User permission verification method and system based on generative AI session mode

Abstract

The invention relates to the technical field of artificial intelligence, and discloses a user permission verification method and system based on a generative AI session mode, and the method comprises the steps: receiving permission request information and a dynamic access environment fingerprint generated by a permission request user through a generative AI session interface, analyzing the current operation sensitivity based on a request resource and an operation intention, and carrying out the verification of the current operation sensitivity; based on the user identity, performing authorizable level verification on the permission demand level to obtain an initial authorization level; evaluating an environment risk level of a permission request environment corresponding to the permission request user by using the dynamic access environment fingerprint; and querying a historical request behavior of the limited request user, and based on the historical request behavior, the current operation sensitivity and the environmental risk level, calculating an authority granting risk value so as to perform secondary authorizable level verification on the initial authorization level to obtain a target authority level. According to the invention, the user access authority can be dynamically adjusted.

Description

TECHNICAL FIELD

[0001] The application relates to a user permission verification method and system based on a generative AI conversation mode, and belongs to the technical field of artificial intelligence. BACKGROUND

[0002] In many scenarios such as financial security, enterprise office and government affairs system, efficient and intelligent identity authentication and permission management through natural language interaction have become the core demand for guaranteeing data security, improving system reliability and optimizing user experience.

[0003] Currently, user permission verification mainly relies on traditional authentication methods, which use static verification methods such as username and password, SMS verification code or biometric features, combined with pre-defined permission rules for access control. For example, in an enterprise system, an administrator manually configures user permission levels through a role-based access control (RBAC) model. However, with the increasing complexity of network attack methods and the diversification of user scenarios, traditional methods cannot intelligently and flexibly respond to dynamic changes in business requirements and personalized permission scenarios, thus lacking the ability to dynamically adjust user access permissions. SUMMARY

[0004] The application provides a user permission verification method and system based on a generative AI conversation mode, which mainly aims to dynamically adjust user access permissions.

[0005] To achieve the above purpose, the user permission verification method based on the generative AI conversation mode provided by the application comprises the following steps: Receiving permission request information and dynamic access environment fingerprints generated by a permission request user through a generative AI conversation interface, wherein the generative AI conversation interface comprises a user identity recognition unit, a resource query unit and an operation analysis unit, the user identity recognition unit is used to identify the user identity of the permission request user, the resource query unit is used to query the request resource of the permission request user, and the operation analysis unit is used to analyze the operation intention of the permission request user; Based on the request resource and the operation intention, analyzing the permission requirement level and the current operation sensitivity of the permission request user, and based on the user identity, performing authorized level verification on the permission requirement level to obtain an initial authorized level; Using the dynamic access environment fingerprints to evaluate the environmental risk level of the permission request environment corresponding to the permission request user; According to the user identity, a history request behavior of the permission request user is queried, a permission granting risk value of the permission request user is calculated based on the history request behavior, the current operation sensitivity and the environment risk level, a secondary authorization level check is performed on the initial authorization level based on the permission granting risk value, and a target permission level is obtained.

[0006] Optionally, based on the request resource and the operation intention, a permission demand level of the permission request user and a current operation sensitivity are analyzed, including: The request resource and the operation intention are subjected to deep semantic analysis to obtain a resource keyword and an operation type; The resource keyword and the operation type are subjected to dictionary matching to obtain a request resource demand level and an operation type demand level; Based on the request resource demand level and the operation type demand level, the permission demand level of the permission request user is determined; Based on the operation type, a current operation risk matrix of the permission request user is constructed; The current operation risk matrix is used to determine the current operation sensitivity of the permission request user.

[0007] Optionally, based on the user identity, an authorization level check is performed on the permission demand level to obtain an initial authorization level, including: The user identity is subjected to role permission mapping to obtain a user reference permission level; The permission demand level and the user reference permission level are subjected to minimum permission intersection calculation to obtain a theoretical authorization range; The theoretical authorization range is subjected to dynamic strategy rule matching to obtain the initial authorization level.

[0008] Optionally, the dynamic access environment fingerprint is used to evaluate an environment risk level of a permission request environment corresponding to the permission request user, including: Multi-dimensional features of the dynamic access environment fingerprint are extracted to obtain an environment feature vector; The environment feature vector is subjected to real-time abnormal information comparison to obtain an abnormal matching index; The abnormal matching index is used to calculate an environment abnormal score of the permission request environment corresponding to the permission request user; The environment abnormal score is subjected to dynamic weight calculation to obtain the environment risk level.

[0009] Optionally, the environment feature vector is subjected to real-time abnormal information comparison to obtain an abnormal matching index, including: The environment feature vector is subjected to multi-dimensional abnormal information comparison to obtain a multi-dimensional difference vector; construct a quantitative index of the environment feature vector by using the multi-dimensional difference vector; perform dynamic weighted aggregation on the quantitative index by using the following formula to obtain an abnormal matching index: ; wherein, represents a standardized abnormal score, represents a device threat score in the quantitative index, represents an IP risk level in the quantitative index, represents a location credibility in the quantitative index, represents a time abnormality probability in the quantitative index, represents a weight coefficient of a weight coefficient of a weight coefficient of a weight coefficient of a weight coefficient of a weight coefficient of a weight coefficient of

[0010] Optionally, the environment abnormal score of the permission request environment corresponding to the permission request user is calculated by using the abnormal matching index, comprising: perform dynamic baseline normalization processing on the abnormal matching index to obtain a standard abnormal value; perform adversarial sample detection processing on the standard abnormal value to obtain an anti-interference abnormal value; perform multi-modal fusion on the anti-interference abnormal value to obtain a preliminary abnormal score; perform dynamic range compression on the preliminary abnormal score to obtain an environment abnormal score.

[0011] Optionally, based on the historical request behavior, the current operation sensitivity and the environment risk level, a permission granting risk value of the permission request user is calculated, comprising: perform feature standardization processing on the historical request behavior, the current operation sensitivity and the environment risk level to obtain a standardized feature vector; perform time-varying weighted fusion on the standardized feature vector by using the following formula to obtain a dynamic weight: ; wherein, represents a dynamic weight of the standardized feature vector calculated at the tth time, represents a time decay factor calculated at the tth time, represents an importance coefficient of the i th standardized feature vector, represents a standardized function output value of the i th standardized feature vector, denotes the dynamic weight of the normalized feature vector calculated for the first time, and n denotes the number of categories of the normalized feature vector; The dynamic weight is used to calculate a permission granting risk value of the permission requesting user.

[0012] Optionally, based on the permission granting risk value, a secondary authorized level check is performed on the initial authorized level to obtain a target permission level, including: The permission granting risk value is dynamically segmented and coded to obtain a risk feature vector; The risk feature vector is subjected to permission decision mapping to obtain a decision vector; The decision vector is subjected to dynamic weight correction to obtain a correction vector; The correction vector is used to calculate a level adjustment value of the initial authorized level; Based on the level adjustment value, the initial authorized level is subjected to level adjustment to obtain a target permission level.

[0013] Optionally, the dynamic segmentation and coding of the permission granting risk value to obtain a risk feature vector includes: The permission granting risk value is dynamically divided into intervals to obtain risk interval membership degrees; The risk interval membership degrees are subjected to time sequence feature fusion to obtain an enhanced feature vector; The enhanced feature vector is subjected to cross-dimension splicing to obtain an original feature matrix; The original feature matrix is subjected to layer normalization to obtain a risk feature vector.

[0014] To solve the above problems, the application further provides a user permission verification system based on a generative AI conversation mode, which comprises: A user information acquisition module is configured to receive permission request information and a dynamic access environment fingerprint generated by a permission requesting user through a generative AI conversation interface, wherein the generative AI conversation interface comprises a user identity recognition unit, a resource query unit and an operation analysis unit, the user identity recognition unit is configured to recognize the user identity of the permission requesting user, the resource query unit is configured to query the request resource of the permission requesting user, and the operation analysis unit is configured to analyze the operation intention of the permission requesting user. An initial permission verification module is configured to analyze the permission demand level and the current operation sensitivity of the permission requesting user based on the request resource and the operation intention, perform authorized level check on the permission demand level based on the user identity to obtain an initial authorized level. ​An environmental risk analysis module is configured to evaluate an environmental risk level of a permission request environment of the permission request user by using the dynamic access environment fingerprint. A permission final verification module is configured to query historical request behaviors of the permission request user according to the user identity, calculate a permission granting risk value of the permission request user based on the historical request behaviors, the current operation sensitivity and the environmental risk level, perform secondary authorized level verification on the initial authorized level based on the permission granting risk value, and obtain a target permission level.

[0015] Compared with the problems described in the background art, the application first integrates NLP and multi-modal interaction technology through a generative AI conversation interface, converts a natural language request into a structured permission instruction, extracts resource keywords, operation types and identity identifiers, and constructs a three-dimensional data foundation of "user intent-resource-environment" to realize intelligent analysis of user permission requests; abstract permission requests are converted into a calculable permission requirement level, a sensitivity level is generated through an operation risk matrix (operation type x data flow x environmental risk) to realize fine measurement of risks, and a theoretical authorized range is generated by taking the intersection of the user role and the permission requirement level (for example, taking L4 as the user benchmark L4 and the requirement L5), and then the Drools rule engine is dynamically adjusted (night access is reduced by one level) to ensure that the initial authorization does not break the identity permission boundary; further, the application dynamically weights three-dimensional features of devices, networks and time to identify abnormal scenarios such as cross-regional login and unknown devices, and upgrades environmental risk from single IP detection to multi-dimensional feature fusion evaluation to reduce environmental risk misjudgment rate and provide real-time security context for permission granting; further, the application calculates a permission granting risk value by fusing historical request behaviors (such as high-frequency abnormal request proportion), operation sensitivity and environmental risk level through a time-varying weighting model (dynamic weight decays over time), and generates a target permission level through dynamic segmented coding and reinforcement learning correction to adaptively assign weights in each dimension to make the final authorized level more matched with the actual risk. Therefore, the application can dynamically adjust user access permissions. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A flowchart of a user permission verification method based on a generative AI conversation method provided by an embodiment of the application is shown. Figure 2 A module diagram of the user permission verification method based on the generative AI conversation method is shown.

[0017] The purpose implementation, functional features and advantages of the application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0018] It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

[0019] The embodiment of the present application provides a user permission verification method based on a generative AI conversation mode. The execution subject of the user permission verification method based on the generative AI conversation mode includes but is not limited to at least one of the electronic devices such as a server, a terminal and the like which can be configured to execute the method provided by the embodiment of the present application. In other words, the user permission verification method based on the generative AI conversation mode can be executed by software or hardware installed in a terminal device or a server device. The server includes but is not limited to a single server, a server cluster, a cloud server or a cloud server cluster and the like.

[0020] Embodiment 1 Referring to Figure 1 Fig. 1 shows a flowchart of the user permission verification method based on the generative AI conversation mode provided by an embodiment of the present application. In the embodiment, the user permission verification method based on the generative AI conversation mode includes: S1, receiving permission request information and dynamic access environment fingerprints generated by a permission request user through a generative AI conversation interface, wherein the generative AI conversation interface includes a user identity recognition unit, a resource query unit and an operation analysis unit, the user identity recognition unit is used to identify the user identity of the permission request user, the resource query unit is used to query the request resource of the permission request user, and the operation analysis unit is used to analyze the operation intention of the permission request user.

[0021] By receiving the permission request information and the dynamic access environment fingerprints generated by the permission request user through the generative AI conversation interface, the embodiment of the present application can accurately extract core information such as user identity, resource and operation intention from the user request, simultaneously collect dynamic environment data such as device information, geographical position and access time, provide multi-dimensional basic data support for subsequent permission verification, and ensure the accuracy and real-time performance of permission control.

[0022] The generated AI conversation interface refers to an intelligent interaction program integrating natural language processing, multi-modal interaction, and permission semantic analysis. It converts user natural language requests into structured permission instructions through generated artificial intelligence technology. The permission request information refers to specific content related to permission application submitted by the user through the generated AI conversation interface, including core elements such as operations expected to be performed (such as "export data"), target resources (such as "customer database"), and identity (such as employee number, account number). The dynamic access environment fingerprint refers to a real-time environment data set generated along with the permission request, including device hardware information (such as terminal model, IP address), geographic location (such as GPS coordinates, network base station), access time (such as specific time, time period), etc.

[0023] Further, the generated AI conversation interface includes a user identity recognition unit, a resource query unit, and an operation analysis unit. The user identity recognition unit is used to identify the user identity of the permission request user. The resource query unit is used to query the request resource of the permission request user. The operation analysis unit is used to analyze the operation intention of the permission request user.

[0024] It should be further noted that the generated AI conversation interface is deployed by a front-end interaction device, an edge computing node, and a back-end infrastructure. The front-end interaction device can deploy a multi-modal interaction engine, such as the Whisper model and the DeepSpeech model, to convert user voice into text. The GPT-4 / LLaMA large language model is used to analyze user intention. The edge computing node can deploy edge computing devices such as NVIDIA Jetson AGX Orin. The back-end infrastructure can deploy a cloud computing platform and distributed storage.

[0025] S2, based on the request resource and the operation intention, analyzing the permission demand level and the current operation sensitivity of the permission request user, based on the user identity, performing authorized level checking on the permission demand level to obtain an initial authorized level.

[0026] The embodiment of the application can quantify the risk level of the permission request by analyzing the permission demand level and the current operation sensitivity of the permission request user based on the request resource and the operation intention, providing accurate risk assessment basis for fine-grained permission control.

[0027] The permission requirement level is a permission control strength index calculated based on the sensitivity of the requested resource and the risk level of the operation type, and the current operation sensitivity is a core parameter of dynamic risk assessment in permission verification, which refers to the potential influence degree of the specific operation behavior requested by the user on system security and data privacy, combined with operation type, data flow direction and execution environment and other factors.

[0028] As an embodiment of the present application, based on the requested resource and the operation intention, the permission requirement level and the current operation sensitivity of the permission request user are analyzed, including: Deep semantic analysis is performed on the requested resource and the operation intention to obtain resource keywords and operation types; Dictionary matching is performed on the resource keywords and the operation types to obtain a requested resource requirement level and an operation type requirement level; Based on the requested resource requirement level and the operation type requirement level, the permission requirement level of the permission request user is determined; Based on the operation type, a current operation risk matrix of the permission request user is constructed; The current operation risk matrix is used to determine the current operation sensitivity of the permission request user.

[0029] The resource keywords refer to core words or phrases that identify target resources extracted from user permission requests through semantic analysis, and the current operation risk matrix refers to a multi-dimensional risk assessment model constructed with operation type as the core dimension, superimposed with variables such as data flow direction, environmental risk and operation scale.

[0030] In the implementation process, the BERT model based on the Transformer architecture can be used for word segmentation and word embedding processing of user requests, the resource entity (such as "customer list" and "financial statement") is located through the named entity recognition (NER) technology, and then the verb phrase is extracted by using the dependency syntax analysis, and the core operation type (such as "export", "modify" and "delete") is identified in combination with the enterprise business dictionary, for example, the user request "I need to delete the test data of the 2023 R&D project", the system parses the resource key words "2023 R&D project test data" and the operation type "delete"; the parsed resource key words are matched with the resource hierarchical dictionary in the enterprise knowledge graph (such as Neo4j) in a fuzzy manner, the sensitivity level (L1-L5) is determined according to the label with the highest matching degree, and the operation type is mapped to the predefined risk coefficient dictionary (such as "view" corresponding to 0.5 and "delete" corresponding to 2.0); the comprehensive risk value is calculated by using a multi-factor weighted model, the basic formula is permission requirement level = resource level × operation coefficient × environment correction factor, wherein the environment factor is dynamically adjusted according to the access period (such as night × 1.3), IP attribution (such as overseas × 1.5) and the like, and the final level is determined through a threshold mapping rule (such as ≤2.5 for L1, 2.5-5 for L2, etc.), for example, L3 × 2.0 × 1.3 (night factor) = 7.8, which is rounded up to L8 permission requirement, triggering the highest level of approval process; an N×N matrix is constructed with the operation type as the row dimension (such as view / export / modify / delete) and the column dimension (such as internal storage / external transmission, operation scale (single / batch), environment risk (trusted / untrusted) and the like); the operation type is taken as the row dimension (such as view / export / modify / delete), and the column dimension (such as internal storage / external transmission, operation scale (single / batch), environment risk (trusted / untrusted) and the like) is superimposed to construct an N×N matrix; the risk values (0-1) of each cell are filled by using the real-time collected environment data (such as IP credit, device fingerprint); the gradient boosting tree model (such as XGBoost) is pre-trained to map the matrix risk value to the sensitivity level (such as: low / medium / high / very high).

[0031] Further, the initial authorization level is checked based on the user identity, and the initial authorization level is obtained, so as to realize the matching verification of the user identity and the permission requirement, thereby generating a temporary authorization state conforming to the identity permission boundary.

[0032] The initial authorization level refers to the initial permission level assigned to the user by the permission verification system after verifying the user identity of the permission request user.

[0033] As an embodiment of the present application, based on the user identity, the authorized level of the permission requirement level is checked to obtain an initial authorized level, including: The user identity is mapped to a role permission to obtain a user reference permission level; The permission requirement level and the user reference permission level are calculated by the minimum permission intersection to obtain a theoretical authorized range; The initial authorized level is obtained by matching the dynamic strategy rule to the theoretical authorized range.

[0034] The user reference permission level refers to the basic permission level generated by user identity (such as role, position or department) mapping, which is usually represented by a numerical value (such as L1-L10) or a permission bit mask (such as 0b1010), and is a static permission baseline preset by the system. The theoretical authorized range refers to the intersection result of the user reference permission and the request permission, which is generated by taking the minimum value or performing a bitwise AND operation on the permission bit mask, representing the maximum compliance authorization boundary when the dynamic strategy is not considered.

[0035] In the specific implementation process, the organization role (such as “financial supervisor”) to which the user belongs can be queried first, and then the role name is associated and matched with the reference level field (such as role_base_level) in the MySQL permission dictionary table to obtain the user reference permission level. For example, the user ID “u1234” is parsed as a “financial supervisor” role through LDAP, and the permission dictionary table returns the reference permission level L4 (corresponding to the accessible “financial report” class resource). The minimum value of the user reference permission level (such as L4) and the permission requirement level (such as L5) converted into numerical values is taken to generate the upper limit of the theoretical authorized range. The theoretical authorized result is input into the Drools rule engine to match the predefined dynamic strategy (such as “additional approval is required for accessing L4 resources during non-working hours”), and the final authorized level and additional items are adjusted through the modify() command of the rule engine. For example, the theoretical authorized level is L4, but the current time is 20:00, which triggers the “night high-sensitive resource access” rule, and the final initial authorized level is adjusted to “L3 (temporary downgrade) + pending manager approval”.

[0036] S3, using the dynamic access environment fingerprint, evaluating the environmental risk level of the permission request environment corresponding to the permission request user.

[0037] The embodiment of the present application can quantify the security risk of the user permission request environment by using the dynamic access environment fingerprint to evaluate the environmental risk level of the permission request environment corresponding to the permission request user, so as to ensure that the permission authorization is performed in a safe environment and avoid unauthorized access or malicious operation in a high-risk environment.

[0038] The environment risk level refers to a quantitative value calculated based on a dynamic access environment fingerprint (such as device abnormal login record, untrusted network environment or IP address change frequency, etc.), used to represent the security abnormality degree of the permission request environment, and the higher the value, the more likely the environment has security risks such as malicious access and device tampering.

[0039] As an embodiment of the present application, the dynamic access environment fingerprint is used to evaluate the environment risk level of the permission request environment corresponding to the permission request user, including: extracting multi-dimensional features of the dynamic access environment fingerprint to obtain an environment feature vector; performing real-time abnormal information comparison on the environment feature vector to obtain an abnormal matching index; using the abnormal matching index to calculate the environment abnormal score of the permission request environment corresponding to the permission request user; performing dynamic weight calculation on the environment abnormal score to obtain the environment risk level.

[0040] The environment feature vector refers to a numerical set composed of multi-dimensional attributes in the dynamic access environment, used to represent the environment state at the time of permission request. The abnormal matching index refers to a quantitative index generated by comparing the environment features with known abnormal intelligence, reflecting the matching degree of potential risks in the environment. The environment abnormal score refers to a quantitative value of the environment abnormality degree calculated based on the abnormal matching index and the user historical behavior baseline, used to measure the deviation degree from the normal mode of the current access.

[0041] In specific implementation, the multi-dimensional feature vector can be constructed by collecting hardware fingerprints (such as CPU serial number, BIOS version) through device drivers, obtaining the IP geographic location and ISP information of the user through the network protocol stack, and recording the login timestamp. The dynamic weights (such as sensitive period weight 0.4, IP risk weight 0.35) are assigned to each risk dimension through the analytic hierarchy process (AHP), and the abnormal score is weighted and summed and then mapped to the risk level interval (such as 0-30 for low risk). For example, the abnormal score vector [device risk 85, IP risk 90, period risk 75] is multiplied by the weight vector [0.35, 0.4, 0.25] to obtain a score of 84.75, which is mapped to the "high risk (red)" level.

[0042] Preferably, the real-time abnormal information comparison on the environment feature vector to obtain the abnormal matching index includes: performing multi-dimensional abnormal information comparison on the environment feature vector to obtain a multi-dimensional difference vector; using the multi-dimensional difference vector to construct a quantitative index of the environment feature vector; The abnormal matching index is obtained by dynamically weighting and aggregating the quantitative indicators using the following formula: ; wherein, represents a standardized abnormal score, represents a device threat score in the quantitative indicators, represents an IP risk level in the quantitative indicators, represents a location credibility in the quantitative indicators, represents a time abnormality probability in the quantitative indicators, represents a weight coefficient of represents a weight coefficient of represents a weight coefficient of represents a weight coefficient of represents a weight coefficient of represents a weight coefficient of represents a weight coefficient of .

[0043] wherein, the multi-dimensional difference vector refers to an ordered set of difference values in each dimension generated by comparing the real-time collected environment feature vector with the historical behavior baseline in multiple dimensions, and the quantitative indicators refer to a structured indicator set mapped from the multi-dimensional difference vector to a standardized risk score.

[0044] In the implementation process, the real-time collected environment feature vector (such as device ID, IP address, etc.) can be compared with the user historical behavior baseline (such as a set of commonly used devices, IP attribution) dimension by dimension, the difference values in each dimension are calculated to form a multi-dimensional difference vector, for example, the user usually uses Beijing IP (114.114.114.114) and iPhone device login, the current login IP is Shanghai (116.234.56.78) and the device is an Android phone, the device difference value is 0.8, the IP difference value is 0.9, and the difference vector [0.8, 0.9, 0, 0] is formed; the multi-dimensional difference vector is mapped to a standardized quantitative indicator (such as 0-100 points), including a device threat score, an IP risk level, a location credibility, and a time abnormality probability, etc., each indicator corresponds to a risk quantization result in one dimension, for example, the device difference value 0.8 is mapped to the device threat score 80 points (unknown device), the IP difference value 0.9 is mapped to the IP risk level 90 points (cross-region login), and the location and time dimensions have no difference, so the corresponding indicator is 0 points.

[0045] It should be noted that the abnormal matching index calculation formula is obtained by dynamically weighting and aggregating multi-dimensional quantitative indicators (device threat score, IP risk level, etc.), integrating scattered risk signals into a comprehensive risk value, and reflecting the matching degree of the current environment and abnormal mode. The abnormal matching index calculation formula is essentially a multi-factor risk linear combination model, which adjusts the contribution of each dimension to the final result through weights, thereby converting multi-dimensional risk into a single numerical value of 0-100, directly reflecting the abnormal degree (such as index ≥ 80 is judged as high risk), and also avoiding single dimension misjudgment (such as only IP abnormality may be caused by business trip). For example, in the financial business scenario, the weight configuration is α=0.3, β=0.4, γ=0.2, δ=0.1, and the calculation of the abnormal matching index is 0.3×80+0.4×90+0.2×0+0.1×0=60 points, that is, the current environment abnormal matching index is 60.

[0046] It should be further explained that the weight coefficients in the abnormal matching index calculation formula are obtained by learning the contribution of each dimension to the abnormality through models such as logistic regression and gradient boosting tree using historical abnormal event data (such as labeled attack / normal samples). For example, input: feature values such as "device threat score" and "IP risk level" in historical attack events, output: whether it is abnormal (0 / 1), and after training, the weight coefficients are obtained: α1 (device)=0.3, α2 (IP)=0.35, α3 (location)=0.2, α4 (time)=0.15.

[0047] Further, as another optional embodiment of the present application, the use of the abnormal matching index to calculate the environment abnormal score of the permission request environment corresponding to the permission request user comprises: performing dynamic baseline normalization processing on the abnormal matching index to obtain a standard abnormal value; performing adversarial sample detection processing on the standard abnormal value to obtain an anti-interference abnormal value; performing multi-modal fusion on the anti-interference abnormal value to obtain a preliminary abnormal score; performing dynamic range compression on the preliminary abnormal score to obtain an environment abnormal score.

[0048] The standard abnormal value refers to the standardized numerical value obtained by dynamically normalizing the original abnormal matching index, which is used to eliminate the baseline difference of different users or scenes, so that the abnormal degree can be compared across scenes. The anti-interference abnormal value refers to the abnormal value corrected by eliminating the fake or interference features through adversarial sample detection based on the standard abnormal value. The preliminary abnormal score refers to the comprehensive risk indicator generated by fusing the anti-interference abnormal value with multi-modal data (such as biological features, behavior time sequence, and environment attributes).

[0049] In the implementation process, the abnormal matching index (such as 0-100 points) can be compared with the historical environmental risk baseline (such as an average abnormal index of 40 points), and the Z-score standardization formula is used to convert it into a standard normal distribution value, eliminating the influence of individual differences, for example, the abnormal index of a user's regular login is 30-50 points, and the abnormal matching index of a certain login is 80 points, and after normalization, the standard abnormal value is 3.0 (far more than the average value 3 sigma), indicating that this time the environmental abnormality is significant; through the generation of the adversarial network (GAN), it is detected whether there is an artificially constructed abnormal feature (such as a fake device fingerprint), and the suspicious sample is verified for feature reconstruction and verification, and an anti-interference abnormal value is generated, for example, the abnormal matching index of a certain request is 75 points, but the GAN detects that the device fingerprint and the IP behavior mode have antagonistic features (such as high-end devices using low-quality proxy IP), and the abnormal value is corrected to 85 points; the anti-interference abnormal value is weighted and fused with other modal data (such as biological characteristics, behavior timing), the attention mechanism is used to allocate the weight of each mode, and a preliminary abnormal score is generated, for example, the anti-interference abnormal value is 85 points, but the keyboard input rhythm matches the historical mode by 90% (the behavior mode weight is 0.3), and the preliminary abnormal score after fusion = 85x0.7 + 15x0.3 = 64 points; the preliminary abnormal score (the range may be larger) is compressed to the standard interval of 0-100 points through the Sigmoid function (f(x) = 100 / (1 + e^(-k(x-m))), wherein k controls the steepness of the curve, and m controls the center offset), and the compression parameters are adjusted according to the business risk preference, for example, the preliminary abnormal score is 75 points, and after dynamic compression, it becomes 88 points (because k=0.2 strengthens the high-risk area), and the final environmental abnormal score is 88 points, triggering a secondary risk warning.

[0050] S4、According to the user identity, the historical request behavior of the limit request user is queried, the permission granting risk value of the permission request user is calculated based on the historical request behavior, the current operation sensitivity and the environmental risk level, and the initial authorization level is checked again based on the permission granting risk value. The secondary authorization level is checked to obtain the target permission level.

[0051] According to the user identity, the historical request behavior of the limit request user is queried, the permission granting risk value of the permission request user is calculated based on the historical request behavior, the current operation sensitivity and the environmental risk level, and the initial authorization level is checked again based on the permission granting risk value. The secondary authorization level is checked to obtain the target permission level.

[0052] The historical request behavior refers to all permission application records initiated by the permission request user in the past period of time (such as the last 30 days / 90 days), including request time, permission type (such as data access, system operation), request frequency, approval result (pass / reject) and abnormal operation label (such as high-frequency request, cross-region login application) and other behavior data, which can be obtained by querying the behavior analysis database (data storage) corresponding to the generative AI conversation system.

[0053] The permission granting risk value of the permission request user is calculated based on the historical request behavior, the current operation sensitivity and the environmental risk level, which can comprehensively consider the user behavior pattern, the operation risk itself and the environmental safety state, quantitatively evaluate the potential threat that the granted permission may bring, and provide multi-dimensional risk basis for permission decision.

[0054] The permission granting risk value refers to a quantitative index calculated based on the historical request behavior, the current operation sensitivity and the environmental risk level, and is used to measure the security threat degree that the granted specific permission may bring.

[0055] As an embodiment of the present application, the permission granting risk value of the permission request user is calculated based on the historical request behavior, the current operation sensitivity and the environmental risk level, comprising: performing feature standardization processing on the historical request behavior, the current operation sensitivity and the environmental risk level to obtain a standardized feature vector; performing time-varying weighted fusion on the standardized feature vector by using the following formula to obtain a dynamic weight: ; wherein, the dynamic weight of the standardized feature vector calculated at the t th time, the time decay factor calculated at the t th time, the importance coefficient of the i th standardized feature vector, the standardized function output value of the i th standardized feature vector, the dynamic weight of the standardized feature vector calculated at the t th time, and n represents the number of categories of the standardized feature vector; The dynamic weight is used to calculate the permission granting risk value of the permission request user.

[0056] The dynamic weight refers to a weight coefficient adaptively assigned to different risk feature dimensions (historical request behavior, operation sensitivity, environmental risk level) according to real-time environmental changes and historical data trends.

[0057] ​In the implementation process, the historical request behavior (frequency / type), operation sensitivity (action danger level), and environmental risk level (device / location / time) can be respectively subjected to Z-score standardization to eliminate dimensional differences and obtain a standardized feature vector; the standardized feature vector is multiplied by a dynamic weight, and a quantum random disturbance (±3 points) is superimposed to output a final risk value R∈[0, 100], for example, a standardized vector = [0.8, 1.2, 2.1], a weight = [0.4, 0.3, 0.3]→R=0.8×0.4+1.2×0.3+2.1×0.3=1.19 (normalized = 79 points).

[0058] The embodiment of the application adjusts the initial authorization result dynamically by the matching rule of risk and authorization level (such as low risk, high risk, and low risk) to ensure that the target authorization level finally granted matches the actual risk level, and realizes fine management and control of the authorization.

[0059] The target authorization level is the final authorization level determined by the secondary check of the initial authorization level based on the authorization risk value, and is the fine authorization result after dynamic adjustment.

[0060] As an embodiment of the application, the secondary authorization level check of the initial authorization level based on the authorization risk value obtains the target authorization level, including: The authorization risk value is subjected to dynamic segmented coding processing to obtain a risk feature vector; The risk feature vector is subjected to authorization decision mapping to obtain a decision vector; The decision vector is subjected to dynamic weight correction operation to obtain a correction vector; The correction vector is used to calculate the level adjustment value of the initial authorization level; The initial authorization level is subjected to level adjustment based on the level adjustment value to obtain the target authorization level.

[0061] The risk feature vector is a numerical vector generated by segmented mapping and coding of the authorization risk value, used to represent the risk level and its feature distribution, the decision vector is an operation instruction vector generated by rule mapping based on the risk feature vector, and the correction vector is an optimized vector generated by weighted adjustment of the decision vector by introducing historical behavior and environmental correction factors.

[0062] In the implementation process, the risk feature vector can be matched with the preset decision rule (such as extremely high risk→reduce 3 levels + double person approval) by using the Drools rule engine to generate a decision vector (such as [reduce 3 levels, approval, limit]) containing the level adjustment range and additional conditions; introduce user historical permission compliance rate, resource access frequency and other correction factors, calculate the correction weight (such as high compliance rate to reduce the level reduction range) through the reinforcement learning model (such as Q-Learning), and weight and correct the decision vector (such as the original reduction of 3 levels is corrected to 2 levels); the level adjustment range (such as reduction of 2 levels) is extracted from the corrected vector, combined with the numerical representation of the initial authorization level (such as L4=4), and the adjustment value (4-2=2→L2) is calculated, for example, the initial authorization level L4 (numerical value 4), after correction, the level is reduced by 2, the adjustment value is 4-2=2, and the target level L2 is obtained; the initial authorization level is updated according to the adjustment value, and the conditions in the decision vector (such as the approval process) are added, to generate the target permission level (such as L2 + total monitor approval), for example, the initial level L4 is reduced by 2 to L2, and the condition of “total monitor approval” is added, and the target permission level is “L2 (to be approved by the total monitor)”.

[0063] Further, as an optional embodiment of the present application, the dynamic segmentation coding process of the permission granting risk value is performed to obtain a risk feature vector, comprising: performing dynamic interval division on the permission granting risk value to obtain risk interval membership degree; performing time sequence feature fusion on the risk interval membership to obtain an enhanced feature vector; performing cross-dimension splicing on the enhanced feature vector to obtain an original feature matrix; performing layer normalization processing on the original feature matrix to obtain a risk feature vector.

[0064] The risk interval membership degree refers to the degree of belonging of the permission granting risk value to each preset risk interval.

[0065] In the implementation process, the K-means clustering algorithm can be used to dynamically generate the risk interval boundary (such as the threshold of low / middle / high / very high risk) based on the historical risk value distribution (such as the data in the past 30 days), and the membership degree of the current risk value to each interval (such as the membership degree of the risk value 92 points to "very high risk" is 0.9, and the membership degree to "high risk" is 0.1) is calculated by using a fuzzy membership function. For example, in the financial transaction scenario, if the number of recent attack events increases, the K-means automatically adjusts the "high risk" interval from 71-90 to 65-85, and the membership degree of the risk value 88 points to the new "high risk" interval is 0.8, and the membership degree to "very high risk" is 0.2; the current risk value membership degree vector and the membership degree sequence of the past N time windows (such as N=5) are extracted, the trend features (such as the membership degree rising rate and the fluctuation amplitude) are calculated by using a sliding window, and the LSTM network is used to fuse the time sequence dependence relationship (such as three consecutive membership degrees rising indicating that the risk is increasing), for example, the current membership degree vector is [0, 0, 0.2, 0.8] (very high risk 0.8), the past four membership degrees are [0, 0, 0.3, 0.7], [0, 0, 0.4, 0.6], the LSTM outputs the trend feature vector [rising rate 0.1 / time, fluctuation amplitude 0.2], and the trend feature vector is spliced with the current membership degree to form an enhanced feature; the risk interval membership degree (such as 4 dimensions), the time sequence trend feature (such as 2 dimensions), and the environmental risk additional feature (such as IP credibility and device age, each 1 dimension) are spliced into an original feature matrix (such as 4+2+2=8 columns) according to the dimensions, and each row corresponds to a feature vector of a time window; each row (each time window feature) of the original feature matrix is subjected to layer normalization to generate a numerical stable risk feature vector, for example, the feature value of a certain row is [0.8, 0.2, 0.1, 0.2, 0.3, 0.6], the mean is 0.383, the standard deviation is 0.267, and after normalization, it is [1.56, -0.68, -1.06, -0.68, -0.31, 0.81], which is used as the final risk feature vector.

[0066] Embodiment 2 As Figure 2 shown, it is a functional module diagram of the user permission verification system based on the generative AI conversation mode of the application.

[0067] The user permission verification system based on the generative AI conversation mode 200 can be installed in an electronic device. According to the implemented functions, the user permission verification system based on the generative AI conversation mode can include a user information acquisition module 201, a permission initial verification module 202, an environmental risk analysis module 203, and a permission final verification module 204. The modules of the application can also be referred to as units, which refer to a series of computer program segments that can be executed by an electronic device processor and can complete a fixed function, which are stored in the memory of the electronic device.

[0068] In the embodiments of the present application, the functions of each module / unit are as follows: The user information obtaining module 201 is configured to receive permission request information and a dynamic access environment fingerprint generated by a generative AI conversation interface of a permission request user, wherein the generative AI conversation interface comprises a user identity recognition unit, a resource query unit and an operation analysis unit, the user identity recognition unit is configured to recognize the user identity of the permission request user, the resource query unit is configured to query the request resource of the permission request user, and the operation analysis unit is configured to analyze the operation intention of the permission request user. The permission initial verification module 202 is configured to analyze the permission demand level and the current operation sensitivity of the permission request user based on the request resource and the operation intention, perform authorized level verification on the permission demand level based on the user identity, and obtain an initial authorization level. The environment risk analysis module 203 is configured to evaluate the environment risk level of the permission request environment corresponding to the permission request user by using the dynamic access environment fingerprint. The permission final verification module 204 is configured to query the historical request behavior of the permission request user according to the user identity, calculate a permission granting risk value of the permission request user based on the historical request behavior, the current operation sensitivity and the environment risk level, perform secondary authorized level verification on the initial authorization level based on the permission granting risk value, and obtain a target permission level.

[0069] In detail, the modules in the user permission verification system 200 based on the generative AI conversation mode in the embodiments of the present application use the same technical means as the user permission verification method based on the generative AI conversation mode in the above-mentioned Figure 1 , and can produce the same technical effects, which will not be described here.

[0070] It is obvious for those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and the present application can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not limiting. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present application.

Claims

1. A user permission verification method based on generative AI conversation, characterized in that, The method includes: The system receives permission request information and dynamic access environment fingerprints generated by a user requesting permissions through a generative AI session interface. The generative AI session interface includes a user identification unit, a resource query unit, and an operation analysis unit. The user identification unit is used to identify the user identity of the user requesting permissions. The resource query unit is used to query the requested resources of the user requesting permissions. The operation analysis unit is used to analyze the operation intent of the user requesting permissions. Based on the requested resource and the operation intent, the permission request user's permission requirement level and current operation sensitivity are analyzed. Based on the user's identity, the permission requirement level is verified to obtain the initial authorization level. The environmental risk level of the permission request environment corresponding to the permission request user is assessed using the dynamic access environment fingerprint. Based on the user's identity, query the historical request behavior of the user requesting permission. Based on the historical request behavior, the current operation sensitivity, and the environmental risk level, calculate the permission granting risk value of the user requesting permission. Based on the permission granting risk value, perform a secondary authorization level verification on the initial authorization level to obtain the target permission level.

2. The user permission verification method based on generative AI conversation as described in claim 1, characterized in that, Based on the requested resource and the operation intent, analyze the permission requirement level and current operation sensitivity of the permission requesting user, including: Deep semantic analysis is performed on the requested resource and the operation intent to obtain resource keywords and operation types; Dictionary matching is performed on the resource keywords and the operation types to obtain the requested resource requirement level and the operation type requirement level; Based on the requested resource requirement level and operation type requirement level, the permission requirement level of the permission requesting user is determined; Based on the operation type, construct the current operation risk matrix of the permission requesting user; The sensitivity of the current operation of the user requesting permission is determined using the current operation risk matrix.

3. The user permission verification method based on generative AI conversation as described in claim 1, characterized in that, Based on the user's identity, the authorization level of the permission request is verified to obtain an initial authorization level, including: The user identity is used to perform role and permission mapping to obtain the user's baseline permission level; The theoretical range of permissions that can be authorized is obtained by calculating the minimum permission intersection between the permission requirement level and the user's baseline permission level. Dynamic policy rule matching is performed on the theoretically authorizable scope to obtain the initial authorization level.

4. The user permission verification method based on generative AI conversation as described in claim 1, characterized in that, Using the dynamic access environment fingerprint, the environmental risk level of the permission request environment corresponding to the permission requesting user is assessed, including: Extract the multi-dimensional features of the dynamic access environment fingerprint to obtain the environment feature vector; The environmental feature vector is compared with real-time anomaly information to obtain an anomaly matching index; Using the anomaly matching index, calculate the environment anomaly score of the permission request environment corresponding to the permission requesting user; The environmental anomaly score is dynamically weighted to obtain the environmental risk level.

5. The user permission verification method based on generative AI conversation as described in claim 4, characterized in that, The step of performing real-time anomaly information comparison on the environmental feature vector to obtain an anomaly matching index includes: The environmental feature vector is compared with multi-dimensional anomaly information to obtain a multi-dimensional difference vector. Using the multidimensional difference vector, a quantitative index of the environmental feature vector is constructed; The abnormal matching index is obtained by dynamically weighting and aggregating the quantitative indicators using the following formula: ； in, Indicates standardized anomaly score, This represents the equipment threat score in the quantitative indicators. This indicates the IP risk level in the quantitative indicators. This indicates the reliability of the position in the quantitative indicators. This represents the probability of time anomalies in quantitative indicators. express The weighting coefficients, express The weighting coefficients, express The weighting coefficients, express The weighting coefficients.

6. The user permission verification method based on generative AI conversation as described in claim 4, characterized in that, The step of calculating the environment anomaly score of the permission request environment corresponding to the permission requesting user using the anomaly matching index includes: The abnormal matching index is subjected to dynamic baseline normalization to obtain standard outlier values; Adversarial sample detection processing is performed on the standard outliers to obtain robust outliers; The anti-interference anomalies are fused using multimodal methods to obtain a preliminary anomaly score; The preliminary anomaly score is dynamically compressed to obtain the environmental anomaly score.

7. The user permission verification method based on generative AI conversation as described in claim 1, characterized in that, Based on the historical request behavior, the current operation sensitivity, and the environmental risk level, calculate the permission granting risk value for the permission requesting user, including: The historical request behavior, the current operation sensitivity, and the environmental risk level are subjected to feature standardization processing to obtain a standardized feature vector; The standardized feature vectors are then subjected to time-varying weighted fusion using the following formula to obtain dynamic weights: ； in, This represents the dynamic weights of the standardized eigenvectors calculated in the t-th iteration. Express the time decay factor calculated in the t-th time. This represents the importance coefficient of the standardized feature vector of the i-th class. This represents the output value of the normalization function for the i-th class of normalized eigenvectors. Indicates the first The dynamic weights of the standardized feature vector are calculated in this step, where n represents the number of categories in the standardized feature vector; Using the dynamic weights, calculate the risk value of granting permissions to the user who requested the permission.

8. The user permission verification method based on generative AI conversation as described in claim 1, characterized in that, Based on the aforementioned permission granting risk value, a secondary authorization level verification is performed on the initial authorization level to obtain the target permission level, including: The risk value for granting the permission is dynamically segmented and encoded to obtain a risk feature vector. The risk feature vector is mapped to a permission decision to obtain a decision vector; Perform a dynamic weight correction operation on the decision vector to obtain a corrected vector; Using the correction vector, calculate the level adjustment value for the initial authorization level; Based on the level adjustment value, the initial authorization level is adjusted to obtain the target permission level.

9. The user permission verification method based on generative AI conversation as described in claim 8, characterized in that, The dynamic segmentation and encoding of the risk value for granting the permission to obtain a risk feature vector includes: The risk value for granting the permission is dynamically divided into intervals to obtain the membership degree of the risk interval; Temporal feature fusion is performed on the membership of the risk intervals to obtain an enhanced feature vector; The enhanced feature vectors are concatenated across dimensions to obtain the original feature matrix; The original feature matrix is ​​subjected to layer normalization to obtain the risk feature vector.

10. A user permission verification system based on generative AI conversation, characterized in that, The system includes: The user information acquisition module is used to receive permission request information and dynamic access environment fingerprint generated by the permission requesting user through the generative AI session interface. The generative AI session interface includes a user identity recognition unit, a resource query unit, and an operation analysis unit. The user identity recognition unit is used to identify the user identity of the permission requesting user. The resource query unit is used to query the requested resources of the permission requesting user. The operation analysis unit is used to analyze the operation intent of the permission requesting user. The initial permission verification module is used to analyze the permission request level and current operation sensitivity of the permission requesting user based on the requested resource and the operation intent, and to perform an authorization level verification on the permission request level based on the user identity to obtain the initial authorization level. The environmental risk analysis module is used to assess the environmental risk level of the environment corresponding to the permission request of the permission requesting user by utilizing the dynamic access environment fingerprint. The final permission verification module is used to query the historical request behavior of the user with the restricted request based on the user's identity, calculate the permission granting risk value of the user with the restricted request based on the historical request behavior, the current operation sensitivity and the environmental risk level, and perform a second authorization level verification on the initial authorization level based on the permission granting risk value to obtain the target permission level.

Images