User permission configuration control system and method and server

Abstract

The invention provides a user permission configuration control system, a user permission configuration control method and a server, and relates to the technical field of permission control, the scheme can fully utilize organization information, post information and permission information of a user to automatically generate personalized permission configuration suggestions, and can utilize a related language large model to carry out auxiliary configuration, so that the user permission configuration control efficiency is improved. And the accuracy and the applicability of authority distribution are greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of permission control, in particular to a user permission configuration control system, method and server. BACKGROUND

[0002] With the expansion of enterprise scale and the complexity of business, user permission management becomes more and more challenging. Enterprises need to quickly and accurately allocate appropriate permissions for new employees or employees with job changes to ensure business continuity and information security. Existing permission management systems usually adopt a Role-Based Access Control (RBAC) model, which allows administrators to allocate permissions to users based on predefined role templates or automatically inherit part of the permissions of the superior according to the organizational structure. However, the existing RBAC system lacks intelligent recommendation function and cannot automatically generate the optimal permission configuration according to the specific situation of the user; manual allocation of permissions is prone to errors, resulting in overlarge or undersized permission settings. In addition, the permission inheritance mode of the existing RBAC system is too simple to meet the complex business needs, lacks the full use of historical data and similar position information, and cannot realize intelligent permission allocation. SUMMARY

[0003] In view of the low efficiency, error-prone, lack of personalization and other problems existing in the process of allocating user permissions in existing enterprises, the purpose of the present application is to provide a user permission configuration control system, method and server, which can fully utilize the user's organizational information, position information and permission information to automatically generate personalized permission configuration suggestions, and can use related language large models to assist configuration, greatly improving the accuracy and applicability of permission allocation.

[0004] In a first aspect, the present application provides a user permission configuration control system, which comprises: A collection and processing module is configured to obtain organizational information, position information and permission information of a user from a pre-set identity source interface, an identity recognition management interface and a target business interface, respectively. A permission analysis module is configured to construct permission format data corresponding to the user according to the organizational information, the position information and the permission information, determine a permission configuration prompt strategy corresponding to the user based on the permission format data, and generate a permission configuration list corresponding to the permission format data using the permission configuration prompt strategy. An authorization management module is configured to determine a permission comparison prompt strategy corresponding to the user based on the permission configuration list, obtain a permission adjustment parameter corresponding to the permission configuration list using the permission comparison prompt strategy, and set permission data corresponding to the user using the permission adjustment parameter.

[0005] Optionally, the collection processing module comprises a data collection module and a data preprocessing module; wherein the input end of the data collection module is connected with the identity source interface, the identity recognition management interface and the target service interface, the output end of the data collection module is connected with the input end of the data preprocessing module; the output end of the data preprocessing module is connected with the permission analysis module; The data collection module is configured to collect the organization information, the post information and the permission information corresponding to the user from the preset identity source interface, the identity recognition management interface and the target service interface. The data preprocessing module is configured to, after processing the repeated data and the missing values in the organization information, the post information and the permission information, construct the permission context information corresponding to the organization information, the post information and the permission information according to the preset data format.

[0006] Optionally, the data collection module comprises: The identity source data collection module is configured to collect the user information, the post information and the organization structure information corresponding to the user through the identity source interface, and determine the organization information based on the user information, the post information and the organization structure information. The identity recognition data collection module is configured to collect the same post access application information corresponding to the user through the identity recognition management interface, and determine the post information based on the same post access application information. The target service data collection module is configured to collect the post permission information and the permission role information corresponding to the user through the target service interface, and determine the permission information based on the post permission information and the permission role information.

[0007] Optionally, the data preprocessing module comprises: The data cleaning module is configured to, after determining the repeated data and the missing data contained in the organization information, the post information and the permission information, perform the de-duplication processing on the repeated data, and after determining the missing values corresponding to the missing data based on the organization information, the post information and the permission information, update the missing data by using the missing values; The data standardization module is configured to determine the data coding parameter, the data naming parameter and the field setting parameter according to the preset data format, and after performing the format processing on the organization information, the post information and the permission information which have completed the data cleaning by using the data coding parameter, the data naming parameter and the field setting parameter, obtain the standard input data corresponding to the user; The context information acquisition module is configured to acquire the permission context information corresponding to the standard input data by using the preset LLM model.

[0008] Optionally, the permission analysis module comprises: The input processing module is configured to construct the permission context information corresponding to the user according to the organization information, the post information and the permission information input from the collection processing module, and determine the permission format data by using the permission context information. The analysis processing module is configured to determine a permission configuration prompt strategy based on user information data, organization information data, similar position data, and permission control data corresponding to the user determined by the permission format data, and perform permission analysis on the user based on the preset LLM model and the permission configuration prompt strategy; The permission recommendation module is configured to obtain a permission analysis result corresponding to the LLM model, and determine permission recommendation data corresponding to the user based on the permission analysis result. The output processing module is configured to obtain a formatting parameter corresponding to the permission configuration prompt strategy, and obtain a permission configuration list corresponding to the permission recommendation data based on the formatting parameter.

[0009] Optionally, the permission analysis module further comprises a permission configuration prompt word construction module. The permission configuration prompt word construction module is configured to construct a permission configuration prompt template corresponding to the LLM model based on identifiers corresponding to the user information data, the organization information data, the similar position data, and the permission control data; wherein the permission configuration prompt template is used to generate the permission configuration prompt strategy.

[0010] Optionally, the authorization management module comprises: The permission comparison and analysis module is configured to determine a permission comparison prompt strategy based on similar position data corresponding to the user determined by the permission configuration list, and obtain a difference analysis result of the user based on the preset LLM model and the permission comparison prompt strategy. The risk prompt module is configured to determine a permission adjustment parameter corresponding to the permission configuration list based on the difference analysis result, and determine a risk prompt strategy corresponding to the user based on a permission risk value corresponding to the permission adjustment parameter. The permission adjustment module is configured to set and update the permission data corresponding to the user based on the permission adjustment parameter. The authorization confirmation module is configured to obtain an authorization confirmation instruction corresponding to the user based on the permission data, and control the user to set the permission based on the permission data based on the authorization confirmation instruction.

[0011] Optionally, the authorization management module further comprises: The permission configuration preview module is configured to obtain a visual page corresponding to the permission configuration list, and display the permission configuration list based on the visual page.

[0012] In a second aspect, the present application provides a user permission configuration control method, which is applied to the user permission configuration control system mentioned in the first aspect, and the system at least comprises a collection processing module, a permission analysis module, and an authorization management module; the method comprises: The collection processing module is controlled to obtain organization information, position information, and permission information of the user from a preset identity source interface, an identity recognition management interface, and a target business interface, respectively. The control authority analysis module constructs the authority format data corresponding to the user according to the organization information, the post information and the authority information, determines the authority configuration prompt strategy corresponding to the user based on the authority format data, and generates the authority configuration list corresponding to the authority format data by using the authority configuration prompt strategy; The control authorization management module determines the authority comparison prompt strategy corresponding to the user based on the authority configuration list, obtains the authority adjustment parameter corresponding to the authority configuration list by using the authority comparison prompt strategy, and sets the authority data corresponding to the user by using the authority adjustment parameter.

[0013] In a third aspect, an embodiment of the present application further provides a server, comprising a processor and a memory, the memory stores computer executable instructions capable of being executed by the processor, and the processor executes the computer executable instructions to realize the steps of the user authority configuration control method provided in the second aspect.

[0014] In a fourth aspect, an embodiment of the present application further provides a storage medium, which stores computer executable instructions, and the computer executable instructions make the processor realize the steps of the user authority configuration control method provided in the second aspect when the computer executable instructions are called and executed by the processor.

[0015] The user authority configuration control system, method and server provided by the embodiment of the present application, the system comprises: a collection processing module, an authority analysis module and an authorization management module. Specifically, the collection processing module is used to obtain the organization information, the post information and the authority information of the user from the preset identity source interface, the identity recognition management interface and the target business interface respectively; the authority analysis module is used to construct the authority format data corresponding to the user according to the organization information, the post information and the authority information, determine the authority configuration prompt strategy corresponding to the user based on the authority format data, and generate the authority configuration list corresponding to the authority format data by using the authority configuration prompt strategy; and the authorization management module is used to determine the authority comparison prompt strategy corresponding to the user based on the authority configuration list, obtain the authority adjustment parameter corresponding to the authority configuration list by using the authority comparison prompt strategy, and set the authority data corresponding to the user by using the authority adjustment parameter. The scheme can fully utilize the organization information, the post information and the authority information of the user to automatically generate personalized authority configuration suggestions, and can use a related language large model to assist in configuration, thereby greatly improving the accuracy and applicability of authority allocation.

[0016] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and achieved by the structure particularly pointed out in the description, claims and drawings.

[0017] In order to make the above objectives, characteristics and advantages of the present application more apparent, comprehensible and easier to understand, the following preferred embodiments are specifically described below with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to make the above objectives, characteristics and advantages of the present application more apparent, comprehensible and easier to understand, the following preferred embodiments are specifically described below with reference to the accompanying drawings.

[0019] Figure 1 A structural schematic diagram of a user permission configuration control system according to an embodiment of the present application is provided. Figure 2 A structural schematic diagram of a collection and processing module in a user permission configuration control system according to an embodiment of the present application is provided. Figure 3 A structural schematic diagram of a permission analysis module in a user permission configuration control system according to an embodiment of the present application is provided. Figure 4 A structural schematic diagram of an authorization management module in a user permission configuration control system according to an embodiment of the present application is provided. Figure 5 A structural schematic diagram of another user permission configuration control system according to an embodiment of the present application is provided. Figure 6 A flowchart of a user permission configuration control method according to an embodiment of the present application is provided. Figure 7 A flowchart of another user permission configuration control method according to an embodiment of the present application is provided. Figure 8 A structural schematic diagram of a server according to an embodiment of the present application is provided.

[0020] Icon: 100 - collection and processing module; 200 - permission analysis module; 300 - authorization management module; 110 - data collection module; 110a - identity source data collection module; 110b - identity recognition data collection module; 110c - target service data collection module; 120 - data preprocessing module; 120a - data cleaning module; 120b - data standardization module; 120c - context information acquisition module; 210 - input processing module; 220 - analysis processing module; 230 - permission recommendation module; 240 - output processing module; 250 - permission configuration prompt word construction module; 310 - permission comparison and analysis module; 320 - risk prompt module; 330 - permission adjustment module; 340 - authorization confirmation module; 350 - permission configuration preview module; 101 - processor; 102 - memory; 103 - bus; 104 - communication interface. DETAILED DESCRIPTION

[0021] To make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions of the present application will be described clearly and completely below in conjunction with embodiments. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0022] With the expansion of the scale of enterprises and the complexity of business, user permission management is becoming more and more challenging. Enterprises need to quickly and accurately assign appropriate permissions to new employees or employees with job changes to ensure business continuity and information security. Existing permission management systems usually use a role-based access control model. These systems allow administrators to assign permissions to users based on predefined role templates or automatically inherit part of the permissions of their superiors according to the organizational structure. However, the existing RBAC system lacks intelligent recommendation functions and cannot automatically generate the optimal permission configuration according to the specific circumstances of the user; manual allocation of permissions is prone to errors, resulting in overlarge or undersized permissions. In addition, the permission inheritance mode of the existing RBAC system is too simple and cannot meet the complex business needs, lacks the full use of historical data and similar position information, and cannot achieve intelligent permission allocation. Based on this, the present application provides a user permission configuration control system, method and server, which can fully utilize the user's organizational information, position information and permission information to automatically generate personalized permission configuration suggestions, and can use related language large models to assist configuration, greatly improving the accuracy and applicability of permission allocation.

[0023] To facilitate the understanding of the present embodiment, first, a user permission configuration control system disclosed by the present embodiment will be described in detail. The user permission configuration control system is dedicated to solving the precision and efficiency problems of permission management in enterprise digital scenarios. By building a complete closed loop of "collection-analysis-authorization", it realizes the landing of intelligent permission configuration from multi-source data integration, covering organization, position, and business full-dimensional permission governance, and adapting to the fine-grained permission control needs under complex business architecture. As shown in Figure 1 The system includes: A collection processing module 100 is configured to obtain organizational information, position information and permission information of a user from a pre-set identity source interface, an identity recognition management interface and a target business interface, respectively.

[0024] The module connects the preset identity source interface (such as enterprise IM system, Dingding, Feishu, etc.) through deep docking, not only obtains basic organization information (department affiliation, hierarchical relationship), but also extends to collect dynamic change records of organizational structure (such as recent department merger and split information), and provides basis for adjusting the organization of the right.

[0025] When pulling the post information from the identity and access management (IAM, Identity and Access Management) interface, the "static responsibility + dynamic load" data of the post is collected in detail. In addition to the fixed post description content, the current pending task quantity, collaboration business line and other real-time information of the post are synchronously captured to assist in determining the urgency of the post permission requirements.

[0026] For target business interfaces (such as ERP, OA and other business systems), a "timed polling + event triggering" dual-mode is used to collect permission information. When a permission change event (such as adding a business function permission) occurs in the business system, the change details are incrementally obtained immediately to ensure the real-time nature of the permission information.

[0027] The permission analysis module 200 is configured to construct the permission format data corresponding to the user according to the organization information, the post information and the permission information, to determine the permission configuration prompt strategy corresponding to the user based on the permission format data, and to generate the permission configuration list corresponding to the permission format data by using the permission configuration prompt strategy.

[0028] The permission format data construction process is based on the collected multi-dimensional information and uses a "hierarchical modeling" approach to construct the permission format data. Specifically, the organization layer is based on the organizational structure tree to mark the general permission baseline of each level of organization (such as the default global view permission of the group headquarters); the post layer combines the static responsibility and dynamic load of the post to generate a post-specific permission set (such as the "finance cashier" post, which dynamically adjusts the threshold of the fund operation permission according to the current business peak); the business layer associates the business system permission rules to match the operation permissions of the post in the specific business process (such as the "order approval" and "supplier access" sub-permissions of the procurement post in the procurement system); and finally, a multi-level permission format data system of "organization bottom-up + post adaptation + business refinement" is formed.

[0029] The rule engine and machine learning dual-driven strategy can be introduced in the process of generating the permission configuration prompt strategy. The rule engine has built-in enterprise permission management specifications (such as “secondary approval of sensitive post permissions” and “temporary authorization of cross-organization collaboration permissions”), which checks the compliance of the permission format data and outputs basic prompts (such as identifying permission items that require special approval). The machine learning related module can train a permission recommendation model based on historical permission configuration cases and business risk data (such as business loss events caused by past misuse of permissions), predict the optimal permission configuration for different organization-post combinations, and generate intelligent prompts. The combination of the two forms a “compliance constraint + business adaptation” permission configuration prompt strategy to guide the generation of a permission configuration list containing “mandatory permissions, recommended permissions, and risk permissions”.

[0030] The authorization management module 300 is configured to determine a permission comparison prompt strategy corresponding to the user based on the permission configuration list, obtain a permission adjustment parameter corresponding to the permission configuration list by using the permission comparison prompt strategy, and set the permission data corresponding to the user by using the permission adjustment parameter.

[0031] In the application process of the permission comparison prompt strategy, the module can construct a “current permissions-recommended permissions” two-dimensional comparison model based on the permission configuration list. This model can compare the differences between the user's current actual permissions and the recommended permissions in the list through vertical comparison, distinguish between “permission deficiency (affecting business operations)” and “permission redundancy (risk hidden danger)”, and generate a visual comparison report (such as using a heat map to mark permission gaps and redundant areas). This model can also compare horizontally to associate benchmark permission configurations of the same organization and the same post (such as taking the median of the permissions of the same post in the department), identify abnormal points in the current configuration (such as a certain employee's permissions being much higher than the average level of the same post), and trigger a risk warning prompt.

[0032] The permission adjustment parameter can support “automatic + manual” dual-mode processing. In the automatic adjustment process, for rule-specific and low-risk permission changes (such as routine permission upgrades for posts), the system automatically calls the business system interface to complete permission configuration updates based on the permission adjustment parameters (such as permission validity period and associated business scope), and synchronously records the change log. In the manual adjustment process, for high-risk permissions that require human intervention (such as sensitive data access permissions), the system pushes a permission adjustment work order to the administrator's workbench, along with auxiliary decision-making information such as “risk level, impact scope, and historical operation records”. After the administrator confirms, the system triggers permission changes, and after the changes, the system notifies the user through email and to-do messages, ensuring that the permission adjustment is traceable and controllable.

[0033] For example, Figure 2As shown, the optional collection processing module 100 includes a data collection module 110 and a data preprocessing module 120; wherein the input end of the data collection module 110 is connected with the identity source interface, the identity recognition management interface and the target service interface, the output end of the data collection module 110 is connected with the input end of the data preprocessing module 120; the output end of the data preprocessing module 120 is connected with the permission analysis module 200.

[0034] The data collection module 110 is used to collect the organization information, post information and permission information corresponding to the user from the preset identity source interface, identity recognition management interface and target service interface.

[0035] The data collection module 110 is used as a system data entrance, and deeply interfaces with three types of core interfaces: The identity source interface (such as enterprise HR system, unified identity platform): collect the organization information such as the organization structure (including department level, reporting relationship) and organization change track (historical department adjustment record) to which the user belongs; The identity recognition management (IAM) interface: focus on the post dimension, and collect the post information such as post establishment type (fixed post / temporary post) and post responsibility list (including core responsibility and cooperation requirement); The target service interface (such as ERP, CRM and other business systems): accurately extract the permission information such as business operation permission (menu access, data addition, deletion, modification and query) and permission validity period (temporary permission / long-term permission).

[0036] Through multi-interface parallel collection, the “organization-post-business” full-dimension data is covered, and a complete data source is provided for permission analysis.

[0037] The data preprocessing module 120 is used to process the repeated data and missing values in the organization information, post information and permission information, and construct the permission context information corresponding to the organization information, post information and permission information according to the preset data format.

[0038] The data preprocessing module 120 can realize the “cleaning+standardization” double-process management of the collected data. Specifically, the data cleaning uses a duplicate checking algorithm (such as MD5 checking) to identify and remove redundant records in the organization, post and permission information; through statistical interpolation (such as mean filling and adjacent value matching), the missing fields (such as the post information missing scene of some old employees) are repaired to ensure the data integrity. In the process of constructing the permission context, the cleaned data can be mapped into a unified format (such as JSON structured data) according to the enterprise permission management specifications (such as permission coding rules and organization-post association standards), the organization affiliation relationship, post responsibility mapping and permission business scope are associated, and the “organization-post-permission” strongly associated permission context information is formed, which provides standardized input for the subsequent permission analysis module.

[0039] Optionally, the data collection module 110 comprises: An identity source data collection module 110a, configured to collect user information, post information and organizational structure information corresponding to a user through an identity source interface, and determine organizational information based on the user information, the post information and the organizational structure information.

[0040] The identity source data collection module 110a is a key point in the collection of organizational information, and can be deeply connected to a core identity source system of an enterprise (such as an HR management platform or a unified identity authentication center). In the process of realizing multi-dimensional information collection, user basic information (including an employee number, a name and a time of employment) and post service record (a current post and a historical post change track) can be actively pulled, and organizational structure data (a department code, a department level and a department function description) can be associated.

[0041] The organizational information construction logic can be based on the collected user-post-organization association data, and can generate organizational information through a “post belonging organization mapping algorithm”. For example, according to “user A serves in the marketing department-brand post”, the organizational structure code and the function range of the marketing department are associated, and structured organizational information containing “organizational level (group-subcompany-department) and the positioning of the post in the organization” is output, so as to clearly define the organizational boundary of the user permission.

[0042] An identity recognition data collection module 110b, configured to collect same-post access application information corresponding to a user through an identity recognition management interface, and determine post information based on the same-post access application information.

[0043] The module focuses on the value mining of post data of an identity and access management (IAM) system, and can collect application access behavior data of a same-post user in real time in the process of recognizing the same-post behavior, including “high-frequency access application list, application operation time period distribution and cross-application collaboration path”. For example, the “research and development post” group is analyzed, and the frequency and collaboration relationship of the group in accessing a code repository system and a project management tool are captured.

[0044] In the process of dynamically constructing the post information, the post behavior clustering algorithm can be used to dynamically supplement the post information based on the behavior characteristics of the same-post access application and in combination with the static responsibilities of the post description. For example, it is identified that the “research and development post” frequently collaborates with a test system, and the post collaboration requirement of “needing to cooperate with the test post to develop permissions” is supplemented, so that the post information is more suitable for the actual business scenario and reflects the real permission requirements of the post.

[0045] A target business data collection module 110c, configured to collect post permission information and permission role information corresponding to a user through a target business interface, and determine permission information based on the post permission information and the permission role information.

[0046] The module is a permission center for directional docking of each business system (such as ERP, OA, CRM, etc.). In the process of permission collection, on the one hand, post permission information (post default configuration basic permissions, such as "financial post" in ERP "voucher query, payment application" basic operation permissions) can be collected; on the other hand, permission role information (special role permissions assigned to users, such as "temporary project leader" role corresponding to "cross-department data approval right").

[0047] The permission information integration logic can integrate discrete post basic permissions and role special permissions through a "permission role-post permission association algorithm" to generate permission information. For example, the default permissions of the "project manager" post + the permissions of the "key project leader" role are superimposed, and a complete permission data set containing "regular operation permissions, temporary extension permissions, and permission validity / invalidity time" is output, accurately restoring the actual permission range of the user in the business system.

[0048] Optionally, the data preprocessing module 120 includes: The data cleaning module 120a is configured to determine repeated data and missing data in the organization information, the post information, and the permission information, perform de-duplication processing on the repeated data, determine missing values corresponding to the missing data based on the organization information, the post information, and the permission information, and update the missing data using the missing values.

[0049] The module realizes a "detection-repair" closed loop to guarantee data integrity and uniqueness. In the data problem identification process, a "multi-dimensional data verification algorithm" can be used to scan organization information (such as duplicate department codes), post information (such as duplicate post records of the same user), and permission information (such as duplicate definition of permission rules), accurately marking repeated data and missing data points. For example, through "user ID + post code" compound verification, duplicate post information of the same user in the identity source and the business system is identified.

[0050] In the data repair logic, for repeated data, a "timestamp priority + data source credibility" double rule de-duplication can be used (such as retaining the latest post record in the HR system and discarding the historical redundant data in the business system). For missing data, based on a data association completion model, an organization-post-permission association relationship library can be called to automatically derive missing values (such as completing the missing business system operation permissions of a user according to the general permission rules of the same post in the same department), complete data "denoising-completion", and output a clean data set.

[0051] The data standardization module 120b is configured to determine data coding parameters, data naming parameters and field setting parameters according to a preset data format, and format the organization information, the post information and the permission information after the data cleaning is completed by using the data coding parameters, the data naming parameters and the field setting parameters, to obtain the standard input data corresponding to the user.

[0052] The module realizes data "structuring-standardization" based on the enterprise permission management standard. In the standard parameter definition process, the data coding parameters (for example, the permission code adopts the "system code + function code" 10-character rule), the data naming parameters (for example, the post name unified format is "organization level + post sequence + post name") and the field setting parameters (for example, the organization information needs to include the fixed fields of "department ID, parent department ID and department function") can be disassembled according to the preset data format specification.

[0053] In the formatting process, the cleaned data can be matched with the standard parameters field by field, and through "field mapping + format conversion", the heterogeneous data (for example, the post name "market specialist" of the HR system and the "market post" of the business system) is unified into the enterprise standard format (for example, "group-market department-market specialist post"), to generate standard input data and ensure the consistency of data interpretation of the downstream module.

[0054] The context information acquisition module 120c is configured to acquire the permission context information corresponding to the standard input data by using a preset LLM model.

[0055] The module introduces a large language model (LLM) to empower the construction of permission context. In the model training and adaptation process, the preset LLM model can be fine-tuned based on the enterprise permission management knowledge base (including permission rules and organization-post collaboration specifications), so that it can understand the association logic of "organization-post-permission" of the enterprise (for example, "the financial post needs to be associated with the 'funds module' permission and the 'cashier role' approval rule in the ERP system"). The context generation logic can be determined by the LLM model through "multi-dimensional association reasoning" after the input of the standardized data. For example, by analyzing the standard input data of "market department-brand post", combining historical permission configuration cases, and deducing the permission context information that "it needs to be associated with the 'campaign creation' permission, and needs to cooperate with the'media post' to carry out 'advertising placement approval'", the module provides more business-related deep input for the permission analysis module.

[0056] The data preprocessing module 120 takes "cleaning-standardization-intelligent association" as the core path, and through the cooperation of the three sub-modules, the original collected data is converted into high-quality input that can be directly used for permission analysis.

[0057] The permission analysis module 200 implements the accurate recommendation of permission configuration in the logical chain of "data input-intelligent analysis-recommendation generation-output formatting" combined with the prompt word engineering empowerment. As shown in Figure 3 The permission analysis module 200 includes: The input processing module 210 is configured to construct the permission context information corresponding to the user according to the organization information, post information and permission information input from the collection processing module, and determine the permission format data by using the permission context information.

[0058] This module focuses on the transformation of "raw data-analysis available format", and lays the foundation for subsequent analysis. By receiving the organization information (such as department hierarchy, scope of rights and responsibilities), post information (such as post sequence, cooperation requirements), and permission information (such as historical permission configuration, business system permission rules) output by the collection processing module, the multi-dimensional correlation algorithm is used to construct the permission context information containing "user-organization affiliation, post-permission mapping logic, and business scenario permission boundary".

[0059] Based on the context information, the permission format data can be disassembled, and a "three-level field structure" is used to design the basic layer (user ID, organization code, and other identification information), the business layer (post core responsibilities, high-frequency business scenarios), and the permission layer (historical permission change records, sensitive permission contact frequency), to ensure that the data structure adapts to the input requirements of the subsequent analysis model.

[0060] The analysis processing module 220 is configured to determine the permission configuration prompt strategy by using the user information data, organization information data, similar position data and permission control data corresponding to the user determined by the permission format data, and perform permission analysis on the user based on the preset LLM model by using the permission configuration prompt strategy.

[0061] This module undertakes the core analysis function, and can realize deep reasoning in combination with multi-dimensional data and LLM model. The key dimensions are extracted from the permission format data, as follows: User information data (such as time of employment, past permission change records, and cross-department collaboration frequency); Organization information data (such as the permission baseline of the department to which the user belongs and cross-organization collaboration rules); Similar position data (permission configuration distribution of users in the same post and permission use efficiency indicators); Permission control data (enterprise sensitive permission list and permission hierarchical control rules).

[0062] Based on the above data, the permission configuration prompt strategy (such as "new employees need to be configured with basic post permissions first, and after 3 months, extended permissions will be opened according to business proficiency") is generated by "rule matching + scene mapping", and the strategy is input into the preset LLM model.

[0063] The LLM model combines the enterprise permission knowledge base (including compliance requirements and business process specifications) to perform multi-scenario reasoning on permission format data (such as "the post needs to temporarily upgrade report export permissions at the end of the quarter to support business review"), and outputs analysis results including permission necessity, adaptability, and risk level.

[0064] The permission recommendation module 230 is configured to obtain the permission analysis results corresponding to the LLM model, and determine the permission recommendation data corresponding to the user by using the permission analysis results.

[0065] Based on the LLM analysis results, the module generates hierarchical permission recommendations. The analysis results output by the LLM are structurally parsed to extract "mandatory permission items (such as basic permissions corresponding to the core responsibilities of the post), recommended permission items (such as extended permissions adapted to current business needs), and risky permission items (such as sensitive operation permissions beyond the regular scope of the post)".

[0066] In combination with business time sequence characteristics (such as project cycle and quarterly business peak), dynamic attributes (such as the effective period of "campaign management permissions" and the temporary validity period of "cross-department approval rights") are supplemented for the recommended permission items, and finally the permission recommendation data including permission type, permission level, applicable scenario, and risk prompt are formed to ensure that the recommendations are both in line with business needs and comply with compliance requirements.

[0067] The output processing module 240 is configured to obtain the formatted parameters corresponding to the permission configuration prompt strategy, and obtain the permission configuration list corresponding to the permission recommendation data by using the formatted parameters.

[0068] The module converts the permission recommendation data into a standardized permission configuration list for use by downstream modules. Specifically, pre-set formatted parameters (such as list structure specifications: hierarchical display according to "organization-post-business system" dimensions; involved fields require permission code, permission description, suggested operation (enable / disable), and priority) can be called.

[0069] The permission recommendation data can be "field matched and logically sorted" to generate the permission configuration list. For example, sort by "core permissions-extended permissions-risky permissions", label each permission's "recommendation basis (such as based on 80% user configuration for the same post)" and "operation suggestion (such as risky permissions require department head approval)", and provide clear and directly usable audit basis for the authorization management module.

[0070] Optionally, the permission analysis module 200 further includes a permission configuration prompt word construction module 250. The permission configuration prompt word construction module 250 is configured to construct a permission configuration prompt template corresponding to the LLM model according to the user information data, the organization information data, the similar position data, and the identifiers corresponding to the permission control data. The permission configuration prompt template is used to generate a permission configuration prompt strategy.

[0071] The authority configuration prompt word construction module 250 can improve the analysis accuracy of the LLM through prompt word template standardization. In the specific implementation process, the core identifiers such as user ID, department code, post sequence identifier, and sensitive authority label are extracted as template variables.

[0072] In the process of constructing the authority configuration prompt template, a fixed logic framework (such as "based on {user ID} {organization code} attribution and {post sequence} characteristics, combined with the authority distribution of {similar positions}, analyze the reasonable authority range in {business scenarios}, and meet {authority control rules}") is included, and variable insertion positions are reserved.

[0073] The template supports scenario-based adaptation, for example, for the "new employee onboarding" scenario, the template focuses on "post basic authority + compliance verification"; for the "post promotion" scenario, it focuses on "analysis of the difference between new and old post authorities + evaluation of the rationality of expanded authorities", ensuring that the LLM input accurately matches business needs and improves analysis efficiency.

[0074] The authorization management module 300 takes "comparative analysis-risk control-adjustment execution-confirmation landing" as the core link, combined with visual enhancement, to realize the fine control of authority configuration. The specific sub-module functions are as follows Figure 4 As shown in the figure, the authorization management module 300 includes: The authority comparison analysis module 310 is configured to determine an authority comparison prompt strategy based on similar position data corresponding to a user determined by an authority configuration list, and obtain a difference analysis result of the user based on the preset LLM model using the authority comparison prompt strategy.

[0075] The authority comparison analysis module 310 is configured to build an intelligent comparison system of "recommended configuration vs. existing configuration", and generate an authority comparison prompt strategy (such as "compare with the same department and the same post, the current user has 3 more sensitive authorities, which need to be checked") based on similar position data (such as the authority distribution of other users in the same post, department authority baseline) in the authority configuration list.

[0076] The strategy is input into the preset LLM model, combined with the enterprise authority knowledge base, to perform multi-dimensional difference analysis on the existing authority of the user and the recommended authority. In the vertical comparison process, the historical evolution of the user's authority (such as the authority change record in the past 6 months) can be sorted out, and the redundancy caused by the accumulation of authority (such as temporary authority not recovered in time during the handover of the employee) can be identified. In the horizontal comparison process, the authority median of the same organization and the same post can be associated to mark abnormal authority items (such as a user's data export authority level far exceeding the average level of the department). Finally, the difference analysis result including "authority difference, difference cause, and potential impact" is output, providing data support for risk assessment.

[0077] The risk prompt module 320 is configured to determine the permission adjustment parameter corresponding to the permission configuration list by using the difference analysis result, and determine the risk prompt strategy corresponding to the user by using the permission risk value corresponding to the permission adjustment parameter.

[0078] The risk prompt module 320 constructs a hierarchical risk early warning system based on the difference analysis result. Specifically, the permission adjustment parameter (such as the type of the permission to be added, the sensitivity level of the permission to be recovered, and the permission adjustment range) can be extracted from the difference analysis result, and the enterprise risk assessment model is combined to calculate the risk value of each adjusted permission (such as the risk value of 85 points corresponding to the “core data export permission of the financial system”, triggering a high risk warning).

[0079] In the process of generating the risk prompt strategy according to the risk value, when the risk value is low, the notification can be automatically adjusted and pushed (such as “OA system leave application permission has been opened for you”); when the risk value is medium, the administrator can be prompted by a pop-up window for confirmation (such as “Market Department Zhang Mou applies for the customer data export permission of the marketing system, which needs to be approved by the department manager”); and when the risk value is high, the operation can be blocked and a multi-level approval process can be triggered (such as “IT administrator permission change needs to be signed by CTO and information security person in charge”).

[0080] The final risk prompt strategy includes risk details (such as “the permission involves customer privacy data, and historical misuse has led to a data leakage event”) and disposal suggestions (such as “it is suggested to configure a data desensitization rule before opening it again”), which assist decision-making.

[0081] The permission adjustment module 330 is configured to set and update the permission data corresponding to the user by using the permission adjustment parameter.

[0082] The permission adjustment module 330 finally realizes efficient landing of permission change. Specifically, the permission adjustment parameter is used to call the permission interface of each business system to execute permission setting and updating. Specifically, it can involve: Incremental adjustment: adding permission (such as opening “cross-department data viewing right” for project managers); Decreasing adjustment: recovering permission (such as automatically closing the access permission of the original department system after the employee's post is adjusted); Change adjustment: modifying the permission level (such as reducing the “financial query permission” from “full data” to “department dimension”).

[0083] In actual scenarios, batch operations (such as team-wide permission upgrade) and timing tasks (such as automatic recovery of temporary permissions when they expire) can also be supported, and the changes are synchronized in real time to related systems (such as the HR system and the single sign-on platform), ensuring the consistency of the permission state.

[0084] The authorization confirmation module 340 is configured to acquire an authorization confirmation instruction corresponding to the permission data based on the user, and control the user to set the permission according to the permission data based on the authorization confirmation instruction.

[0085] The module can build a complete link of "application-approval-execution". First, an authorization confirmation instruction (such as an electronic approval sheet containing permission change content, risk level, and validity period) can be generated and pushed to the relevant person in charge (such as the user himself / herself, the department manager, and the information security officer). Then, based on the confirmation instruction (agreement / refusal) of the person in charge, the permission adjustment module is controlled to perform corresponding operations: if agreed, triggering the permission setting and recording the operation log (including the operator, operation time, and operation content); if refused, terminating the process and synchronously notifying the user (such as "Your financial system senior query permission application is rejected, reason: the current post does not need this permission").

[0086] Optionally, the authorization management module 300 further comprises a permission configuration preview module 350 configured to acquire a visual page corresponding to the permission configuration list, and display the permission configuration list based on the visual page.

[0087] The permission configuration preview module 350 provides an intuitive permission configuration view. Specifically, based on the permission configuration list, a visual page is generated, and for different types of perspectives, the following is specifically provided: The organization structure perspective shows the permission distribution of all users in the department (such as marking the permission level with different colors); The post perspective compares the permission differences of different users in the same post (such as highlighting the permission over-provisioned user); The user perspective presents the permission matrix of a single user (such as classifying by business system, showing the permission details of each system).

[0088] The module can support interactive operations (such as clicking on the permission item to view details, and dragging to adjust the permission level) and dynamic filtering (such as filtering by risk level and permission type), helping administrators quickly understand the overall configuration and improve decision-making efficiency.

[0089] Through the cooperation of the above sub-modules, the authorization management module 300 realizes the whole-process closed-loop management of the permission change from "finding differences-evaluating risks-executing adjustments-confirming landing", which not only improves the analysis accuracy through LLM, but also reduces the decision threshold through visualization, and finally builds an efficient permission management and control system of "intelligent analysis + manual decision + automatic execution". Specifically as Figure 5 Another structure diagram of a user permission configuration control system is shown, and details are not repeated.

[0090] The present scheme has the following technical effects: In terms of intelligence and personalization, existing technologies usually rely on predefined role templates or simple inheritance rules, lacking personalized configuration for specific users and situations. The user permission configuration control system in the embodiments of the present application can analyze multi-dimensional data using large language models, intelligently generate personalized permission configuration recommendations based on the specific situation of the user (such as position, organizational structure, and permission of similar positions), greatly improving the accuracy and applicability of permission allocation.

[0091] In terms of automation, the permission allocation in existing technologies often requires manual operation by administrators, which is time-consuming and labor-intensive, and prone to errors. The user permission configuration control system in the embodiments of the present application can be highly automated from data collection, permission recommendation to final execution, greatly improving efficiency and reducing human errors.

[0092] In terms of data utilization, existing technologies usually only consider limited factors such as the department or job level to which the user belongs. The user permission configuration control system in the embodiments of the present application can consider multi-dimensional data such as user position information, organizational structure, similar position permissions, and RBAC role definitions, achieving more comprehensive and accurate permission recommendations.

[0093] In terms of flexibility, existing technologies often use rigid rules that are difficult to adapt to complex and changing business needs. The recommendation mechanism based on large language models in the user permission configuration control system of the embodiments of the present application has strong flexibility and can adapt to the organizational structure and business needs of different enterprises.

[0094] From the user permission configuration control system in the above embodiments, it can be seen that the system can fully utilize the user's organizational information, position information, and permission information to automatically generate personalized permission configuration recommendations, and can use relevant language models to assist in configuration, greatly improving the accuracy and applicability of permission allocation.

[0095] The embodiments of the present application also provide a user permission configuration control method, which is applied to the user permission configuration control system mentioned in the above embodiments. The system at least includes a collection processing module, a permission analysis module, and an authorization management module, as shown in Figure 6 The method includes: Step S601, control the collection processing module to obtain the user's organizational information, position information, and permission information from the pre-set identity source interface, identity recognition management interface, and target business interface, respectively; Step S602, control the permission analysis module to construct the user's corresponding permission format data based on the organizational information, position information, and permission information, determine the user's corresponding permission configuration prompt strategy based on the permission format data, and generate the permission configuration list corresponding to the permission format data using the permission configuration prompt strategy; In step S603, the control authorization management module determines the permission comparison prompt strategy corresponding to the user based on the permission configuration list, obtains the permission adjustment parameter corresponding to the permission configuration list using the permission comparison prompt strategy, and sets the permission data corresponding to the user using the permission adjustment parameter.

[0096] In a specific implementation process, the collection processing module can collect user information such as an employee ID, a name, and a mobile phone number, and obtain post information such as a post name and a job level, and obtain organizational structure information such as a department hierarchical relationship and a superior-subordinate relationship when collecting data from an identity source system, such as an enterprise IM system, DingTalk, and Feishu. The same post access application information system is collected from the IAM system, specifically, which applications have been authorized for personnel in the same or similar post to access. The same post permission information, i.e., the existing permission configuration of personnel in the same or similar post, and the business system permission role, i.e., the role and permission set information defined in the business system, are collected from the target business system, i.e., the system that needs to authorize user access, such as an enterprise reimbursement system.

[0097] In the data preprocessing process, the collection processing module can remove duplicate data, process missing values, and achieve unified data format, coding, naming conventions, and fields through data standardization processing. In addition, in the process of forming the permission context information, all related data can be integrated to construct the permission context information.

[0098] The permission analysis module can use LLM analysis processing, and can construct appropriate prompt words to guide the LLM to generate permission configurations as needed.

[0099] Example: Please generate appropriate permission configuration suggestions for the new user based on the following permission context information: 1. User basic information: - Name: {name} - Employee ID: {employee_id} - Department: {department} - Position: {position} - Job Level: {level} 2. Organizational structure information: - Direct Supervisor: {supervisor} - Department Head: {department_head} - Number of Subordinates: {subordinates_count} 3. Same post permission data: {similar_position_permissions} 4. Existing RBAC role definitions: {rbac_roles} Based on the information above, please generate permission configuration suggestions in the following format: 1. Recommended system access permissions; 2. Recommended character list; 3. Recommended specific operation permissions; 4. Explanation of the basis for permission recommendations.

[0100] The input processing can utilize input prompts and preprocessed permission context information, as shown in the following example: { "user_info": { "name": "Zhang San", "employee_id": "EMP001", "department": "Sales Department" "position": "Sales Manager", "level": "M2" }, "org_info": { "supervisor": "Li Si", "department_head": "Wang Wu", "subordinates_count": 5 }, "similar_positions": [ { "employee_id": "EMP002", "position": "Sales Manager", "systems": ["CRM", "OA", "ERP"], "roles": ["sales_manager", "approval_l2"], "permissions": [ "customer_view", "customer_edit", "order_approve", "report_view ] } ], "rbac_roles": [ { "role_name": "sales_manager", "permissions": [ "customer_management", "order_management", "team_management" ] } ]} The output processing process generates a structured permissions configuration manifest, an example of which is as follows: { "recommended_systems": [ { "system_name": "CRM", "reason": "As a sales manager, access to the customer management system is required" }, { "system_name": "OA", "reason": "Daily office affairs and approval matters need to be handled" }, { "system_name": "ERP", "reason": "Sales orders and reports need to be viewed" } ], "recommended_roles": [ { "role_name": "sales_manager", "reason": "The basic role that matches the job responsibilities" }, { "role_name": "approval_l2", "reason": "Approval permissions based on job level" } ], "recommended_permissions": [ { "permission": "customer_view", "reason": Basic permissions to view customer information }, { "permission": "customer_edit", "reason": "Managing and maintaining customer information" }, { "permission": "order_approve", "reason": "Sales order approval authority" }, { "permission": "report_view", "reason": "Permission to view sales reports" } ], "recommendation_basis": [ "Based on the existing permission configuration of user EMP002 in the same position", "Meets the standard role definition for a sales manager" "Considering the team management needs based on the number of direct subordinates", "Meets the approval authority requirements for M2 level positions" ]} During the authorization management process, after generating recommended permission configurations, the permission configurations for similar positions can be visualized and compared intuitively. Specifically, a large-scale model can analyze the permission configuration data of both to identify differences. The recommended permission configurations are displayed visually, showing the permission list. The permission comparison analysis primarily involves comparing the permissions with those of similar positions.

[0101] The permission comparison prompts are constructed as follows: { "current_recommendation": { "systems": ["CRM", "OA", "ERP"], "roles": ["sales_manager", "approval_l2"], "permissions": ["customer_view", "customer_edit", "order_approve", "report_view"] }, "similar_position": { "employee_id": "EMP002", "systems": ["CRM", "OA", "ERP", "Knowledge_Base"], "roles": ["sales_manager", "approval_l2", "content_contributor"], "permissions": ["customer_view", "customer_edit", "order_approve", "report_view", "article_edit"] }} Please analyze the differences between the following two sets of permission configurations: 1. Recommended permission configuration: {current_recommendation}; 2. Existing permission configurations for the same position: {similar_position}; Please provide: 1. List of permission differences; 2. Possible reasons for the differences; 3. Adjustment suggestions.

[0102] The specific results of the LLM difference analysis are as follows: { "difference_analysis": { "missing_permissions": [ { "system": "Knowledge_Base", "role": "content_contributor", "permissions": ["article_edit"], "possible_reason": "Existing staff in the same role may have taken on additional responsibilities for maintaining the knowledge base content."} ], "extra_permissions": [], "similarity_score": "80%", "risk_level": "Low risk" }, "adjustment_suggestions": [ { "action": "Consider adding knowledge base access permissions", "reason": "This permission is generally available to employees in the same position, and may be related to the knowledge-sharing responsibilities of the sales manager position." "priority": "medium" } ]} In practical scenarios, a manual intervention mechanism can be added to grant permissions, allowing administrators to manually adjust permissions and record the reasons for the adjustments and operation logs. A confirmation mechanism can also be added, providing users with confirmation and rejection options.

[0103] For details of the above process, please refer to [link / reference]. Figure 7 The flowchart of another user permission configuration control method is not described in detail here.

[0104] As can be seen from the above user permission configuration control method, this method can make full use of users' organizational information, job information and permission information to automatically generate personalized permission configuration suggestions, and can use relevant language large models for auxiliary configuration, which greatly improves the accuracy and applicability of permission allocation.

[0105] The user permission configuration control method provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned user permission configuration control system embodiment. For the sake of brevity, any parts not mentioned in the system embodiment can be referred to the corresponding content in the aforementioned user permission configuration control system embodiment.

[0106] This embodiment also provides a server, the structural diagram of which is shown below. Figure 8 As shown, the device includes a processor 101 and a memory 102; wherein, the memory 102 is used to store one or more computer instructions, which are executed by the processor to implement the steps of the above-described user permission configuration control method.

[0107] Figure 8The illustrated server also includes a bus 103 and a communication interface 104, the processor 101, the communication interface 104 and the memory 102 are connected through the bus 103.

[0108] The memory 102 can contain a high-speed random access memory (RAM), and can also include a non-volatile memory, such as at least one disk memory. The bus 103 can be an ISA bus, a PCI bus, or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0109] The communication interface 104 is used to connect with at least one user terminal and other network units through a network interface, and send the encapsulated IPv4 packet or IPv4 packet to the user terminal through the network interface.

[0110] The processor 101 can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by integrated logic circuits of hardware in the processor 101 or instructions in the form of software. The above processor 101 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. Each method, step and logic block disclosed in the embodiment of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiment of the present disclosure can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, or other mature storage media in the art. The storage medium is located in the memory 102, and the processor 101 reads the information in the memory 102, and combines the hardware to complete the steps of the method of the above embodiment.

[0111] The embodiment of the present application further provides a storage medium, which stores a computer program, and the computer program is run by a processor to execute the steps of the user permission configuration control method in the foregoing embodiment.

[0112] In several embodiments provided in the present application, it should be understood that the disclosed system, device, apparatus and method can be implemented by other manners. The system embodiments described above are only illustrative, for example, the division of the units is only a logical function division, and another division manner can be used in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interfaces, devices or units, and can be electrical, mechanical or other forms.

[0113] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, can be located in one place or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0114] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0115] If the functions are realized in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer readable storage medium executable by a processor. Based on this understanding, the technical solutions of the present application or the part of the present application which essentially contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0116] Finally, it should be noted that the above-described embodiments are merely specific embodiments of the present application, which are used to illustrate the technical solutions of the present application, but not to limit the same. The protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that any person skilled in the art can still modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features, within the technical scope disclosed by the present application. The modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A user rights configuration control system, characterized by, The system comprises: The acquisition processing module is used for acquiring the organization information, post information and permission information of the user from the preset identity source interface, identity recognition management interface and target service interface respectively; The permission analysis module is used for constructing the permission format data corresponding to the user according to the organization information, post information and permission information, determining the permission configuration prompt strategy corresponding to the user based on the permission format data, and generating the permission configuration list corresponding to the permission format data by using the permission configuration prompt strategy; The authorization management module is used for determining the permission comparison prompt strategy corresponding to the user based on the permission configuration list, acquiring the permission adjustment parameter corresponding to the permission configuration list by using the permission comparison prompt strategy, and setting the permission data corresponding to the user by using the permission adjustment parameter.

2. The user rights configuration control system of claim 1, wherein, The acquisition processing module comprises a data acquisition module and a data preprocessing module; wherein the input end of the data acquisition module is connected with the identity source interface, the identity recognition management interface and the target service interface, and the output end of the data acquisition module is connected with the input end of the data preprocessing module; the output end of the data preprocessing module is connected with the permission analysis module; The data acquisition module is used for acquiring the organization information, post information and permission information corresponding to the user from the preset identity source interface, identity recognition management interface and target service interface; The data preprocessing module is used for constructing the permission context information corresponding to the organization information, post information and permission information after processing the repeated data and missing values in the organization information, post information and permission information according to the preset data format.

3. The user rights configuration control system of claim 2, wherein, The data acquisition module comprises: The identity source data acquisition module is used for acquiring the user information, post information and organizational structure information corresponding to the user through the identity source interface, and determining the organization information based on the user information, post information and organizational structure information; The identity recognition data acquisition module is used for acquiring the same post access application information corresponding to the user through the identity recognition management interface, and determining the post information based on the same post access application information; The target service data acquisition module is used for acquiring the post permission information and permission role information corresponding to the user through the target service interface, and determining the permission information based on the post permission information and permission role information.

4. The user rights configuration control system of claim 2, wherein, The data preprocessing module comprises: The data cleaning module is used for determining the repeated data and missing data contained in the organization information, post information and permission information, performing de-duplication processing on the repeated data, determining the missing value corresponding to the missing data based on the organization information, post information and permission information, and updating the missing data by using the missing value; The data standardization module is configured to determine data coding parameters, data naming parameters, and field setting parameters according to the preset data format, and to obtain standard input data corresponding to the user by performing format processing on the organization information, the post information, and the permission information that have been subjected to data cleaning, by using the data coding parameters, the data naming parameters, and the field setting parameters. The context information acquisition module is configured to acquire the permission context information corresponding to the standard input data by using a preset LLM model.

5. The user rights configuration control system of claim 1, wherein, The permission analysis module includes: The input processing module is configured to construct the permission context information corresponding to the user according to the organization information, the post information, and the permission information input from the collection processing module, and to determine the permission format data by using the permission context information. The analysis processing module is configured to determine the permission configuration prompt strategy by using the user information data, the organization information data, the similar post data, and the permission control data corresponding to the user, which are determined by using the permission format data, and to perform permission analysis on the user by using the permission configuration prompt strategy and based on a preset LLM model. The permission recommendation module is configured to acquire a permission analysis result corresponding to the LLM model, and to determine the permission recommendation data corresponding to the user by using the permission analysis result. The output processing module is configured to acquire a formatting parameter corresponding to the permission configuration prompt strategy, and to acquire the permission configuration list corresponding to the permission recommendation data by using the formatting parameter.

6. The user rights configuration control system of claim 5, wherein, The permission analysis module further includes a permission configuration prompt word construction module. The permission configuration prompt word construction module is configured to construct a permission configuration prompt template corresponding to the LLM model according to identifiers corresponding to the user information data, the organization information data, the similar post data, and the permission control data, wherein the permission configuration prompt template is used to generate the permission configuration prompt strategy.

7. The user rights configuration control system of claim 1, wherein, The authorization management module includes: The permission comparison analysis module is configured to determine the permission comparison prompt strategy according to the similar post data corresponding to the user, which is determined by using the permission configuration list, and to acquire a difference analysis result of the user by using the permission comparison prompt strategy and based on a preset LLM model. The risk prompt module is configured to determine the permission adjustment parameter corresponding to the permission configuration list by using the difference analysis result, and to determine the risk prompt strategy corresponding to the user by using a permission risk value corresponding to the permission adjustment parameter. The permission adjustment module is configured to set and update the permission data corresponding to the user by using the permission adjustment parameter. The authorization confirmation module is configured to acquire an authorization confirmation instruction corresponding to the user based on the permission data, and to control the user to set permissions according to the permission data based on the authorization confirmation instruction.

8. The user rights configuration control system of claim 7, wherein, The authorization management module further includes: The permission configuration preview module is configured to acquire a visual page corresponding to the permission configuration list, and to display the permission configuration list based on the visual page.

9. A user authority configuration control method characterized by, The method is applied to the user right configuration control system according to any one of claims 1 to 8, and the system at least comprises a collection processing module, a right analysis module and an authorization management module; The method comprises: controlling the collection processing module to acquire organizational information, post information and right information of a user from a preset identity source interface, an identity recognition management interface and a target service interface respectively; controlling the right analysis module to construct right format data corresponding to the user according to the organizational information, the post information and the right information, to determine a right configuration prompt strategy corresponding to the user based on the right format data, and to generate a right configuration list corresponding to the right format data by using the right configuration prompt strategy; controlling the authorization management module to determine a right comparison prompt strategy corresponding to the user based on the right configuration list, to acquire a right adjustment parameter corresponding to the right configuration list by using the right comparison prompt strategy, and to set right data corresponding to the user by using the right adjustment parameter.

10. A server, characterized by comprise a processor and a memory, the memory stores computer executable instructions capable of being executed by the processor, and the processor executes the computer executable instructions to implement the steps of the user right configuration control method in claim 9.

Images