorized operations. Although the request is rejected due to insufficient permissions (returning a failure), the request itself has already occurred, reflecting potential unauthorized attempts or abnormal behavior.

[0110] Therefore, this step requires real-time monitoring of the user account's actual operational behavior. If, within a preset time frame, the number of requests initiated by the user exceeding the granted remote operation permissions exceeds a preset limit, the user account's remote operation permissions will be automatically revoked until a review is completed and approved. Such accounts can also be marked as "key monitoring targets" to strengthen subsequent access control.

[0111] Marking violating accounts as "key monitoring targets" can trigger stricter verification strategies or manual review processes when they log in or request permissions, forming a cumulative identification mechanism for risky behavior, which helps to promptly identify potential high-risk users or internal threats.

[0112] Thus, even if a user's initial permissions have been approved, if they frequently attempt to perform unauthorized operations within a short period, the system can still identify this behavioral pattern and determine if it involves risks such as account impersonation, misuse of permissions, or malicious probing. By setting a threshold for the number of attempts, the system can promptly block remote access permissions when abnormal behavior accumulates to a certain level, preventing further escalation of risks and thereby improving the system's proactive defense capabilities and security control level.

[0113] Furthermore, as a response to the above Figure 1 In addition to the implementation of the method shown, this embodiment of the invention also provides a permission determination device based on remote work, used for the above-mentioned... Figure 1 The method shown is implemented accordingly. This device embodiment corresponds to the foregoing method embodiment. For ease of reading, this device embodiment will not repeat the details of the foregoing method embodiment, but it should be clear that the device in this embodiment can implement all the contents of the foregoing method embodiment. Figure 3 As shown, the device includes:

[0114] The access request unit 301 is used to receive remote access requests sent by user accounts through remote login devices;

[0115] The prompt sending unit 302 is used to send an operation target declaration prompt to the remote login device after the remote access request obtained by the request access unit 301 has been verified, so that the user can fill in the operation target on the remote login device according to the user account;

[0116] The operation parsing unit 303 is used to obtain a list of pre-operation behaviors and a list of operation keywords of the user account in the target business system based on the operation target obtained by the prompt sending unit 302.

[0117] The permission determination unit 304 is used to determine the remote operation permissions of a user account in the target business system based on the pre-operation behavior list, the operation keyword list, the job information corresponding to the user account, and the preset high-risk operation rules obtained by the operation parsing unit 303, so that the user account can perform the operation corresponding to the remote operation permission in the target business system.

[0118] Furthermore, as a response to the above Figure 2 In addition to the method shown, this embodiment of the invention also provides another permission determination device based on remote work, used for the above-mentioned... Figure 2 The method shown is implemented accordingly. This device embodiment corresponds to the foregoing method embodiment. For ease of reading, this device embodiment will not repeat the details of the foregoing method embodiment, but it should be clear that the device in this embodiment can implement all the contents of the foregoing method embodiment. Figure 4As shown, the device includes:

[0119] The access request unit 301 is used to receive remote access requests sent by user accounts through remote login devices;

[0120] The prompt sending unit 302 is used to send an operation target declaration prompt to the remote login device after the remote access request obtained by the request access unit 301 has been verified, so that the user can fill in the operation target on the remote login device according to the user account;

[0121] The operation parsing unit 303 is used to obtain a list of pre-operation behaviors and a list of operation keywords of the user account in the target business system based on the operation target obtained by the prompt sending unit 302.

[0122] The permission determination unit 304 is used to determine the remote operation permissions of a user account in the target business system based on the pre-operation behavior list, the operation keyword list, the job information corresponding to the user account, and the preset high-risk operation rules obtained by the operation parsing unit 303, so that the user account can perform the operation corresponding to the remote operation permission in the target business system.

[0123] In one optional implementation, the permission determination unit 304 includes:

[0124] The acquisition module 3041 is used to acquire the list of functional keywords in the job information, each pre-operation behavior in the list of pre-operation behaviors, and each high-risk operation in the preset high-risk operation rules, wherein each pre-operation behavior has corresponding execution conditions, and each high-risk operation has corresponding compliance conditions and risk value.

[0125] The correlation determination module 3042 is used to determine the correlation between the operation target and the job information based on the operation keyword list and the functional keyword list obtained by the acquisition module 3041. The correlation is used to characterize the degree of relevance between the operation target and the job. The higher the degree of relevance, the higher the compliance of the operation.

[0126] The conflict value determination module 3043 is used to determine the conflict value between each pre-operation behavior and the preset high-risk operation based on each pre-operation behavior, the execution conditions corresponding to each pre-operation behavior, each high-risk operation, and the compliance conditions and risk value corresponding to each high-risk operation in the pre-operation behavior list determined by the acquisition module 3041. The conflict value is used to characterize the degree of violation between the user's pre-operation behavior and the high-risk operation. The higher the degree of violation, the safer the behavior that the user expects to perform.

[0127] The permission determination module 3044 is used to determine the remote operation permissions of a user account in the target business system based on the correlation degree determined by the correlation degree determination module 3042 and the conflict value corresponding to each pre-operation behavior determined by the conflict value determination module 3043.

[0128] In one optional implementation, the correlation determination module 3042 is specifically used for:

[0129] The number of times the operational keywords in the operational keyword list are matched in the functional keyword list is counted, and the first ratio between the number of matches and the total number of operational keywords is determined as the target matching rate;

[0130] The number of functional keywords in the functional keyword list that cover the operational keyword list is counted, and the second ratio between the number of coverage and the total number of functional keywords is determined as the functional coverage rate.

[0131] The degree of correlation is determined based on the target matching rate and the functional coverage rate.

[0132] In an optional implementation, the correlation determination module 3042 determines the correlation degree based on the target matching rate and the functional coverage rate, specifically for:

[0133] The weighted score between the functional coverage rate and the target matching rate is calculated based on the weights corresponding to the functional coverage rate and the target matching rate, and is used as the first score value;

[0134] If the list of operation keywords contains a specified operation keyword that prohibits job information, then the product of the first score and the preset penalty coefficient is used as the relevance.

[0135] If the specified operation keyword that prohibits job information does not exist in the list of operation keywords, then the first score value will be used as the relevance.

[0136] In one optional implementation, the conflict value determination module 3043 is specifically used for:

[0137] Each pre-operation behavior is compared with each high-risk operation to obtain the first matching score of each pre-operation behavior and each high-risk operation. If the pre-operation behavior is successfully matched with the high-risk operation, the first matching score is the risk value of the high-risk operation under the first preset ratio.

[0138] The execution conditions corresponding to each pre-operation behavior are compared with the compliance conditions corresponding to each high-risk operation item by item to obtain a second matching score. If the execution condition and the compliance condition are successfully matched, the second matching score is the risk value of the high-risk operation under a second preset ratio, where the second preset ratio is less than the first preset ratio.

[0139] For each pre-operation behavior, the sum of the first matching score and the second matching score corresponding to each high-risk operation is calculated and determined as the first intermediate conflict value between each pre-operation behavior and the preset high-risk operation.

[0140] For each pre-operation behavior, the sum of the first intermediate conflict values ​​between it and multiple high-risk operations is determined as the conflict value between each pre-operation behavior and the preset high-risk operations.

[0141] In one optional implementation, the permission determination module 3044 is specifically used for:

[0142] Obtain a predetermined correlation qualification threshold, a first conflict safety threshold, and a second conflict safety threshold;

[0143] If the correlation degree is greater than or equal to the correlation degree qualification threshold, grant operation permissions to the first target pre-operation behavior in the pre-operation behavior list whose conflict value is greater than or equal to the second conflict security threshold.

[0144] For the second target pre-operation behavior in the list of pre-operation behaviors with a conflict value greater than or equal to the first conflict security threshold and less than the second conflict security threshold, a verification prompt is sent to the remote login device, and the corresponding permissions are granted after the user account passes the verification according to the verification prompt.

[0145] In an optional implementation, after the user account performs an operation corresponding to the remote operation permission in the target business system, the device further includes an operation monitoring unit 305, which is specifically used for:

[0146] If it is detected that a user account performs more than a preset number of operations that do not comply with the remote operation permissions within a preset time range, the remote operation permissions of the user account will be revoked until the review is passed.

[0147] Furthermore, embodiments of the present invention also provide a storage medium for storing a computer program, wherein the computer program, when running, controls the device where the storage medium is located to execute the above-described... Figures 1-2 The permission determination method based on remote work described in the article.

[0148] Furthermore, embodiments of the present invention also provide a processor for running a program, wherein the program executes the above-described... Figures 1-2 The permission determination method based on remote work described in the article.

[0149] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0150] It is understood that the relevant features in the above methods and apparatus can be referenced interchangeably. Furthermore, the terms "first," "second," etc., in the above embodiments are used to distinguish between embodiments and do not represent the superiority or inferiority of any particular embodiment.

[0151] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0152] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0153] In addition, the memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0154] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0155] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0156] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0157] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0158] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0159] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0160] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0161] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0162] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0163] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for determining permissions based on remote work, characterized in that, The method includes: Receive remote access requests sent by user accounts through remote login devices; After the remote access request is verified, an operation target declaration prompt is sent to the remote login device so that the user can fill in the operation target on the remote login device according to the user account. Based on the stated operational objective, obtain a list of pre-operation behaviors and a list of operational keywords for the user account in the target business system; Based on the pre-operation behavior list, the operation keyword list, the job information corresponding to the user account, and the preset high-risk operation rules, the remote operation permissions of the user account in the target business system are determined so that the user account can perform operations corresponding to the remote operation permissions in the target business system.

2. The method according to claim 1, characterized in that, Based on the pre-operation behavior list, the operation keyword list, the job information corresponding to the user account, and preset high-risk operation rules, the remote operation permissions of the user account in the target business system are determined, including: Obtain the list of functional keywords in the job information, each pre-operation behavior in the list of pre-operation behaviors, and each high-risk operation in the preset high-risk operation rules, wherein each pre-operation behavior has corresponding execution conditions, and each high-risk operation has corresponding compliance conditions and risk value; The correlation between operational objectives and job information is determined based on the operational keyword list and the functional keyword list. The correlation is used to characterize the degree of relevance between operational objectives and job positions. The higher the degree of relevance, the higher the compliance level of the operation. Based on each pre-operation behavior in the pre-operation behavior list, the execution conditions corresponding to each pre-operation behavior, each high-risk operation, and the compliance conditions and risk values ​​corresponding to each high-risk operation, the conflict value between each pre-operation behavior and the preset high-risk operation is determined. The conflict value is used to characterize the degree of violation between the user's pre-operation behavior and the high-risk operation. The higher the degree of violation, the safer the behavior that the user expects to perform. The remote operation permissions of the user account in the target business system are determined based on the correlation degree and the conflict value corresponding to each pre-operation behavior.

3. The method according to claim 2, characterized in that, Determine the correlation between operational objectives and job information based on the operational keyword list and the functional keyword list, including: The number of times the operational keywords in the operational keyword list are matched in the functional keyword list is counted, and the first ratio between the number of matches and the total number of operational keywords is determined as the target matching rate; The number of functional keywords in the functional keyword list that cover the operational keyword list is counted, and the second ratio between the number of coverage and the total number of functional keywords is determined as the functional coverage rate. The degree of correlation is determined based on the target matching rate and the functional coverage rate.

4. The method according to claim 3, characterized in that, Determining the correlation degree based on the target matching rate and the functional coverage rate includes: The weighted score between the functional coverage rate and the target matching rate is calculated based on the weights corresponding to the functional coverage rate and the target matching rate, and is used as the first score value; If the list of operation keywords contains a specified operation keyword that prohibits job information, then the product of the first score and the preset penalty coefficient is used as the relevance. If the specified operation keyword that prohibits job information does not exist in the list of operation keywords, then the first score value will be used as the relevance.

5. The method according to claim 2, characterized in that, Based on each pre-operation behavior in the pre-operation behavior list, the execution conditions corresponding to each pre-operation behavior, each high-risk operation, and the compliance conditions and risk values ​​corresponding to each high-risk operation, the conflict value between each pre-operation behavior and the preset high-risk operation is determined, including: Each pre-operation behavior is compared with each high-risk operation to obtain the first matching score of each pre-operation behavior and each high-risk operation. If the pre-operation behavior is successfully matched with the high-risk operation, the first matching score is the risk value of the high-risk operation under the first preset ratio. The execution conditions corresponding to each pre-operation behavior are compared with the compliance conditions corresponding to each high-risk operation item by item to obtain a second matching score. If the execution condition and the compliance condition are successfully matched, the second matching score is the risk value of the high-risk operation under a second preset ratio, where the second preset ratio is less than the first preset ratio. For each pre-operation behavior, the sum of the first matching score and the second matching score corresponding to each high-risk operation is calculated and determined as the first intermediate conflict value between each pre-operation behavior and the preset high-risk operation. For each pre-operation behavior, the sum of the first intermediate conflict values ​​between it and multiple high-risk operations is determined as the conflict value between each pre-operation behavior and the preset high-risk operations.

6. The method according to claim 2, characterized in that, The remote operation permissions of the user account in the target business system are determined based on the correlation degree and the conflict value corresponding to each pre-operation behavior, including: Obtain a predetermined correlation qualification threshold, a first conflict safety threshold, and a second conflict safety threshold; If the correlation degree is greater than or equal to the correlation degree qualification threshold, grant operation permissions to the first target pre-operation behavior in the pre-operation behavior list whose conflict value is greater than or equal to the second conflict security threshold. For the second target pre-operation behavior in the list of pre-operation behaviors with a conflict value greater than or equal to the first conflict security threshold and less than the second conflict security threshold, a verification prompt is sent to the remote login device, and the corresponding permissions are granted after the user account passes the verification according to the verification prompt.

7. The method according to claim 1, characterized in that, After the user account performs the operation corresponding to the remote operation permission in the target business system, the method further includes: If it is detected that a user account performs more than a preset number of operations that do not comply with the remote operation permissions within a preset time range, the remote operation permissions of the user account will be revoked until the review is passed.

8. A permission determination device based on remote work, characterized in that, The device includes: The access request unit is used to receive remote access requests sent by user accounts through remote login devices; The prompt sending unit is used to send an operation target declaration prompt to the remote login device after the remote access request obtained by the request access unit has been verified, so that the user can fill in the operation target on the remote login device according to the user account; The operation parsing unit is used to obtain a list of pre-operation behaviors and a list of operation keywords of the user account in the target business system based on the operation target obtained by the prompt sending unit; The permission determination unit is used to determine the remote operation permissions of a user account in the target business system based on the pre-operation behavior list, the operation keyword list, the job information corresponding to the user account, and the preset high-risk operation rules obtained by the operation parsing unit, so that the user account can perform the operation corresponding to the remote operation permission in the target business system.

9. A storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to perform the remote office-based permission determination method as described in any one of claims 1 to 7.

10. A processor, characterized in that, The processor is used to run a program, wherein the program executes the remote office-based permission determination method as described in any one of claims 1 to 7.

Images