Dynamic permission allocation method and system based on iris recognition and real-time state monitoring

Abstract

The invention provides a dynamic permission allocation method and system based on iris recognition and real-time state monitoring, and relates to the technical field of information system security, and the method comprises the steps: firstly collecting an iris texture image containing details such as eye iris sphincter contraction form and real-time state monitoring data containing information such as physical space coordinates; performing feature anchoring processing on the two to generate associated feature bodies which synchronously establish bidirectional mapping through timestamps, calling a historical permission interaction database to mine scene matching association, generating an adaptation rule pool, obtaining an initial permission scheme through matching of the associated feature bodies, tracking operation behavior data, and obtaining an initial permission scheme; the method comprises the steps of analyzing the degree of adaptation, feeding back and optimizing an adaptation rule pool, dynamically adjusting a permission range to generate a dynamic permission result, finally synchronizing the dynamic permission result to a permission management and control node and an associated operation terminal, executing a permission instruction and recording a permission change track to form a traceable data chain, thereby improving the security, flexibility and accuracy of permission distribution.

Description

Technical Field

[0001] This invention relates to the field of information system security technology, and more specifically, to a dynamic permission allocation method and system based on iris recognition and real-time status monitoring. Background Technology

[0002] In today's era of rapid digital information development, access control plays a crucial role in various systems and applications. Traditional access control methods are mainly based on static identity information, such as usernames and passwords, or simple role divisions, such as administrators and ordinary users. While these methods can meet basic access control needs to a certain extent, they have many limitations.

[0003] On the one hand, static identity information is easily stolen or cracked, resulting in low security. Once identity information is leaked, unauthorized users can easily gain corresponding permissions, causing serious damage to the system. On the other hand, role-based permission allocation is too rudimentary and cannot be flexibly adjusted according to the actual needs and status of users in different scenarios. For example, an ordinary employee may only need to access specific business data in daily work, but when participating in a special project, they may need to temporarily obtain more relevant permissions. Traditional methods are difficult to implement such dynamic permission adjustments.

[0004] Furthermore, existing access control methods often overlook users' real-time status information, such as their physical location, the associated devices they are using, their current business tasks, and their organizational affiliation. This real-time status information is crucial for accurately determining whether a user should be granted specific permissions. For example, a user may not be allowed access to certain sensitive business data when they are not in the company's office area; similarly, some permissions should be restricted if a user's device poses a security risk. Summary of the Invention

[0005] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a dynamic permission allocation method based on iris recognition and real-time status monitoring, the method comprising:

[0006] The system collects iris texture images and real-time status monitoring data. The iris texture images record the contraction shape of the iris sphincter muscle, the intersection points of texture bifurcation, and the grayscale distribution details of the edge contour. The real-time status monitoring data includes physical space coordinates, interaction records of associated devices, current business task attributes, and information on the organization to which the identity belongs.

[0007] Feature anchoring processing is performed on iris texture images and real-time status monitoring data to generate an associated feature body of iris identity features and status description features. The associated feature body establishes a bidirectional mapping through timestamp synchronization. When iris identity features are called, the corresponding status description features are directly associated and extracted. When the status description features are updated, they are associated with the corresponding iris identity features in real time.

[0008] The historical permission interaction database is called to mine iris identity features, status description features and permission content for contextual matching and association, and an adaptation rule pool is generated. The adaptation rule pool constructs a logical link with feature combination as the trigger condition and permission range as the execution result. The initial permission scheme is obtained by matching the related feature body with the adaptation rule pool.

[0009] Track operational behavior data based on the initial permission scheme, analyze the compatibility between the operational behavior data and the initial permission scheme, extract behavioral features to optimize the adaptation rule pool, and generate dynamic permission results after dynamically adjusting the permission range.

[0010] The dynamic permission results are synchronized to the permission control node and associated operation terminal. The permission control node executes the permission enabling, adjusting or disabling commands, and records the permission change trajectory to form a traceable data chain.

[0011] Furthermore, embodiments of the present invention also provide a dynamic permission allocation system based on iris recognition and real-time status monitoring, characterized in that it includes:

[0012] A processor; a machine-readable storage medium for storing machine-executable instructions of the processor; wherein the processor is configured to execute the aforementioned dynamic permission allocation method based on iris recognition and real-time status monitoring by executing the machine-executable instructions.

[0013] In another aspect, embodiments of the present invention also provide a computer program product, the computer program product including machine-executable instructions, the machine-executable instructions being stored in a computer-readable storage medium, the processor of a computer device reading the machine-executable instructions from the computer-readable storage medium, the processor executing the machine-executable instructions, causing the computer device to execute the above-described dynamic permission allocation method based on iris recognition and real-time status monitoring.

[0014] Based on the above, by collecting iris texture images and utilizing rich information such as the contraction morphology of the iris sphincter, texture bifurcation intersections, and grayscale distribution details of edge contours, a difficult-to-forge iris identity feature was constructed, greatly improving the accuracy and security of identity recognition and effectively preventing unauthorized users from gaining access. Simultaneously, real-time status monitoring data was collected, covering multiple dimensions such as physical space coordinates, associated device interaction records, current business task attributes, and organizational information, enabling comprehensive and real-time understanding of the user's actual status. Next, the iris identity features and status description features were correlated to generate a correlated feature body. A bidirectional mapping was established through timestamp synchronization, allowing permission allocation to closely integrate with the user's identity and real-time status. By mining the historical permission interaction database, an adaptation rule pool was generated. A logical link was constructed using feature combinations as trigger conditions and permission ranges as execution results, achieving scenario-based matching of permission allocation. This allows for the allocation of the most appropriate permissions to users based on different scenarios. Then, operational behavior data based on the initial permission scheme was tracked, its adaptability to the initial permission scheme was analyzed, and feedback was used to optimize the adaptation rule pool, dynamically adjusting the permission range, further improving the accuracy and adaptability of permission allocation. Finally, the dynamic permission results are synchronized to the permission control node and associated operation terminal. The permission control node executes the command to enable, adjust or disable permissions, and records the permission change trajectory to form a traceable data chain, which ensures the real-time and effectiveness of permission management and can meet complex and ever-changing business scenarios and security needs. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the execution flow of the dynamic permission allocation method based on iris recognition and real-time status monitoring provided in an embodiment of the present invention.

[0016] Figure 2 This is a schematic diagram of exemplary hardware and software components of a dynamic permission allocation system based on iris recognition and real-time status monitoring provided in an embodiment of the present invention. Detailed Implementation

[0017] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a dynamic permission allocation method based on iris recognition and real-time status monitoring, provided in one embodiment of the present invention. The following is a detailed description of this dynamic permission allocation method based on iris recognition and real-time status monitoring.

[0018] Step S110: Collect iris texture images and real-time status monitoring data. The iris texture images record the contraction shape of the iris sphincter, texture bifurcation intersections, and grayscale distribution details of the edge contour. The real-time status monitoring data includes physical space coordinates, related device interaction records, current business task attributes, and the organization to which the identity belongs.

[0019] This embodiment uses a financial data processing scenario within an enterprise as an example. In this scenario, it is necessary to dynamically allocate operating permissions for financial personnel to ensure the security of financial data and the compliance of operations. When financial personnel log into the financial data processing system, the iris recognition and status monitoring process is initiated. First, the iris recognition device and the multi-source status acquisition device begin working through a preset synchronization trigger mechanism. The multi-source status acquisition device includes positioning devices for acquiring physical spatial coordinates and monitoring devices for recording device interactions. A data linkage channel is established between these devices through wireless transmission protocols, such as Wi-Fi or Bluetooth, to ensure that data can be transmitted in real time and accurately. At the same time, the system time of all acquisition devices is calibrated using a network time protocol, so that the acquisition actions of each device start at the same time node, avoiding data deviations caused by time asynchrony.

[0020] Step S111: Activate the synchronization triggering mechanism between the iris acquisition device and the multi-source status acquisition device, establish a data linkage channel between the devices through the wireless transmission protocol, and calibrate the system time of all acquisition devices using the network time protocol so that the acquisition actions of each device start at the same time node.

[0021] In this financial scenario, the synchronization mechanism is triggered by the financial staff logging into the system. The wireless transmission protocol uses the company's stable internal Wi-Fi network, whose transmission rate and stability meet the requirements for real-time data transmission. During network time protocol calibration, each acquisition device periodically synchronizes with the company's internal time server to ensure that time deviations are within acceptable limits, such as microseconds, to guarantee the accurate and reliable time correlation of subsequent data.

[0022] Step S112: Call the iris acquisition device to obtain ambient light data through the ambient light sensing component, and start adaptive supplementary light adjustment according to the ambient light data. When the ambient light data is lower than the preset lower limit, gradually increase the infrared supplementary light intensity until the iris area is uniformly illuminated. When the ambient light data is higher than the preset upper limit, turn on the anti-glare filter and reduce the supplementary light intensity to avoid overexposure or shadows in the iris area.

[0023] The ambient light sensor on the iris recognition device continuously monitors the surrounding lighting conditions, such as the current ambient light level. When this level is below a preset lower limit, such as in a dimly lit finance office, the device automatically activates infrared supplementary lighting and gradually increases the intensity. During this process, the device monitors the uniformity of illumination in the iris area in real time, using image analysis algorithms to determine if there is overexposure or shadows in the iris area. Once uniform illumination is achieved, the device stops increasing the intensity. Conversely, if the ambient light level is above a preset upper limit, such as near a window in direct sunlight, the device immediately activates the anti-glare filter and reduces the intensity to minimize interference from strong light on the iris image acquisition, ensuring the acquired iris image quality meets requirements.

[0024] Step S113: After the illumination adjustment is completed, the iris acquisition device is called to locate the position of the eyeball, the iris boundary is determined based on the gray difference between the pupil and the iris, the lens module is driven to focus on the center of the iris area, and multiple frames of eye images are continuously captured according to the preset frame rate.

[0025] After the lighting is adjusted, the iris acquisition device begins to locate the eye. The device acquires images of the eye through an image sensor and then uses image processing algorithms to analyze the grayscale difference between the pupil and the iris. Because the pupil is typically a darker grayscale, while the iris is relatively brighter, this difference allows for accurate determination of the iris's boundary. Once the boundary is determined, the internal drive mechanism moves the lens module to focus on the center of the iris area, ensuring the clarity of the iris image. Subsequently, multiple frames of eye images are continuously captured at a preset frame rate, such as 30 frames per second.

[0026] Step S114: Perform quality screening on the continuously captured multi-frame eye images, and determine the images that meet all screening criteria as iris texture images. The screening criteria include iris region integrity, texture clarity, and noise interference level. Iris region integrity requires that the iris boundary be complete and occupy a proportion of the image that meets the preset standard. Texture clarity is measured by the edge gradient value, and noise interference level is evaluated by the pixel grayscale fluctuation range. The iris texture image retains the contraction state of the iris sphincter, the morphological features of the pupil edge, and the bifurcation and intersection details of the iris texture. The contraction state of the iris sphincter, the morphological features of the pupil edge, and the bifurcation and intersection details of the iris texture are recorded by the image pixel grayscale values. The grayscale value of each pixel corresponds to different structural features of the iris tissue.

[0027] For continuously captured multi-frame eye images, quality screening is required. First, the integrity of the iris region is checked, requiring the iris boundary to be intact and its proportion in the image to meet a preset standard, such as the iris region occupying no less than 60% of the entire image. Then, the texture sharpness is measured by calculating the edge gradient value; the larger the edge gradient value, the sharper the edge of the iris texture. At the same time, the degree of noise interference is judged by evaluating the range of pixel grayscale fluctuations; the smaller the grayscale fluctuation range, the lower the degree of noise interference. Images that simultaneously meet the requirements of iris region integrity, texture sharpness, and noise interference level are determined as iris texture images. In this iris texture image, the contraction state of the iris sphincter is reflected by the changes in pixel grayscale values ​​in different regions; for example, the grayscale values ​​of certain regions will change specifically during contraction. The morphological features of the pupil edge are also recorded through the grayscale value distribution of edge pixels; the details of the bifurcation and intersection of the iris texture are also presented by different combinations of pixel grayscale values, with the grayscale value of each pixel corresponding to different structural features of the iris tissue.

[0028] Step S115: Invoke the spatial positioning device to start the multi-source positioning function under the synchronous trigger signal, and combine indoor wireless positioning and visual positioning technology to obtain physical spatial coordinates. The physical spatial coordinates include planar coordinates and height information. The positioning accuracy of the physical spatial coordinates meets the permission allocation requirements in different scenarios.

[0029] Under the action of a synchronous trigger signal, the spatial positioning device activates its multi-source positioning function. Indoor wireless positioning technology can employ methods such as Wi-Fi fingerprint positioning or Bluetooth beacon positioning, while visual positioning technology determines location by analyzing images captured by cameras installed indoors. The location information obtained from these two positioning technologies is fused to obtain the physical spatial coordinates of the finance personnel's current location. These physical spatial coordinates include planar coordinates (e.g., X-axis and Y-axis coordinates) and height information (Z-axis coordinate). The positioning accuracy is set according to the permission allocation requirements of the financial scenario. For areas involving core financial data operations, higher positioning accuracy is required, such as centimeter-level accuracy; while for general office areas, positioning accuracy can be appropriately reduced, such as meter-level accuracy.

[0030] Step S116: Invoke the device interaction monitoring device to establish a data interaction channel with the associated terminal device, and capture the operation command input time, operation function type and operation object identifier of the terminal device in real time. The operation function type corresponds to the specific function of the terminal device, and the operation object identifier specifies the name of the data or file being operated. Based on the operation command input time, operation function type and operation object identifier, an associated device interaction record is formed.

[0031] The device interaction monitoring equipment establishes a data interaction channel with the terminal devices used by finance personnel, such as computers and dedicated financial terminals. Through this channel, it captures in real time the input time of operation commands on the terminal devices, such as the time a finance personnel clicks a button; the type of operation function, such as querying, modifying, or deleting financial data, with each operation function type corresponding to a specific functional module of the terminal device; and the operation object identifier, i.e., the name of the financial data or file being operated on, such as "October 2023 Financial Statements.xlsx". Combining the above information in chronological order forms a linked device interaction record, which can reflect in detail the operational behavior of finance personnel on the terminal devices.

[0032] Step S117: Retrieve the current task assignment record from the business management system. The current task assignment record includes the task name, task priority, task execution period, and the scope of business data associated with the task. At the same time, obtain the organization information to which the identity belongs through the identity management system. The organization information to which the identity belongs includes the department, job title, and business area of ​​responsibility. Integrate the current task assignment record and the organization information to which the identity belongs to form the current business task attributes and the organization information to which the identity belongs.

[0033] The business management system stores the task assignments for finance personnel, retrieving current task assignment records from it. For example, the task name might be "Preparation for the Fourth Quarter Financial Audit of 2023," the task priority might be "High," the task execution period might be "December 1, 2023 to December 20, 2023," and the scope of business data associated with the task might include "all financial vouchers, accounts, and reports for the fourth quarter of 2023." Simultaneously, the system retrieves the organization information to which the finance personnel belong from the identity management system, such as their department being "Audit Department," their job title being "Audit Specialist," and their area of ​​responsibility being "Financial Audit." Integrating this information forms the current business task attributes and the organization information to which the personnel belong.

[0034] Step S118: After adding a synchronization timestamp to the iris texture image, physical space coordinates, associated device interaction records, current business task attributes, and the organization information to which the identity belongs, integrate them to form real-time status monitoring data.

[0035] Synchronization timestamps are added to the collected iris texture images, acquired physical spatial coordinates, associated device interaction records, and integrated current business task attributes and organizational information. These timestamps are consistent with the time previously calibrated via the network time protocol, ensuring the temporal correlation of this data. This timestamped data is then integrated to form real-time status monitoring data, which comprehensively reflects the identity, status, and business-related information of finance personnel at the current point in time.

[0036] Step S120: Perform feature anchoring processing on the iris texture image and real-time status monitoring data to generate an associated feature body of iris identity features and status description features. The associated feature body establishes a bidirectional mapping through timestamp synchronization. When the iris identity feature is called, the corresponding status description feature is directly associated and extracted. When the status description feature is updated, it is associated with the corresponding iris identity feature in real time.

[0037] After acquiring the iris texture image and real-time status monitoring data, feature anchoring processing is required. In a financial scenario, the purpose of this step is to closely link the iris identity features of financial personnel with their real-time status features, enabling subsequent permission allocation based on identity and status. A two-way mapping is established through timestamp synchronization, allowing the direct extraction of the corresponding status description features when iris identity features are invoked; conversely, when the status description features are updated, they can be linked to the corresponding iris identity features in real time, ensuring the real-time effectiveness of the association between the two.

[0038] Step S121: Perform region segmentation processing on the iris texture image and use an edge contour recognition algorithm to detect gray-level gradient changes in the eye region. First, determine the outer contour boundary of the entire eye region. Then, based on the gray-level difference threshold between the iris, sclera, and pupil, accurately distinguish the iris region from the sclera region and the pupil region, and mark the effective extraction area of ​​the iris texture in the form of a coordinate frame.

[0039] When performing region segmentation on iris texture images, edge contour recognition algorithms analyze the gray-level gradient changes in the eye region of the image. First, abrupt changes in gray-level values ​​are detected to determine the outer contour boundary of the entire eye region, such as the gray-level change from the skin region to the eye region. Then, based on gray-level difference thresholds between the iris and sclera / pupil, the iris, sclera, and pupil regions are further distinguished. The iris typically has unique texture and gray-level characteristics, clearly distinguishable from the white sclera and black pupil. By setting an appropriate gray-level difference threshold, the iris region can be accurately segmented from the eye image, and the effective extraction area of ​​the iris texture can be marked in the form of a coordinate frame. The position and size of this coordinate frame are determined based on the actual position and size of the iris region.

[0040] Step S122: Perform noise filtering on the iris image within the effective extraction area. Use an adaptive filtering algorithm to dynamically adjust the filtering parameters according to the noise type in different regions of the iris image. Reduce the filtering intensity in areas with dense iris texture and increase the filtering intensity in transitional areas. After filtering, use a texture enhancement algorithm to enhance the grayscale contrast of the texture edges to obtain enhanced iris texture information.

[0041] Iris images within the effective extraction region may contain various types of noise, such as sensor noise and environmental interference noise. The adaptive filtering algorithm dynamically adjusts the filtering parameters based on the noise type in different regions of the iris image. In areas with dense iris texture, the filtering intensity is reduced to preserve more texture details; while in edge transition areas, the filtering intensity is increased because there is relatively more noise and it may affect edge sharpness. After filtering, texture enhancement algorithms, such as adjusting image contrast and sharpening edges, are used to improve the grayscale contrast of the iris texture edges, making the texture features more prominent, thus obtaining enhanced iris texture information.

[0042] Step S123: The enhanced iris texture information is converted into iris identity features using a predefined feature encoding algorithm. In the encoding process, key feature points of the iris texture are first extracted. The key feature points include texture bifurcation points, texture endpoints, and texture intersections. Then, the coordinate information and morphological parameters of the texture bifurcation points, texture endpoints, and texture intersections are obtained. The coordinate information and morphological parameters are then processed by a hash encoding algorithm to generate a fixed-length feature code as the iris identity feature.

[0043] Step S1231: Scan the enhanced iris texture image and traverse the entire effective extraction area of ​​the iris through a sliding window. The size of the sliding window is dynamically adjusted according to the density of the iris texture. The sliding window size is reduced in areas with dense texture to capture fine feature points, and the sliding window size is increased in areas with sparse texture to improve detection efficiency.

[0044] The enhanced iris texture image is fully scanned, and a sliding window is used to traverse the entire effective iris extraction area. The size of the sliding window is not fixed, but dynamically adjusted according to the density of the iris texture. In areas with dense texture, such as near the center of the iris, where texture details are rich, the sliding window size needs to be reduced to capture more subtle feature points; while in areas with sparse texture, such as the edges of the iris, the sliding window size can be appropriately increased to improve detection efficiency and reduce unnecessary computation.

[0045] Step S1232: Calculate the extreme value of the second derivative of the pixel gray level in each sliding window, and take the extreme value of the second derivative as the candidate feature point. At the same time, combine the texture direction information in the sliding window to remove pseudo feature points in the region with chaotic texture direction. The pseudo feature point is judged when the texture direction variance of the pixels around the candidate feature point exceeds a preset threshold.

[0046] Within each sliding window, the extreme value of the second derivative of the pixel's grayscale is calculated. These extreme points typically correspond to edges or locations with drastic texture changes in the image; therefore, these points are considered candidate feature points. Simultaneously, the texture orientation information within the sliding window is used to analyze the texture orientation of pixels surrounding the candidate feature points. If the variance of the texture orientation of pixels surrounding a candidate feature point exceeds a preset threshold, it indicates that the texture orientation in that region is chaotic, and the candidate feature point may be a false feature point, requiring its removal to improve the accuracy of feature point extraction.

[0047] Step S1233: Classify and identify candidate feature points, and distinguish texture bifurcation points, texture endpoints and texture intersections based on the connection relationship of the textures around the candidate feature points.

[0048] For the selected candidate feature points, classification and identification are performed based on the connectivity of the surrounding textures. Texture bifurcation points are points where one texture splits into two or more textures; texture endpoints are the start or end points of a texture; texture intersection points are points where two or more textures intersect. By analyzing the direction and connectivity of the textures surrounding the feature points, these different types of feature points can be accurately distinguished.

[0049] Step S1234: Record the coordinate information of various feature points within the effective extraction area of ​​the iris. The coordinate information is established based on the pixel coordinate system of the iris image, with the upper left corner of the iris region as the origin, the horizontal direction as the horizontal axis, and the vertical direction as the vertical axis.

[0050] After differentiating various feature points, their coordinate information within the effective iris extraction area is recorded. This coordinate information is established based on the pixel coordinate system of the iris image, with the upper left corner of the iris region as the origin, the horizontal axis pointing to the right, and the vertical axis pointing downwards. Each feature point has a unique coordinate value, accurate to the pixel level, ensuring the accuracy of the feature point's position information.

[0051] Step S1235: Extract the morphological parameters of each feature point. The morphological parameters of the texture bifurcation point include the extension direction angle and texture width of each bifurcation texture. The morphological parameters of the texture endpoint include the radius of curvature and grayscale gradient of the texture endpoint. The morphological parameters of the texture intersection point include the included angle of the intersecting textures and their respective texture contrast.

[0052] For each feature point, its corresponding morphological parameters are extracted. For texture bifurcation points, the extension direction angle of each bifurcation texture needs to be extracted, such as the angle with the horizontal axis, and the width of the texture, i.e., the size of the texture perpendicular to the extension direction. The morphological parameters of the texture endpoints include the radius of curvature of the texture end, reflecting the degree of curvature of the texture end, and the grayscale gradient rate, i.e., the rate of grayscale change from the texture end to the surrounding area. The morphological parameters of texture intersection points include the angle between the intersecting textures and the texture contrast of each intersecting texture; the higher the contrast, the clearer the texture.

[0053] Step S1236: Normalize the coordinate information and morphological parameters of the feature points, and sort the normalized coordinate information and morphological parameters according to the feature point type to form a structured feature data sequence.

[0054] To eliminate the influence of factors such as size and rotation between different iris images, it is necessary to normalize the coordinate information and morphological parameters of the feature points. Normalization can map these parameters to a uniform range, such as the interval [0, 1]. After processing, the normalized coordinate information and morphological parameters are sorted according to the feature point type, such as texture bifurcation points, texture endpoints, and texture intersections, to form a structured feature data sequence.

[0055] Step S1237: Call the hash encoding algorithm to process the structured feature data sequence, compare the generated feature code with all feature codes in the historical iris identity feature database, calculate the Hamming distance. If the Hamming distance exceeds the preset threshold, it is determined to be a unique feature code. If it is lower than the preset threshold, the feature point extraction parameters are readjusted until a unique feature code is generated.

[0056] The hash encoding algorithm processes the structured feature data sequence to generate a fixed-length feature code. This feature code is then compared with all feature codes in the historical iris identification feature database, calculating the Hamming distance between them. The Hamming distance measures the degree of difference between two feature codes; the larger the distance, the greater the difference. If the Hamming distance exceeds a preset threshold, the feature code is unique and can be used as the financial personnel's iris identification feature. If it is below the preset threshold, it indicates the possible existence of duplicate or similar feature codes, requiring readjustment of feature point extraction parameters, such as the sliding window size and grayscale difference threshold, and repeated feature point extraction and encoding until a unique feature code is generated.

[0057] Step S1238: The finally determined unique feature code is used as the iris identity feature and associated with the corresponding iris texture image metadata. The metadata includes the acquisition time, acquisition device identifier and image quality score. The iris identity feature, iris texture image metadata and their association are written into the identity feature database. An index is set in the database with the iris identity feature as the retrieval key.

[0058] The final unique feature code is used as the iris identification feature and stored in association with the metadata of the corresponding iris texture image. The metadata includes the iris image acquisition time, the identifier of the acquisition device (e.g., device serial number), and the image quality score, which is derived based on previous image quality screening criteria. Then, the iris identification feature, the iris texture image metadata, and the relationships between them are written into the identification feature database. In the database, an index is set up using the iris identification feature as the search key, so that relevant metadata and information can be retrieved quickly and accurately using the iris identification feature in the future.

[0059] Step S124: Perform feature classification and extraction on the real-time status monitoring data. Extract spatial location features from physical space coordinates. Spatial location features are directly represented by the numerical form of physical space coordinate information. Extract operation timing features and operation type features from the interaction records of associated devices. Operation timing features consist of the time sequence of operation command input times in the interaction records of associated devices. Operation type features map different operation function types in the interaction records of associated devices into unique feature codes.

[0060] Feature classification and extraction are performed on real-time status monitoring data. Spatial location features are directly extracted from physical space coordinates, which are numerical forms of physical space coordinate information, such as (X coordinate value, Y coordinate value, Z coordinate value). Operation timing features and operation type features are extracted from the interaction records of associated devices. Operation timing features are time sequences formed by arranging the input times of operation commands in chronological order, reflecting the order of operations. Operation type features map different operation function types, such as query, modify, and delete, to unique feature codes, for example, using a string of numbers or characters to represent each operation type, facilitating subsequent feature processing and matching.

[0061] Step S125: Extract task features from the current business task attributes. Task features include task priority features and task association scope features. Extract job attribute features from the organization information to which the identity belongs. Generate a unique feature identifier based on the department and job name in the organization information to which the identity belongs. Task priority features, task association scope features, and job attribute features together constitute the status description features.

[0062] Task features are extracted from the current business task attributes. Task priority features reflect the urgency and importance of the task, such as using high, medium, and low ratings, or mapping to corresponding numerical values. Task association scope features clarify the scope of business data involved in the task, such as specific financial data categories or documents. Job attribute features are extracted from the organization information to which the identity belongs. A unique feature identifier is generated based on the department and job title; for example, "Audit Department - Audit Specialist" corresponds to a specific feature identifier. These task priority features, task association scope features, and job attribute features together constitute the status description features, comprehensively describing the current business status and identity attributes of the financial personnel.

[0063] Step S126: Construct a structured feature association carrier. The feature association carrier uses iris identity features as the core index field and spatial location features, operation time sequence features, operation type features, task features, and job attribute features as association fields.

[0064] A structured feature association carrier is constructed, resembling a data structure. Iris identification features serve as the core index field, while other features such as spatial location, operation sequence, operation type, task, and job attribute characteristics are used as association fields. This structure organically organizes the identity characteristics and various status characteristics of financial personnel, facilitating data storage, retrieval, and correlation analysis.

[0065] Step S127: Using timestamp as the retrieval condition, locate iris identity features and various status description features under the same timestamp, and fill each feature data into the corresponding field of the feature association carrier through field identifier to obtain the bound feature data.

[0066] Using timestamps as the search criteria, the system searches for iris identity features and various status description features with the same timestamp across all collected data. Once found, each feature data is accurately populated into the corresponding fields of the feature association carrier using field identifiers, thus binding identity features with status features and obtaining bound feature data. In this way, each bound feature data entry contains identity and status information at the same point in time.

[0067] Step S128: Convert the bound feature data into standardized data within the same numerical range, and establish a bidirectional mapping mechanism in the feature association carrier. When the iris identity feature is used as the index key, directly locate and extract all corresponding state description features. When any state description feature is used as the index key, quickly associate it with the corresponding iris identity feature. This generates an associated feature body containing iris identity features and state description features. The associated feature body retains the binding relationship and bidirectional mapping information between iris identity features and state description features. Store the associated feature body in a designated partition of the feature database.

[0068] To facilitate subsequent data analysis and model processing, the bound feature data needs to be converted into standardized data within the same numerical range, for example, converting all feature data to the interval [0, 1] or [-1, 1]. Standardization eliminates the influence of different dimensions between features, making them comparable. A bidirectional mapping mechanism is established in the feature association carrier. When searching using iris identity features as the index key, all corresponding state description features can be directly located and extracted; when using any state description feature as the index key, the corresponding iris identity feature can also be quickly associated. Through these steps, an associated feature body containing iris identity features and state description features is generated, which retains the binding relationship and bidirectional mapping information between the two. Finally, the associated feature body is stored in a designated partition of the feature database. This designated partition can be divided according to business needs or data types for easy management and querying.

[0069] Step S129: Establish a real-time update mechanism for the associated feature body, monitor changes in real-time status monitoring data, and when status data such as physical space coordinates and associated device interaction records are updated, extract new status description features, associate them with the corresponding iris identity features through a two-way mapping mechanism, and synchronously update the relevant fields in the associated feature body.

[0070] A real-time update mechanism for the associated feature body is established, and the system continuously monitors changes in real-time status monitoring data. When the physical spatial coordinates of the finance personnel change, such as moving from one office area to another, or when the interaction records of associated devices are updated, such as when a new operation is performed, the system immediately extracts the new status description features. Through a two-way mapping mechanism, the new status description features are associated with the corresponding iris identity features, and the relevant fields in the associated feature body are updated synchronously to ensure that the information in the associated feature body is always up-to-date and reflects the current true status of the finance personnel.

[0071] Step S130: Call the historical permission interaction database to mine the iris identity features, status description features and permission content for contextual matching and association, and generate an adaptation rule pool. The adaptation rule pool constructs a logical link with feature combination as the trigger condition and permission range as the execution result. The initial permission scheme is obtained by matching the adaptation rule pool with the associated feature body.

[0072] The system accesses the company's internal historical permission interaction database, which stores the allocation and usage of permissions by finance personnel under different identities and states. Data mining techniques are used to analyze the contextual matching relationships between iris recognition features, state description features, and permission content. For example, in a financial audit scenario, when an audit specialist is located at a specific physical coordinate and performing a high-priority audit task, they are typically assigned specific permissions. Based on these relationships, an adaptation rule pool is generated. Each rule in this pool uses a specific combination of features as a trigger condition and a corresponding permission scope as the execution result, constructing a logical chain. Then, the currently generated associated feature body is matched with the rules in the adaptation rule pool to find rules that match the current feature combination, thus obtaining the initial permission scheme.

[0073] Step S131: Collect historical permission interaction records of the target object and other objects in the same position from the permission management system through the data interface. The collection scope covers all permission allocation, usage and change data within the historical preset time period. The historical permission interaction records include iris identity features, status description features, allocated permission content, permission usage duration and permission usage feedback information.

[0074] By connecting to the enterprise's access control system via a data interface, historical access control interaction records are collected from the target group, namely the current finance personnel and other finance personnel in the same position. The collection scope covers all access control allocation, usage, and change data within a preset historical time period, such as the past year or six months. The aforementioned historical access control interaction records include detailed information such as iris recognition characteristics, current status descriptions, allocated access control content (e.g., the range of data that can be operated, operation type), access control usage duration (i.e., the length of time the access control was used), and access control usage feedback information (e.g., whether the operation was successful or whether there were any anomalies).

[0075] Step S132: Preprocess the historical permission interaction records, divide the record sets according to job attribute characteristics and business task characteristics, group records with the same combination of job attribute characteristics and business task characteristics into the same set, sort the records in the same set in chronological order and store them in a temporary data folder, and name the temporary data folder with the combination of job attribute characteristic identifier and business task characteristic identifier.

[0076] The collected historical permission interaction records are preprocessed. First, the records are divided according to job attribute characteristics and business task characteristics. Records with the same combination of job attribute characteristics and business task characteristics are grouped into the same set; for example, all records of the "Audit Specialist" job performing "Financial Audit" tasks are placed together. Then, the records within the same set are sorted in chronological order and stored in a temporary data folder. The temporary data folder is named using a combination of job attribute characteristic identifiers and business task characteristic identifiers to facilitate the differentiation and management of different types of record sets.

[0077] Step S133: For each record set, an association analysis algorithm is used to mine the correspondence between iris identity features, status description features and permission content in the record set, and the association strength between feature combinations and permission content is calculated. The association strength is calculated by comprehensively considering the co-occurrence frequency of features and permissions and the matching accuracy. Combinations with an association strength that reaches a preset strength threshold are determined as valid association relationships.

[0078] For each record set, association analysis algorithms, such as the Apriori algorithm, are used to mine the correspondence between iris identity features, status description features, and permission content. The association strength between feature combinations and permission content is calculated, taking into account factors such as the co-occurrence frequency of features and permissions (the number of times they appear simultaneously) and matching accuracy (the proportion of times permission content is correctly assigned when feature combinations appear). Combinations with association strength reaching a preset threshold are identified as valid associations; these relationships form the basis for generating adaptation rules.

[0079] Step S134: Based on the effective association relationship, an adaptation rule is formed. The adaptation rule adopts a structured form of feature combination condition permission result, which is used to clarify the coordinate range of iris identity feature, spatial location feature, encoding value of operation type feature, task priority feature and job attribute feature identifier. The feature combination condition permission result is used to clarify the corresponding permission range, permission validity period and permission operation restrictions.

[0080] For example, step S1341: Classify and organize the effective relationships, group them according to job attribute feature identifiers, group the effective relationships corresponding to the same job attribute feature identifier into the same group, and sort them according to task priority feature within each group to form an ordered group of relationships.

[0081] The effective relationships are categorized and organized. First, they are grouped according to job attribute characteristics, with effective relationships belonging to the same job attribute characteristic grouped together. For example, all effective relationships with the job attribute characteristic "Audit Specialist" are placed in one group. Within each group, they are then sorted according to task priority characteristics, such as placing relationships for high-priority tasks first, forming ordered relationship groups to facilitate the subsequent refinement and organization of rules.

[0082] Step S1342: Extract common feature items of iris identity features from each group of associations. The common feature items are feature code segments shared by all iris identity features in the group. Use the common feature items as the iris identity feature filtering conditions corresponding to the group of associations.

[0083] Common features of iris identity characteristics are extracted from each set of relationships. These common features are feature code segments shared by all iris identity characteristics within that set. For example, the iris identity characteristics of finance personnel in the same position may share certain feature code segments. These common features are used as the filtering conditions for iris identity characteristics corresponding to that set of relationships, and are used to filter iris identity characteristics that meet the conditions during subsequent rule matching.

[0084] Step S1343: Extract the coordinate range of spatial location features in each group of relationships, and count the maximum and minimum coordinate values ​​of all spatial location features in the group. Use the maximum and minimum coordinate values ​​to determine the coordinate range of the spatial location features corresponding to the group of relationships.

[0085] Extract the coordinate range of spatial location features in each set of relationships. By statistically analyzing the maximum and minimum values ​​of the X, Y, and Z coordinates of all spatial location features within the set, determine the coordinate range of the spatial location features corresponding to the set of relationships. For example, if the X coordinate is within a certain interval, the Y coordinate is within a certain interval, and the Z coordinate is within a certain interval, a spatial region range is formed.

[0086] Step S1344: Organize the encoded values ​​of the operation type features in each group of relationships, summarize the encoded values ​​of all operation type features in the group, and remove duplicate encoded values ​​to form the set of encoded values ​​of the operation type features corresponding to the group of relationships.

[0087] Organize the encoded values ​​of operation type features in each group of relationships, summarize the encoded values ​​of all operation type features appearing in the group, and then remove duplicate encoded values ​​to form a set of encoded values ​​of all operation types involved in the group of relationships.

[0088] Step S1345: Determine the task priority feature corresponding to each group of associations, and take the task priority feature that appears most frequently in the group as the task priority feature corresponding to the group of associations.

[0089] In each set of relationships, the frequency of different task priority features is counted, and the task priority feature with the highest frequency is determined as the task priority feature corresponding to that set of relationships. This can reflect the main situation of task priority in that set of relationships.

[0090] Step S1346: Integrate the iris identity feature screening conditions, the coordinate range of spatial location features, the set of encoded values ​​of operation type features, and task priority features to form feature combination conditions. Each feature item in the feature combination conditions has clear and specific content without any ambiguity.

[0091] The iris identity feature screening criteria, the coordinate range of spatial location features, the set of encoded values ​​for operation type features, and task priority features are integrated to form a feature combination condition. In this condition, the specific content of each feature item is clearly defined, and there is no ambiguity. For example, the iris identity feature screening criteria are clearly defined as a certain common feature item, and the coordinate range of spatial location features is clearly defined as a specific interval, etc.

[0092] Step S1347: Extract permission content from each group of relationships, and count the permission type, scope of permission and operation restrictions of all permission content in the group. The permission type that appears most frequently is taken as the core permission type in the permission scope corresponding to the group of relationships.

[0093] Extract permission content from each group of relationships, and statistically analyze the permission types (e.g., query, modify, delete), scope (i.e., the range of data or files that can be manipulated), and operation restrictions (e.g., operation time limits, operation count limits). Identify the most frequently occurring permission type as the core permission type within the permission scope corresponding to that group of relationships, as this core permission type is the most common and important within that group of relationships.

[0094] Step S1348: Determine the validity period of the permission based on the task priority characteristics corresponding to the group of associations. The task execution period corresponding to the task priority characteristics is the base duration of the permission validity period. The start time of the permission validity period is consistent with the task start time.

[0095] The validity period of permissions is determined based on the task priority characteristics corresponding to this set of relationships. Task priority characteristics typically correspond to the task execution period, which is used as the baseline duration for the permission validity period. The start time of the permission validity period is consistent with the task startup time to ensure that permissions take effect promptly upon task startup.

[0096] Step S1349: Determine the spatial restriction in the permission operation restriction based on the coordinate range of the spatial location feature corresponding to the group of associations. The permission is only valid within the coordinate range of the spatial location feature. Determine the operation restriction in the permission operation restriction based on the set of encoded values ​​of the operation type feature corresponding to the group of associations. Only the operation type within the set of encoded values ​​is allowed to be executed.

[0097] Spatial restrictions in access control are determined based on the coordinate range of spatial location characteristics. This means that permissions are only valid within that coordinate range; if financial personnel exceed this range, permissions may be restricted or adjusted. Operational restrictions are determined based on the set of coded values ​​for operation types. Only operation types contained within this set of coded values ​​are allowed; operation types outside this set are not permitted.

[0098] Step S13410: Integrate the permission scope, permission validity period, and permission operation restrictions to form a permission result. Bind the feature combination conditions to the corresponding permission result. Use the structured form of the feature combination condition permission result to form an adaptation rule. Classify the implementation adaptation rule based on a predefined scene tag mechanism. The scene tag mechanism is generated according to the coordinate range of spatial location features, the type of business task features, and the responsibility scope of job attribute features. Each adaptation rule is bound to at least one scene tag.

[0099] The scope of permissions, including core permission types, permission effects, validity periods, and operational restrictions, is integrated to form a permission result. Then, feature combination conditions are bound to the permission result in a structured format of "feature combination conditions → permission result" to form adaptation rules. These adaptation rules are categorized based on a predefined scenario tagging mechanism. The scenario tagging mechanism generates tags based on the coordinate range of spatial location features, the type of business task features, and the scope of responsibilities of job attribute features, such as the scenario tag "Audit Department - Financial Audit - Office Area A". Each adaptation rule is bound to at least one scenario tag to facilitate rule management and retrieval according to scenarios.

[0100] Step S135: Construct an index directory for the adaptation rule pool based on the scene tags. The index directory uses scene tags and feature types as dual search dimensions. Each index item in the index directory is associated with the storage address of the corresponding adaptation rule.

[0101] An index directory for adaptation rules is built based on scene tags, using scene tags and feature types as dual search dimensions. For example, users can first filter relevant rules based on scene tags, and then further narrow down the scope based on feature types. Each index entry in the index directory is associated with the storage address of the corresponding adaptation rule in the storage medium, allowing for quick location of the required adaptation rule.

[0102] Step S136: Extract the iris identity features and state description features from the associated feature body, generate scene retrieval tags by combining them with the current scene information, and use the scene retrieval tags to match the index directory of the adaptation rule pool to initially filter out a set of candidate rules that match the current scene.

[0103] Iris identity features and state description features are extracted from the associated feature body. Combined with current scene information, such as the region to which the current physical space coordinates belong and the type of business task, scene retrieval tags are generated. Then, the scene retrieval tags are used to match the index directory of the adaptive rule pool to initially filter out a set of candidate rules related to the current scene, reducing the workload of subsequent rule matching.

[0104] Step S137: Match the rules in the candidate rule set to determine the matching rule that perfectly matches the current feature combination; if a perfectly matching matching rule exists, directly extract the permission result corresponding to the rule as the initial permission scheme; if no perfectly matching matching matching rule exists, select multiple similar rules with the highest correlation strength, combine the priority features of the current business task attributes and the accuracy of the spatial location features, weight and fuse the permission range of similar rules, eliminate permission conflict parts, supplement the missing permission parts, and generate the initial permission scheme after adjustment. The initial permission scheme is used for operable permission types, permission scope, permission effective time and permission operation restrictions, wherein the permission scope is consistent with the business data range associated with the business task features in the associated feature body, and the permission effective time is set according to the execution period of the current business task features; store the initial permission scheme in a structured file format and synchronize it to the permission temporary cache area.

[0105] A detailed matching process is performed on the rules in the candidate rule set, checking whether the feature combination conditions of each rule are completely consistent with the feature combination in the current associated feature body. If a perfectly matching rule exists, the permission result corresponding to that rule is directly extracted as the initial permission scheme. If no perfectly matching rule exists, the multiple similar rules with the highest association strength are selected. The permission ranges of the above similar rules are weighted and fused by combining the priority features of the current business task attributes (higher priority, greater weight for the corresponding rule) and the accuracy of the spatial location features (more accurate location, greater weight for the corresponding rule). During the fusion process, for parts with conflicting permissions, such as one rule allowing data modification while another does not, they need to be removed according to business rules and security requirements; for parts with missing permissions, such as certain necessary operation permissions not being covered, they need to be supplemented. After adjustment, an initial permission scheme is generated. This initial permission scheme clarifies the operable permission types, the scope of permission effect (which is consistent with the business data scope associated with the business task features in the associated feature body), the permission effective time is set according to the execution period of the current business task features, and the permission operation restrictions, etc. Finally, the initial permission scheme is stored in a structured file format, such as XML or JSON, and synchronized to the temporary permission cache for subsequent permission activation and adjustment.

[0106] Step S140: Track the operation behavior data based on the initial permission scheme, analyze the adaptability of the operation behavior data and the initial permission scheme, extract the behavior features to optimize the adaptation rule pool, and generate dynamic permission results after dynamically adjusting the permission range.

[0107] After the initial permission scheme is generated, the system tracks the operational behavior data of finance personnel based on this scheme. By analyzing the compatibility of this operational behavior data with the initial permission scheme—for example, determining whether the operation is within the permission scope and meets the task requirements—behavioral characteristics are extracted. These behavioral characteristics are fed back to the adaptation rule pool to optimize the rules in the pool. Simultaneously, the permission scope is dynamically adjusted based on the analysis results. For example, when it is found that finance personnel need additional permissions to complete a task, permissions are appropriately expanded; when unnecessary permissions or abnormal permission usage are found, permissions are contracted, ultimately generating a dynamic permission result.

[0108] Step S141: Start the operation behavior tracking process in the permission control node to capture all operation behavior data based on the initial permission scheme in real time. The operation behavior data includes operation time, operation object, operation content, operation result and operation duration.

[0109] At the enterprise's access control nodes, such as servers or dedicated access management devices, an operation behavior tracking process is initiated. This process monitors all operations performed by financial personnel based on the initial access scheme in real time, capturing operation behavior data. This data includes the operation time, i.e., the specific time when the operation occurred; the operation object, i.e., the financial data or files being operated on; the operation content, such as specific query conditions and modified data values; the operation result, such as whether the operation was successful, failed, or an error message appeared; and the operation duration, i.e., the time spent from the start to the end of the operation.

[0110] Step S142: Divide the operation behavior data into different operation sets according to the operation type characteristics, and group records with the same operation type characteristics into the same set.

[0111] The captured operational behavior data is categorized according to operational type characteristics, and records with the same operational type characteristics are grouped into the same operational set. For example, records of all query operations are placed in one set, and records of all modification operations are placed in another set, which facilitates separate analysis of different types of operations.

[0112] Step S143: Perform adaptation analysis on the operation behavior data and the initial permission scheme to obtain the adaptation analysis results. The adaptation analysis results include two dimensions: permission scope adaptation and operation necessity. Permission scope adaptation determines whether the operation behavior is within the permission scope specified in the initial permission scheme. Operation necessity combines the attributes of the current business task to determine whether the operation behavior is related to task execution.

[0113] An adaptation analysis was conducted on the operational behavior data and the initial permission scheme, evaluating it from two dimensions: permission scope adaptation and operational necessity. The permission scope adaptation dimension determined whether the financial personnel's actions were within the clearly defined permission scope of the initial permission scheme. For example, whether unauthorized data was accessed, or whether operations exceeding authorized limits were performed. The operational necessity dimension, considering the attributes of the current business task, determined whether the action was relevant to task execution. For instance, when performing a financial audit task, querying relevant financial documents is a necessary operation, while accessing entertainment websites unrelated to the audit task is unnecessary.

[0114] Step S144: Based on the adaptation analysis results, determine the adaptation level of each operation record, and count the proportion of operation records at each adaptation level. Mark the operation records that exceed the permission range with the corresponding operation type characteristics and operation object identifiers. Mark the necessary operation records that cannot be executed due to missing permissions with the corresponding business task association information.

[0115] Based on the adaptation analysis results, an adaptation level is determined for each operation record, for example, divided into three levels: high, medium, and low. High adaptation indicates that the operation is fully within the authorized scope and is necessary; medium adaptation may indicate that the operation is within the authorized scope but its necessity is generally low; low adaptation indicates that the operation exceeds the authorized scope or is unnecessary. The percentage of operation records at each adaptation level is statistically analyzed to understand the overall adaptation situation. For operation records exceeding the authorized scope, their corresponding operation type characteristics and operation object identifiers are marked to facilitate subsequent analysis of permission abuse or unauthorized operations. For necessary operation records that cannot be executed due to lack of permissions, the corresponding business task association information, such as task name and task stage, is marked.

[0116] Step S145: Extract behavioral features from the operation behavior data. The behavioral features include operation frequency features, operation duration features, operation association features, and operation preference features. The operation frequency feature is represented by the number of times the same operation type is executed per unit time. The operation duration feature is represented by the statistical value of the duration of each operation. The operation association feature is represented by the execution order relationship between different operation types. The operation preference feature is represented by the set of frequent operation types.

[0117] Step S1451: Group and statistically analyze the preprocessed operation behavior data according to operation type characteristics, determine the total number of executions for each operation type within the effective period of the initial permission scheme, calculate the number of executions per unit time based on the total duration of the effective period of the initial permission scheme, and use the number of executions per unit time as the core parameter of the operation frequency characteristic.

[0118] The preprocessed operational behavior data is grouped and statistically analyzed according to operational type characteristics. The total number of executions for each operational type within the initial permission scheme's effective period is determined; for example, how many times were query operations executed, how many times were modification operations executed, etc., within a day's effective permission period. Then, based on the total duration of the initial permission scheme's effective period, the number of executions per unit time is calculated, such as the number of executions per hour. This number is used as the core parameter of the operational frequency characteristic, reflecting the frequency of operations.

[0119] Step S1452: For each operation type, extract the start time and end time of each operation, calculate the time difference between the start time and end time to obtain the duration of a single operation, perform statistical analysis on all single operation durations of the same operation type, and obtain the statistical values ​​of the average, maximum, minimum and standard deviation, which together serve as components of the operation duration feature.

[0120] For each operation type, the start and end times of each operation are extracted, and the time difference between the two is calculated to obtain the duration of a single operation. Statistical analysis is performed on all single operation durations of the same operation type to calculate the average value, reflecting the average execution time of that operation type; the maximum and minimum values, to understand the fluctuation range of the operation duration; and the standard deviation, to measure the dispersion of the operation duration. These statistical values ​​together constitute the operation duration characteristics, describing the execution time characteristics of different operation types.

[0121] Step S1453: Construct an operation time sequence association model. Using the time sequence as the axis, record the execution sequence of each operation type, calculate the transition probability between adjacent operation types, and the transition probability is represented by the ratio of the number of times the operation type is executed after the previous operation type is executed to the total number of times the previous operation type is executed. Combine the operation types whose transition probability reaches the set probability as the feature content of the operation association feature, and record the average interval time between operation types.

[0122] A temporal sequence association model is constructed, using chronological order as the axis to record the sequence of various operation types performed by financial personnel. For example, the operation sequence might be "Query → Modify → Save → Submit". The transition probability between adjacent operation types is calculated, which is the proportion of times a subsequent operation type is executed immediately after the previous one, relative to the total number of times the previous operation type is executed. Combinations of operation types with transition probabilities reaching a set probability are used as feature content of operation association characteristics; these combinations reflect common associations between operations. Simultaneously, the average interval time between these operation types is recorded, i.e., the average time from the end of one operation to the start of the next related operation.

[0123] Step S1454: Filter out frequent operation types that are executed more than the operation frequency threshold within a unit time, and use the frequent operation types as the feature basis of operation preference features. At the same time, analyze the correlation between frequent operation types and current business task attributes, retain frequent operation types with a correlation greater than the set correlation, and record the correlation relationship with business task attributes in the feature association table. The feature association table is bound and stored with the operation preference feature set.

[0124] Operation types that are executed more than a frequency threshold within a given time period are identified as frequent operation types. These frequent operation types are then combined to form the feature base of operation preference characteristics. Simultaneously, the correlation between these frequent operation types and the attributes of the current business task is analyzed, for example, by calculating the correlation coefficient between the operation type and the task objective. Frequent operation types with a correlation greater than a set value are retained, and their association with business task attributes is recorded in a feature association table. The feature association table is stored in conjunction with the set of operation preference characteristics for future reference during permission adjustments and rule optimizations.

[0125] Step S1455: Standardize the extracted operation frequency features, operation duration features, operation association features, and operation preference features to obtain the behavioral features.

[0126] The extracted operation frequency features, operation duration features, operation association features, and operation preference features are standardized by converting them to the same numerical range, such as the [0, 1] interval. Standardization can eliminate the differences in units and orders of magnitude between different features, making them comparable and facilitating subsequent data analysis and model processing, ultimately yielding behavioral features.

[0127] Step S146: Bind the behavioral features with the iris identity features and state description features in the associated feature body to generate a comprehensive feature package containing identity, state, and behavioral information. Optimize the adaptation rule pool based on the comprehensive feature package. Based on the optimized adaptation rule pool and real-time operational behavior data, dynamically adjust the permission scope of the initial permission scheme. During the permission scope adjustment process, if new operation type features appear, determine whether to include the new operation type features in the permission scope by combining the correlation between the new operation type features and the business task and the operation security assessment. Simultaneously monitor the update status of the state description features in the associated feature body. When the physical space coordinates change and exceed the original permission scope corresponding to the space area, shrink the permission scope to the permission content matching the new space area. When the current business task attribute is completed, the operation permissions of the relevant business data are simultaneously reduced.

[0128] Behavioral features are bound to iris identity features and status description features in the associated feature body, integrating them into a comprehensive feature package containing identity, status, and behavioral information. Based on this comprehensive feature package, the matching status of current behavioral patterns with rules is analyzed, and the analysis results are fed back to the adaptation rule pool to optimize the rules in the rule pool, such as adjusting the trigger conditions or permission results of the rules. Based on the optimized adaptation rule pool and real-time operational behavior data, the permission scope of the initial permission scheme is dynamically adjusted. When a new operation type feature appears, its relevance to the business task is assessed, such as whether it is necessary to complete the task, and the operation security, such as whether there is a risk of data leakage, etc., and the decision is made on whether to include it in the permission scope based on the assessment results. At the same time, the update status description features in the associated feature body are monitored synchronously. When the physical spatial coordinates change and exceed the spatial area corresponding to the original permission scope, the permission scope is automatically shrunk to the permission content matching the new spatial area. For example, when moving from an area with high-level permissions to a normal area, the permissions are reduced accordingly. When the current business task attribute is completed, such as when an audit task ends, the operation permissions of related business data are reduced synchronously to reduce the risk of permission abuse.

[0129] Step S147: After the permission scope adjustment is completed, a dynamic permission result is generated. The dynamic permission result includes a real-time permission list, permission adjustment instructions, and permission validity period update information. The permission adjustment instructions clearly define the operational behavior data characteristics and rule optimization content on which the adjustment is based. The permission adjustment instructions are presented in the form of a structured table, which includes three columns: adjustment basis feature item, original rule content, and adjusted rule content.

[0130] After the permission scope adjustment is completed, a dynamic permission result is generated. This dynamic permission result includes a real-time permission list, which lists the specific permissions currently held by the finance personnel; a permission adjustment description, which details the basis for the permission adjustment, namely the operational behavior data characteristics and rule optimization content. This permission adjustment description is presented in a structured table format, with three columns: the adjustment basis feature item, the original rule content, and the adjusted rule content, clearly showing the changes before and after the adjustment; and permission validity period update information, indicating the new effective and expiration times of the permissions.

[0131] For example, the method may also include:

[0132] Step S1471: Extract permission call records, operation obstruction records, redundant permission call records, and necessary operation missing records during the execution of dynamic permission results. Permission call records include the call time, the type of permission called, and the corresponding status description features; operation obstruction records include the type of obstructed operation, the physical space coordinates and business task attributes corresponding to the obstruction time; redundant permission call records include the permission types that did not generate business value after being called, the number of calls, and the corresponding status description features; necessary operation missing records include the permission types that are necessary for the execution of business tasks but have not been assigned, and the business steps corresponding to the missing operations.

[0133] During the execution of dynamic permission results, the system continuously extracts various relevant records, including permission call records, which record the time when the permission was called, the type of permission called, and the status description characteristics at that time; operation obstruction records, which record the circumstances under which the operation was blocked, including the type of obstructed operation, the physical space coordinates at the time of obstruction, and the business task attributes; redundant permission call records, which record the permission types that did not generate business value after being called, the number of times they were called, and the corresponding status description characteristics; and necessary operation missing records, which record the permission types that are necessary for the execution of the business task but have not been assigned, as well as the business links corresponding to the missing operations.

[0134] Step S1472: The extracted records are time-stamp aligned and bound to the iris identity features and status description features in the associated feature body. The records are grouped according to the correspondence between the operation type features and the status description features. Records with the same operation type features and similar status description features are grouped into the same feature group. Each feature group is labeled with the corresponding dynamic permission result version.

[0135] The extracted records are aligned and bound to the iris identity features and status description features in the associated feature body according to timestamps to ensure accurate temporal correspondence. Then, the records are grouped according to the correspondence between operation type features and status description features, grouping records with the same operation type feature and similar status description features into the same feature group. Each feature group is labeled with the corresponding dynamic permission result version to trace and analyze operations under different permission versions.

[0136] Step S1473: Analyze the operation obstruction records and necessary operation missing records within each feature group, locate the adaptation deviation between the permission range and the status description features, the deviation where the permission range corresponding to the operation obstruction record is smaller than the status requirement, the deviation where the permission range corresponding to the necessary operation missing record does not cover the necessary business links, and synchronize the physical space coordinate changes, business task attribute updates and related device interaction records when the deviation occurs.

[0137] Analyze the operation-blocked records and necessary operation-missing records within each feature group to pinpoint the mismatch between the permission scope and the status description features. Operation-blocked records typically indicate that the permission scope is less than the current status requirement, preventing finance personnel from performing necessary operations; necessary operation-missing records indicate that the permission scope does not cover the essential business processes. During the analysis, track changes in physical space coordinates when the synchronization deviation occurs, such as whether the user has moved to a new area, updates to business task attributes, such as whether the task priority has increased, and interaction records with associated devices, such as whether new devices have been used, to comprehensively understand the background of the deviation.

[0138] Step S1474: Count the redundant permission call records in each feature group, identify redundant items whose permission scope exceeds the status requirements, and determine the redundancy based on the fact that there is no business operation record after the permission type is called in the feature group and is not related to the current business task attributes.

[0139] Redundant permission call records within each feature group are analyzed. This is done by checking whether a permission type call generates a corresponding business operation record and whether the permission type is associated with the current business task attribute, thus identifying redundant items whose permission scope exceeds state requirements. If a permission type is called but does not generate any business operation record and is unrelated to the current business task attribute, it is determined to be a redundant item.

[0140] Step S1475: Based on the analysis results of adaptation deviation and redundancy, generate an authorization rule optimization strategy. For deviations where the authorization scope is smaller than the state requirements, expand the authorization types under the corresponding state description features to cover the necessary business processes. For deviations where the authorization scope does not cover the necessary business processes, supplement the special permissions corresponding to the associated business task attributes. For redundancy, remove authorization content that is not related to the state description features and authorization types. Synchronize the authorization rule optimization strategy to the adaptation rule pool, update the trigger conditions and authorization results of the corresponding feature combinations, and mark the optimized rule version and the record identifier of the basis for optimization.

[0141] Based on the analysis results of adaptation deviations and redundancies, an optimization strategy for permission rules was formulated. For deviations where the permission scope is less than the state requirements, the permission types under the corresponding state description features were expanded to ensure coverage of essential business operations. For deviations where the permission scope does not cover essential business operations, specific permissions associated with business task attributes were added to meet task requirements. For redundancies, permission content unrelated to state description features and permission types was removed to streamline the permission scope. The above permission rule optimization strategy was synchronized to the adaptation rule pool, the triggering conditions and permission results of the corresponding feature combinations were updated, and the optimized rule version and the record identifier on which the optimization was based were marked for subsequent traceability and verification.

[0142] Step S1476: Select scenarios with the same iris identity features and similar state description features, apply the optimized rules to generate a verification permission scheme, record the execution process of the verification permission scheme, and extract permission call records, operation obstruction records, redundant permission call records, and necessary operation missing records during the verification process; compare the records during the verification process with the records before optimization to confirm the improvement of adaptation deviation and redundancy items, formally include the optimized rules that pass the verification into the adaptation rule pool, and return the optimized rules that fail to pass the verification to re-analyze the adaptation deviation and redundancy items, adjust the optimization strategy, and verify again.

[0143] Select scenarios with identical iris identity features and similar state descriptions, such as the same finance personnel in similar tasks and states, and apply the optimized rules to generate a verification permission scheme. Record the execution process of this verification permission scheme, extract various records during the execution process, and compare them with the records before optimization. Analyze whether the adaptation deviation has been reduced and whether redundant items have been effectively removed to confirm the optimization effect. Formalize the optimized rules that pass the verification into the adaptation rule pool. For rules that fail the verification, go back and re-analyze the adaptation deviation and redundant items, adjust the optimization strategy, and verify again until the rule optimization meets the requirements.

[0144] Step S1477: When the same type of operation is blocked, redundant calls are made, or necessary operations are missing during the execution of subsequent dynamic permission results, the historical optimization basis is traced back by recording the identifier, the reasons for the repeated deviations are analyzed, if the state description feature extraction is incomplete, the feature extraction dimensions are supplemented, if the rule matching logic is missing, the rule triggering conditions are adjusted, a backtracking correction strategy is generated, and the adaptation rule pool is updated.

[0145] During the subsequent execution of dynamic permission results, if the same type of operation is blocked, redundant calls are made, or necessary operations are missing again, the historical optimization basis is traced back by recording the identifier to analyze the reasons for the repeated deviations. If the problem is due to incomplete extraction of state description features, resulting in inaccurate rule matching, then the dimensions of feature extraction are supplemented, such as adding new state features. If there are omissions in the rule matching logic, such as certain conditions not being considered, then the triggering conditions of the rules are adjusted. Based on the analysis results, a backtracking correction strategy is generated, and the adaptation rule pool is updated to continuously improve the accuracy and applicability of the rules.

[0146] Step S150: Synchronize the dynamic permission results to the permission control node and associated operation terminal, execute permission enable, adjust or disable commands through the permission control node, and record the permission change trajectory to form a traceable data chain.

[0147] After the dynamic permission results are generated, they need to be synchronized to the permission control node and the associated operation terminals used by financial personnel. The permission control node executes corresponding permission enabling, adjustment, or disabling commands based on the dynamic permission results, ensuring that the permission status of financial personnel is consistent with the dynamic permission results. Simultaneously, a detailed record of permission change events is maintained, including the time of permission activation, the content of the adjustment, and the time of disabling, forming a traceable data chain for auditing and querying when needed, ensuring transparency and oversight of permission changes.

[0148] Step S151: Parse the dynamic permission results and extract the real-time permission list, permission adjustment instructions, and permission validity period update information from the dynamic permission results. The real-time permission list clarifies the specific permission type, permission scope, and permission operation restrictions. The permission adjustment instructions clarify the operational behavior data characteristics and rule optimization content on which the adjustment is based. The permission validity period update information clarifies the start and end times of the new permission validity period.

[0149] The dynamic permission results are analyzed to extract the real-time permission list, permission adjustment instructions, and permission validity period update information. The real-time permission list details the specific permission types currently held by finance personnel, such as query and modify permissions, the scope of these permissions (i.e., the range of financial data they can manipulate), and operation restrictions, such as operation time and frequency limits. The permission adjustment instructions explain the basis for permission adjustments, including operational behavior data characteristics and specific rule optimizations. The permission validity period update information clarifies the start and end times of the new permission validity period.

[0150] Step S152: Establish a data transmission channel between the dynamic permission results and the permission control node. Use an encrypted transmission protocol to ensure the security of data transmission. After the transmission channel is established, perform a data connectivity test and transmit the test data to the permission control node. The permission control node receives and feeds back the test results. After the test is passed, the dynamic permission results are officially transmitted.

[0151] A data transmission channel is established between the dynamic permission results and the permission control node. To ensure data transmission security, an encrypted transmission protocol, such as SSL / TLS, is used. After the transmission channel is established, a data connectivity test is performed by transmitting test data to the permission control node. The node receives the data and sends back the test result. If the test passes, the channel is considered normal, and the dynamic permission results are officially transmitted. If the test fails, the channel is checked for problems, and the connection is re-established until the test passes.

[0152] Step S153: Transmit the dynamic permission results to the permission management node. After receiving the dynamic permission results, the permission management node extracts the permission types from the real-time permission list and compares the currently effective permission types with the permission types in the real-time permission list.

[0153] The dynamic permission results are transmitted to the permission management node. After receiving the data, the node extracts the permission types from the real-time permission list. Then, it compares the currently effective permission types with the permission types in the real-time permission list to identify any differences.

[0154] Step S154: If there is no effective permission at present, generate a permission activation instruction. The permission activation instruction specifies the permission type, permission scope, permission validity period and permission operation restrictions. The execution time of the permission activation instruction is consistent with the start time of the permission validity period.

[0155] If the comparison reveals that no permissions are currently in effect, a permission activation instruction is generated. This instruction specifies the type of permission to be enabled, its scope, validity period, and operational restrictions. The execution time of the permission activation instruction is set to match the start time of the permission's validity period to ensure that the permission is activated promptly at the beginning of its validity period.

[0156] Step S155: If there is a difference between the currently effective permission and the permission type in the real-time permission list, and the difference is manifested as an increase in the permission type, then a permission extension instruction is generated in the permission adjustment instruction. The permission extension instruction specifies the newly added permission type, the scope of the newly added permission and the operation restrictions. The validity period of the newly added permission is consistent with the validity period of the permission in the real-time permission list.

[0157] When the currently active permissions differ from the permission types in the real-time permission list, and a new permission type is added to the real-time permission list, a permission extension instruction is generated in the permission adjustment command. This permission extension instruction specifies the new permission type, the scope of the new permission, and its operational restrictions. The validity period of the new permission is consistent with the validity period of the permissions in the real-time permission list to ensure the continuity and consistency of permissions.

[0158] Step S156: If there is a difference between the currently effective permissions and the permission types in the real-time permission list, and the difference is manifested as a reduction in permission types, then a permission contraction instruction is generated in the permission adjustment instruction. The permission contraction instruction specifies the permission type to be cancelled and the cancellation time, and the cancellation time is consistent with the generation time of the permission adjustment instruction.

[0159] If the currently active permissions exceed the number of permission types in the real-time permission list, meaning a reduction in permission types is needed, a permission contraction instruction is generated within the permission adjustment directive. This permission contraction instruction specifies the permission types to be cancelled and the cancellation time. The cancellation time is typically set to match the generation time of the permission adjustment instruction to promptly revoke unnecessary permissions.

[0160] Step S157: If there is no permission type in the real-time permission list, a permission disabling instruction is generated. The permission disabling instruction specifies all permission types to be disabled and the disabling time. The disabling time is consistent with the generation time of the permission disabling instruction.

[0161] When the real-time permission list contains no permission types, it means that the finance personnel should not currently have any permissions. In this case, a permission disabling instruction is generated. This instruction explicitly disables all permission types and specifies the disabling time. The disabling time is consistent with the instruction's generation time, ensuring that permissions are disabled immediately.

[0162] Step S158: Transmit the generated permission enable command, permission adjustment command, or permission disable command to the associated operation terminal, so that after receiving the command, the associated operation terminal can adjust the local permission configuration according to the command content, and enable, expand, shrink or disable the corresponding permission function.

[0163] The generated permission enable, permission adjustment, or permission disable instructions are transmitted via a secure data transmission channel to the associated operation terminals used by finance personnel, such as computers or dedicated finance terminals. Upon receiving the instructions, the associated operation terminals adjust their local permission configurations accordingly, enabling new permissions, expanding existing permissions, narrowing permission scopes, or disabling corresponding permission functions to ensure that the terminal's permission status is consistent with the dynamic permission results.

[0164] Step S159: Record the generation time, instruction type, instruction content, and execution object of the permission instruction through the permission control node, and record the reception time, execution time, and execution result of the permission instruction through the associated operation terminal. Both records contain the corresponding dynamic permission result identifier. Extract the record information from the permission control node and the associated operation terminal, arrange them in chronological order, and form the basic data for the permission change trajectory. Integrate the generation time, reception time, execution time, instruction type, instruction content, execution object, and execution result from the basic data, add the dynamic permission result identifier and the corresponding iris identity feature, and form the permission change trajectory record. Link the permission change trajectory records corresponding to each permission change in chronological order, with the execution result of the previous record serving as the preceding state of the next record, to form a traceable data chain. Store the traceable data chain in the permission change database, and set an index in the permission change database with the iris identity feature as the retrieval key.

[0165] The access control node records detailed information about each access instruction, including its generation time, type (enable, adjust, disable), content, and target (i.e., the iris recognition feature of the financial personnel). The associated operation terminal records the receipt time, execution time, and result of the access instruction, such as whether the permission was successfully enabled, adjusted, or disabled. Both records include corresponding dynamic access result identifiers for association. The records from the access control node and associated operation terminal are extracted and arranged chronologically to form the foundational data for access change tracking. This foundational data, including generation time, receipt time, execution time, instruction type, content, target, and result, is integrated, and dynamic access result identifiers and corresponding iris recognition features are added to create a complete access change tracking record. Each access change is linked chronologically, with the execution result of the previous record serving as the preceding state for the next, thus forming a complete and traceable data chain. Finally, this traceable data chain is stored in the access change database, which is indexed using iris recognition features as the search key, facilitating subsequent queries of the financial personnel's access change history by iris recognition.

[0166] Based on the same inventive concept, please refer to Figure 2The diagram shows a schematic block diagram of a dynamic permission allocation system 100 based on iris recognition and real-time status monitoring, provided in an embodiment of this application, for executing the above-described dynamic permission allocation method based on iris recognition and real-time status monitoring. The dynamic permission allocation system 100 based on iris recognition and real-time status monitoring may include a communication unit 110, a machine-readable storage medium 120, and a processor 130.

[0167] In this embodiment, both the machine-readable storage medium 120 and the processor 130 are located in the dynamic permission allocation system 100 based on iris recognition and real-time status monitoring, and are separately configured. Alternatively, the machine-readable storage medium 120 can also be integrated into the processor 130 and can communicate and interact with external systems through the communication unit 110. The machine-readable storage medium 120 is used to store machine-executable instructions for executing the scheme of this application, and the processor 130 is used to execute the machine-executable instructions stored in the machine-readable storage medium 120 to implement the dynamic permission allocation method based on iris recognition and real-time status monitoring provided in the aforementioned method embodiments.

[0168] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A dynamic permission allocation method based on iris recognition and real-time status monitoring, characterized in that, The method includes: The system collects iris texture images and real-time status monitoring data. The iris texture images record the contraction shape of the iris sphincter muscle, the intersection points of texture bifurcation, and the grayscale distribution details of the edge contour. The real-time status monitoring data includes physical space coordinates, interaction records of associated devices, current business task attributes, and information on the organization to which the identity belongs. Feature anchoring processing is performed on iris texture images and real-time status monitoring data to generate an associated feature body of iris identity features and status description features. The associated feature body establishes a bidirectional mapping through timestamp synchronization. When iris identity features are called, the corresponding status description features are directly associated and extracted. When the status description features are updated, they are associated with the corresponding iris identity features in real time. The historical permission interaction database is called to mine iris identity features, status description features and permission content for contextual matching and association, and an adaptation rule pool is generated. The adaptation rule pool constructs a logical link with feature combination as the trigger condition and permission range as the execution result. The initial permission scheme is obtained by matching the related feature body with the adaptation rule pool. Track operational behavior data based on the initial permission scheme, analyze the compatibility between the operational behavior data and the initial permission scheme, extract behavioral features to optimize the adaptation rule pool, and generate dynamic permission results after dynamically adjusting the permission range. The dynamic permission results are synchronized to the permission control node and associated operation terminal. The permission control node executes the permission enabling, adjusting or disabling commands, and records the permission change trajectory to form a traceable data chain.

2. The dynamic permission allocation method based on iris recognition and real-time status monitoring according to claim 1, characterized in that, The acquisition of iris texture images and real-time status monitoring data includes: The synchronous triggering mechanism of the iris acquisition device and the multi-source status acquisition device is activated. A data linkage channel between the devices is established through the wireless transmission protocol. The system time of all acquisition devices is calibrated using the network time protocol so that the acquisition actions of each device start at the same time node. The iris acquisition device obtains ambient light data through the ambient light sensor component. Based on the ambient light data, adaptive supplementary light adjustment is activated. When the ambient light data is lower than the preset lower limit, the infrared supplementary light intensity is gradually increased until the iris area is evenly illuminated. When the ambient light data is higher than the preset upper limit, the anti-glare filter is activated and the supplementary light intensity is reduced to avoid overexposure or shadows in the iris area. After the lighting is adjusted, the iris acquisition device is called to locate the position of the eyeball. The iris boundary is determined based on the gray difference between the pupil and the iris. The lens module is driven to focus on the center of the iris area and captures multiple frames of eye images continuously according to the preset frame rate. Multiple consecutively captured eye images undergo quality screening. Images meeting all screening criteria are identified as iris texture images. The screening criteria include iris region integrity, texture clarity, and noise interference level. Iris region integrity requires that the iris boundary be complete and occupy a proportion of the image that meets a preset standard. Texture clarity is measured by edge gradient values, and noise interference level is evaluated by pixel grayscale fluctuation range. The iris texture image preserves the contraction state of the iris sphincter, pupil edge morphological features, and bifurcation and intersection details of the iris texture. The contraction state of the iris sphincter, pupil edge morphological features, and bifurcation and intersection details of the iris texture are recorded through image pixel grayscale values, with each pixel grayscale value corresponding to different structural features of the iris tissue. The spatial positioning device is invoked to start the multi-source positioning function under the synchronous trigger signal. It combines indoor wireless positioning and visual positioning technology to obtain physical spatial coordinates. The physical spatial coordinates include planar coordinates and height information. The positioning accuracy of the physical spatial coordinates meets the permission allocation requirements in different scenarios. The device interaction monitoring device establishes a data interaction channel with the associated terminal device, and captures the operation command input time, operation function type and operation object identifier of the terminal device in real time. The operation function type corresponds to the specific function of the terminal device, and the operation object identifier specifies the name of the data or file being operated. An interaction record of the associated device is formed based on the operation command input time, operation function type and operation object identifier. Retrieve the current task assignment record from the business management system. The current task assignment record includes the task name, task priority, task execution period, and the scope of business data associated with the task. At the same time, obtain the organization information to which the identity belongs through the identity management system. The organization information to which the identity belongs includes the department, job title, and business area of ​​responsibility. Integrate the current task assignment record and the organization information to which the identity belongs to form the current business task attributes and the organization information to which the identity belongs. After adding a synchronization timestamp to the iris texture image, physical space coordinates, associated device interaction records, current business task attributes, and the organization information to which the identity belongs, the data is integrated to form real-time status monitoring data.

3. The dynamic permission allocation method based on iris recognition and real-time status monitoring according to claim 1, characterized in that, The step of performing feature anchoring processing on the iris texture image and real-time status monitoring data to generate a correlated feature body of iris identity features and status description features includes: Region segmentation processing is performed on the iris texture image, and the gray-level gradient change of the eye region is detected by the edge contour recognition algorithm. First, the outer contour boundary of the entire eye region is determined. Then, based on the gray-level difference threshold between the iris and sclera and the pupil, the iris region is distinguished from the sclera region and the pupil region. The effective extraction area of ​​iris texture is marked in the form of a coordinate frame. Noise filtering is performed on the iris image within the effective extraction area. An adaptive filtering algorithm is used to dynamically adjust the filtering parameters according to the noise type in different regions of the iris image. The filtering intensity is reduced in areas with dense iris texture and increased in areas with edge transition. After filtering, a texture enhancement algorithm is used to enhance the grayscale contrast of the texture edges to obtain enhanced iris texture information. A predefined feature encoding algorithm is used to convert the enhanced iris texture information into iris identity features. In the encoding process, the key feature points of the iris texture are first extracted. The key feature points include texture bifurcation points, texture endpoints and texture intersections. Then, the coordinate information and morphological parameters of the texture bifurcation points, texture endpoints and texture intersections are obtained. Then, the coordinate information and morphological parameters are processed by a hash encoding algorithm to generate a fixed-length feature code as the iris identity feature. Feature classification and extraction are performed on real-time status monitoring data. Spatial location features are extracted from physical space coordinates, and the spatial location features are directly represented by the numerical form of physical space coordinate information. Operation timing features and operation type features are extracted from the interaction records of associated devices. The operation timing features consist of the time sequence of the operation command input time in the interaction records of associated devices, and the operation type features map different operation function types in the interaction records of associated devices into unique feature codes. Task features are extracted from the current business task attributes. These features include task priority features and task association scope features. Job attribute features are extracted from the organization information to which the identity belongs. A unique feature identifier is generated based on the department and job name in the organization information to which the identity belongs. The task priority features, task association scope features, and job attribute features together constitute the status description features. A structured feature association carrier is constructed, with iris identity features as the core index field and spatial location features, operation time sequence features, operation type features, task features, and job attribute features as association fields. Using timestamps as search criteria, iris identity features and various status description features under the same timestamp are located. Each feature data is then filled into the corresponding field of the feature association carrier through field identifiers to obtain the bound feature data. The bound feature data is converted into standardized data within the same numerical range, and a two-way mapping mechanism is established in the feature association carrier. When the iris identity feature is used as the index key, all corresponding state description features are directly located and extracted. When any state description feature is used as the index key, it is quickly associated with the corresponding iris identity feature. This generates an associated feature body containing iris identity features and state description features. The associated feature body retains the binding relationship and two-way mapping information between iris identity features and state description features. The associated feature body is stored in a designated partition of the feature database. Establish a real-time update mechanism for the associated feature body to monitor changes in real-time status monitoring data. When status data such as physical space coordinates and associated device interaction records are updated, extract new status description features, associate them with the corresponding iris identity features through a two-way mapping mechanism, and synchronously update the relevant fields in the associated feature body.

4. The dynamic permission allocation method based on iris recognition and real-time status monitoring according to claim 1, characterized in that, The process of calling the historical permission interaction database to mine iris identity features, status description features, and permission content for contextual matching and association, generating an adaptation rule pool, includes: The historical permission interaction records of the target object and other objects in the same position are collected from the permission management system through the data interface. The collection scope covers all permission allocation, usage and change data within a preset historical time period. The historical permission interaction records include iris identity features, status description features, allocated permission content, permission usage duration and permission usage feedback information. The historical permission interaction records are preprocessed, and the record sets are divided according to the job attribute characteristics and business task characteristics. Records with the same combination of job attribute characteristics and business task characteristics are grouped into the same set. The records in the same set are sorted in chronological order and stored in a temporary data folder. The temporary data folder is named with a combination of job attribute characteristic identifier and business task characteristic identifier. For each record set, an association analysis algorithm is used to mine the correspondence between iris identity features, status description features and permission content in the record set, calculate the association strength between feature combinations and permission content, and comprehensively calculate the association strength by combining the co-occurrence frequency of features and permissions and the matching accuracy. Combinations with association strength reaching a preset strength threshold are determined as valid association relationships. Based on effective correlations, adaptation rules are extracted and formed. The adaptation rules adopt a structured form of feature combination conditional permission results, which are used to clarify the coordinate range of iris identity features, spatial location features, the encoding value of operation type features, task priority features, and job attribute feature identifiers. The feature combination conditional permission results are used to clarify the corresponding permission scope, permission validity period, and permission operation restrictions. The implementation adaptation rules are classified based on a predefined scene tag mechanism, wherein the scene tag mechanism is generated according to the coordinate range of spatial location features, the type of business task features, and the scope of responsibilities of job attribute features, and each adaptation rule is bound to at least one scene tag. An index directory for an adaptation rule pool is constructed based on the scene tags. The index directory uses scene tags and feature types as dual search dimensions. Each index item in the index directory is associated with the storage address of the corresponding adaptation rule. Iris identity features and state description features are extracted from the associated feature body, and scene retrieval tags are generated by combining them with the current scene information. The scene retrieval tags are then matched with the index directory of the adaptation rule pool to initially select a set of candidate rules that match the current scene. The rules in the candidate rule set are matched to determine the appropriate rule that perfectly matches the current feature combination; If a perfectly matching adaptation rule exists, the permission result corresponding to the rule is directly extracted as the initial permission scheme. If no perfectly matching adaptation rule exists, multiple similar rules with the highest correlation strength are selected. The permission range of the similar rules is weighted and fused by combining the priority features of the current business task attributes and the accuracy of the spatial location features. Permission conflicts are eliminated, missing permissions are supplemented, and the initial permission scheme is generated after adjustment. The initial permission scheme is used for operable permission types, permission scope, permission effective time, and permission operation restrictions. The permission scope is consistent with the business data range associated with the business task features in the associated feature body, and the permission effective time is set according to the execution period of the current business task features. The initial permission scheme is stored in a structured file format and synchronized to the temporary permission cache.

5. The dynamic permission allocation method based on iris recognition and real-time status monitoring according to claim 1, characterized in that, The process of tracking operational behavior data based on the initial permission scheme, analyzing the compatibility between the operational behavior data and the initial permission scheme, extracting behavioral features to optimize the adaptation rule pool, and dynamically adjusting the permission range to generate dynamic permission results includes: Initiate an operation behavior tracking process in the permission control node to capture all operation behavior data based on the initial permission scheme in real time. The operation behavior data includes operation time, operation object, operation content, operation result, and operation duration. The operation behavior data is divided into different operation sets according to the operation type characteristics, and records with the same operation type characteristics are grouped into the same set; The operation behavior data is subjected to adaptation analysis with the initial permission scheme to obtain adaptation analysis results. The adaptation analysis results include two dimensions: permission scope adaptation and operation necessity. Permission scope adaptation determines whether the operation behavior is within the permission scope specified in the initial permission scheme. Operation necessity combines the attributes of the current business task to determine whether the operation behavior is related to task execution. Based on the adaptation analysis results, the adaptation level of each operation record is determined, and the proportion of operation records at each adaptation level is statistically analyzed. Operation records that exceed the permission range are marked with the corresponding operation type characteristics and operation object identifiers. Necessary operation records that cannot be executed due to lack of permissions are marked with the corresponding business task association information. Behavioral features are extracted from operational behavior data. These behavioral features include operation frequency features, operation duration features, operation association features, and operation preference features. Operation frequency features are represented by the number of times the same operation type is executed per unit time. Operation duration features are represented by the statistical value of the duration of each operation. Operation association features are represented by the execution order relationship between different operation types. Operation preference features are represented by the set of frequent operation types. The behavioral characteristics are bound to the iris identity characteristics and status description characteristics in the associated characteristic body to generate a comprehensive feature package containing identity, status and behavioral information. The adaptation rule pool is optimized based on the comprehensive feature package. Based on the optimized adaptation rule pool and real-time operation behavior data, the permission scope of the initial permission scheme is dynamically adjusted. If a new operation type characteristic appears during the permission scope adjustment process, the correlation between the new operation type characteristic and the business task and the operation security assessment are combined to determine whether the new operation type characteristic should be included in the permission scope. Synchronously monitor the updates of status description features in the associated feature body. When the physical space coordinates change and exceed the spatial area corresponding to the original permission scope, shrink the permission scope to the permission content that matches the new spatial area. When the current business task attribute is completed, the operation permissions of related business data are reduced synchronously. After the permission scope is adjusted, a dynamic permission result is generated. The dynamic permission result includes a real-time permission list, permission adjustment instructions, and permission validity period update information. The permission adjustment instructions clearly define the operational behavior data characteristics and rule optimization content on which the adjustment is based. The permission adjustment instructions are presented in the form of a structured table, which includes three columns: adjustment basis feature item, original rule content, and adjusted rule content.

6. The dynamic permission allocation method based on iris recognition and real-time status monitoring according to claim 5, characterized in that, The extraction of behavioral features from operational behavior data includes: The preprocessed operation behavior data is grouped and statistically analyzed according to operation type characteristics. The total number of executions for each operation type within the effective period of the initial permission scheme is determined. The number of executions per unit time is calculated based on the total duration of the effective period of the initial permission scheme, and the number of executions per unit time is used as the core parameter of the operation frequency characteristic. For each operation type, the start and end times of each operation are extracted from the operation records. The time difference between the start and end times is calculated to obtain the duration of a single operation. Statistical analysis is performed on all single operation durations of the same operation type to obtain the statistical values ​​of the mean, maximum, minimum, and standard deviation, which together serve as components of the operation duration feature. Construct an operation time sequence association model, with the time sequence as the axis, record the execution sequence of each operation type, calculate the transition probability between adjacent operation types, the transition probability is represented by the proportion of the number of times the operation type is executed after the previous operation type is executed to the total number of times the previous operation type is executed, and the operation type combination with the transition probability reaching the set probability is used as the feature content of the operation association feature, while recording the average interval time between operation types. Frequent operation types that are executed more than the operation frequency threshold within a unit of time are selected, and these frequent operation types are used as the feature basis of operation preference features. At the same time, the correlation between frequent operation types and current business task attributes is analyzed, and frequent operation types with a correlation greater than the set correlation are retained. The correlation relationship between these frequent operation types and business task attributes is recorded in a feature association table, which is bound and stored with the operation preference feature set. The extracted operation frequency features, operation duration features, operation association features, and operation preference features are standardized to obtain the behavioral features.

7. The dynamic permission allocation method based on iris recognition and real-time status monitoring according to claim 3, characterized in that, The enhanced iris texture information is converted into iris identity features using a predefined feature encoding algorithm. The encoding process first extracts key feature points of the iris texture, including texture bifurcation points, texture endpoints, and texture intersections. Then, the coordinate information and morphological parameters of these points are obtained. Finally, a hash encoding algorithm is used to process the coordinate information and morphological parameters to generate a fixed-length feature code as the iris identity feature, including: The enhanced iris texture image is scanned, and the entire effective extraction area of ​​the iris is traversed through a sliding window. The size of the sliding window is dynamically adjusted according to the density of the iris texture. The sliding window size is reduced in areas with dense texture to capture fine feature points, and the sliding window size is increased in areas with sparse texture to improve detection efficiency. Within each sliding window, the extreme value of the second derivative of the pixel gray level is calculated, and the extreme value of the second derivative is used as a candidate feature point. At the same time, combined with the texture direction information within the sliding window, pseudo feature points in areas with chaotic texture direction are eliminated. The criteria for judging pseudo feature points is that the variance of the texture direction of the pixels surrounding the candidate feature point exceeds a preset threshold. Candidate feature points are classified and identified, and texture bifurcation points, texture endpoints and texture intersections are distinguished based on the connection relationship of the textures surrounding the candidate feature points. Record the coordinate information of various feature points within the effective extraction area of ​​the iris. The coordinate information is established based on the pixel coordinate system of the iris image, with the upper left corner of the iris region as the origin, the horizontal direction as the horizontal axis, and the vertical direction as the vertical axis. Extract the morphological parameters of each feature point. The morphological parameters of the texture bifurcation point include the extension direction angle and texture width of each bifurcation texture. The morphological parameters of the texture endpoint include the radius of curvature and grayscale gradient of the texture endpoint. The morphological parameters of the texture intersection point include the included angle of the intersecting textures and their respective texture contrast. The coordinate information and morphological parameters of the feature points are normalized, and the normalized coordinate information and morphological parameters are sorted according to the feature point type to form a structured feature data sequence. The structured feature data sequence is processed by calling a hash encoding algorithm. The generated feature code is compared with all feature codes in the historical iris identity feature database. The Hamming distance is calculated. If the Hamming distance exceeds a preset threshold, it is determined to be a unique feature code. If it is lower than the preset threshold, the feature point extraction parameters are readjusted until a unique feature code is generated. The final determined unique feature code is used as the iris identity feature and stored in association with the corresponding iris texture image metadata. The metadata includes the acquisition time, acquisition device identifier and image quality score. The iris identity feature, iris texture image metadata and their relationship are written into the identity feature database. An index is set in the database with the iris identity feature as the retrieval key.

8. The dynamic permission allocation method based on iris recognition and real-time status monitoring according to claim 1, characterized in that, The process of synchronizing dynamic permission results to the permission control node and associated operation terminals, executing permission enabling, adjusting, or disabling commands through the permission control node, and recording permission change trajectories to form a traceable data chain includes: The dynamic permission results are parsed, and the real-time permission list, permission adjustment instructions, and permission validity period update information are extracted from the dynamic permission results. The real-time permission list clarifies the specific permission type, permission scope, and permission operation restrictions. The permission adjustment instructions clarify the operational behavior data characteristics and rule optimization content on which the adjustment is based. The permission validity period update information clarifies the start and end times of the new permission validity period. Establish a data transmission channel between the dynamic permission results and the permission control node, and use an encrypted transmission protocol to ensure the security of data transmission. After the transmission channel is established, a data connectivity test is performed first, and the test data is transmitted to the permission control node. The permission control node receives and feeds back the test results. After the test is passed, the dynamic permission results are officially transmitted. The dynamic permission results are transmitted to the permission management node. After receiving the dynamic permission results, the permission management node extracts the permission types from the real-time permission list and compares the currently effective permission types with the permission types in the real-time permission list. If no permissions are currently active, a permission activation instruction is generated. The permission activation instruction specifies the permission type, scope of permission, validity period of permission, and operation restrictions of permission. The execution time of the permission activation instruction is consistent with the start time of the permission validity period. If the currently effective permissions differ from the permission types in the real-time permission list, and the difference is manifested as an increase in permission types, a permission extension instruction is generated in the permission adjustment instruction. The permission extension instruction specifies the newly added permission type, the scope of the newly added permission, and the operation restrictions. The validity period of the newly added permission is consistent with the validity period of the permissions in the real-time permission list. If there is a difference between the currently effective permissions and the permission types in the real-time permission list, and the difference is manifested as a reduction in the number of permission types, then a permission contraction instruction is generated in the permission adjustment instruction. The permission contraction instruction specifies the permission type to be cancelled and the cancellation time, and the cancellation time is consistent with the generation time of the permission adjustment instruction. If there is no permission type in the real-time permission list, a permission disabling instruction is generated. The permission disabling instruction specifies all permission types to be disabled and the disabling time. The disabling time is consistent with the generation time of the permission disabling instruction. The generated permission enable command, permission adjustment command, or permission disable command is transmitted to the associated operation terminal so that the associated operation terminal can adjust the local permission configuration according to the command content after receiving the command, and enable, expand, shrink or disable the corresponding permission function. The permission control node records the generation time, type, content and execution target of permission commands, and the associated operation terminal records the receipt time, execution time and execution result of permission commands. Both records contain the corresponding dynamic permission result identifier. Extract the record information of the permission control nodes and associated operation terminals, arrange them in chronological order, and form the basic data of permission change trajectory; By integrating the generation time, reception time, execution time, instruction type, instruction content, execution object, and execution result from the basic data, dynamic permission result identifiers and corresponding iris identity features are added to form a permission change trajectory record; Each permission change is recorded in chronological order, and the execution result of the previous record is used as the preceding state of the next record to form a traceable data chain. The traceable data chain is stored in the permission change database, which uses iris identity features as the retrieval index.

9. A dynamic permission allocation system based on iris recognition and real-time status monitoring, characterized in that, include: processor; A machine-readable storage medium for storing machine-executable instructions of the processor; The processor is configured to execute the dynamic permission allocation method based on iris recognition and real-time status monitoring as described in any one of claims 1 to 8 by executing the machine-executable instructions.

10. A computer program product, characterized in that, The computer program product includes machine-executable instructions stored in a computer-readable storage medium. The processor of the computer device reads the machine-executable instructions from the computer-readable storage medium and executes the machine-executable instructions, causing the computer device to perform the dynamic permission allocation method based on iris recognition and real-time status monitoring according to any one of claims 1 to 8.

Images