Power station material access control method and authentication system based on dynamic permission configuration

Abstract

The invention discloses a power station material access control method and authentication system based on dynamic permission configuration, and relates to the technical field of power station material access, and the method comprises the steps: obtaining a user, a role, a material and an operation set, and building an initial permission matrix and a historical log; identifying redundant candidate permissions based on operation counting and a user coverage rate, realizing permission optimization through matrix element zero clearing and new subdivision roles, and performing conflict detection and role separation based on a mutual exclusion permission rule set; after an access request is received, basic authorization verification is carried out based on the optimization authority, a comprehensive risk index is calculated, and the number of authentication steps is determined; executing multi-factor authentication according to steps, controlling operation of the material storing and taking equipment after successful authentication, and generating a log for subsequent optimization; according to the invention, dynamic optimization of authority and risk-adaptive multi-level authentication are realized, and the safety and management efficiency of power station material access are improved.

Description

Technical Field

[0001] This invention relates to the field of power plant material storage and retrieval technology, and more specifically, to a power plant material storage and retrieval control method and authentication system based on dynamic permission configuration. Background Technology

[0002] In power plant operation, the secure storage and retrieval of materials is crucial. Currently, power plant material management mostly adopts a role-based static access control (RBAC) model. This model has fixed permission configurations and cannot be dynamically adjusted according to actual usage, resulting in a coarse-grained permission configuration and widespread permission redundancy. A large number of idle or rarely used permissions remain in roles, increasing the risk of permission abuse. At the same time, the static model is difficult to cope with risk changes in complex scenarios, has a single authentication strength, and cannot dynamically adjust security policies according to the importance of materials, operation type, time, and user behavior. In addition, permission conflicts within roles often rely on manual review, which is inefficient and prone to omissions. Therefore, existing technologies suffer from problems such as imprecise permission management, rigid security policies, inability to adapt to dynamic risks, and insufficient permission conflict detection capabilities. To address the above problems, this invention proposes a solution. Summary of the Invention

[0003] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a power plant material access control method and authentication system based on dynamic permission configuration to solve the problems mentioned in the background art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: The power plant material access control method based on dynamic permission configuration includes the following steps: In the power plant material storage and retrieval authentication system, obtain user sets, role sets, material sets, and operation sets, establish user-role mapping relationships, and generate an initial permission matrix and a historical material storage and retrieval log set according to role, material, and operation type; Based on the obtained initial permission matrix and historical resource access log set, for each role, resource, and operation type, the operation count and user coverage are calculated. Permissions with operation counts lower than the permission usage frequency threshold and user coverage lower than the role coverage threshold are marked as redundant candidate permissions, thus obtaining a set of redundant candidate permissions. The process involves clearing the matrix elements corresponding to redundant candidate permissions in the initial permission matrix and creating new sub-roles for users who actually use the redundant candidate permissions. Permission conflicts in the newly created sub-roles are detected based on the mutual exclusion permission rule set, and conflicting permissions are separated into roles. This generates an optimized role set, permission matrix, and user-role mapping relationship. Upon receiving a request for access to supplies, basic authorization verification is performed based on the optimized user-role mapping and permission matrix; if authorization is successful, a comprehensive risk index is calculated; and the number of authentication steps is determined by comparing the comprehensive risk index with a preset risk threshold. Multi-factor authentication is performed sequentially based on the number of authentication steps; if all authentication steps are successful, the material storage and retrieval equipment is controlled to perform operations; operation logs are generated and the historical operation and historical material storage and retrieval log sets are updated.

[0005] In a preferred embodiment, after obtaining the user set, role set, resource set, and operation set, the method further includes: establishing a role-resource permission matrix as an initial permission matrix based on roles, resources, and operation types. The initial permission matrix sets matrix elements with the number of roles, resources, and operation types as dimensions. When a role is granted permission to perform a certain operation type on a resource, the corresponding matrix element is set to 1; otherwise, it is set to 0. A historical material access log set is formed by collecting historical material access logs within a certain time range from the power plant material access authentication system. Each historical operation record in the historical material access log set includes at least the user, role, material, operation type, timestamp, and operation result fields. Each material has its pre-assigned security level, and the operation type corresponds to storage and retrieval operations. It also includes importing mutually exclusive permission rule sets, where elements represent conflicting combinations of material operation permissions that need to be isolated.

[0006] In a preferred embodiment, the operation count is calculated as follows: within a preset statistical analysis period, log entries whose timestamps fall within the statistical analysis period and whose operation results are successful are selected from the historical material access log set. The log entries are categorized and accumulated according to role, material, and operation type to obtain the operation count of each role performing each operation type on each material. The operation count is then used as matrix elements to form a frequency matrix, which is used to characterize the frequency of use of each ternary permission within the statistical analysis period. Furthermore, a permission usage frequency threshold is preset for each operation type to distinguish between high-frequency and low-frequency permissions.

[0007] In a preferred embodiment, the calculation of user coverage includes: determining the set of subordinate users and the number of users for each role based on the user-role mapping relationship; for each ternary permission in the initial permission matrix, within the statistical analysis period, counting the set of users who performed the corresponding operation type on the corresponding material with the identity of the role to which the ternary permission belongs and whose operation result was successful from the historical material access log set, and defining the user coverage as the ratio of the number of users in the user set to the total number of subordinate users of the role to which the ternary permission belongs; when a role currently has no subordinate users, the user coverage corresponding to the role is recorded as 0; and a role coverage threshold is preset for each operation type to distinguish between permissions that are common within the role and redundant permissions.

[0008] In a preferred embodiment, a new sub-role is created for users who actually use redundant candidate permissions. Specifically, this includes: for each permission in the redundant candidate permission set, determining the set of users who actually use the permission within the statistical analysis period based on the historical material access log set; creating a new sub-role for users in the original role who belong to the user set; adding a corresponding row for the sub-role in the permission matrix to grant redundant candidate permissions; and simultaneously adding a mapping between the sub-role and the users in the user set in the user-role mapping relationship, thereby simplifying the permission scope of the original role, while the sub-role concentrates on carrying the special permissions that a small number of users truly need.

[0009] In a preferred embodiment, permission conflict detection is based on a set of mutually exclusive permission rules. Specifically, each mutually exclusive rule in the set of mutually exclusive permission rules is used to restrict the same role from having two material operation permissions specified therein at the same time. For any role, all mutually exclusive rules in the set of mutually exclusive permission rules are traversed. When it is detected in the permission matrix that a role has two material operation permissions specified by the mutually exclusive rules at the same time, it is determined that the role has a permission conflict. The role is then adjusted by separating the roles, removing at least one of the two material operation permissions from the original role, creating a new role for the removed material operation permission, and updating the permission matrix and user-role mapping relationship accordingly, thereby realizing the separation of responsibilities based on the set of mutually exclusive permission rules.

[0010] In a preferred embodiment, the calculation of the comprehensive risk index includes: setting a material security level for the material based on its importance, value, and safety requirements; pre-setting an operation risk coefficient for operation types, such that the operation risk coefficient for retrieval operations is greater than that for storage operations; defining a time function based on the power plant's working and non-working time periods to distinguish the risk differences of material access requests initiated at different times; obtaining a role risk coefficient by calculating the ratio of the number of permissions a role has on high-security-level materials to the total number of permissions for the corresponding role based on the optimized permission matrix; for users initiating material access requests, the user risk coefficient is the maximum value of the role risk coefficients currently held by the user; and obtaining the comprehensive risk index by weighted summation of the material security level, operation risk coefficient, time function value, role risk coefficient, and user risk coefficient according to a pre-set linear combination formula.

[0011] In a preferred embodiment, the number of authentication steps is determined by comparing the comprehensive risk index with a preset risk threshold. Specifically, multiple risk thresholds are preset in the parameters of the power plant material storage and retrieval authentication system, dividing the comprehensive risk index into at least three risk level ranges. When the comprehensive risk index falls into the lowest risk range, the number of authentication steps is set to 1, and only single-factor authentication is configured. When the comprehensive risk index falls into the middle risk range, the number of authentication steps is set to 2, and two-factor authentication with two different combinations of credentials is configured. When the comprehensive risk index falls into the highest risk range, the number of authentication steps is set to greater than or equal to 3, and a manual confirmation step by a superior with approval authority is added on the basis of multi-factor authentication.

[0012] In a preferred embodiment, multi-factor authentication includes one or more combinations of the following authentication methods: access card authentication, account password authentication, fingerprint recognition authentication, facial recognition authentication, one-time dynamic password authentication, and SMS verification code authentication; The combination of authentication methods is configured through parameters of the power plant material storage and retrieval authentication system: When configuring single-factor authentication, select any single authentication method from the available authentication options; When using two-factor authentication, two different authentication methods are selected to form a two-factor authentication process. When the comprehensive risk index falls into the highest risk range, a manual confirmation step by a superior with approval authority should be added, based on at least two different authentication methods.

[0013] The power plant material storage and retrieval authentication system based on dynamic permission configuration includes the following modules: The permission element initialization module is used to obtain user sets, role sets, resource sets, and operation sets, and to establish initial user-role mapping relationships, initial permission matrices, historical resource access log sets, and mutual exclusion permission rule sets. The permission optimization module is used to calculate operation counts and user coverage, filter redundant candidate permissions, create new subdivided roles, detect and handle permission conflicts, and generate optimized role sets, permission matrices, and user-role mapping relationships. The policy generation module is used to receive material access requests, perform basic authorization verification, calculate comprehensive risk indicators, determine the number of authentication steps based on risk thresholds, and generate access control policies. The authentication execution module is used to perform multi-factor authentication according to access control policies, control the operation of material storage and retrieval equipment, generate operation logs and update the historical material storage and retrieval log set, preset alarm rules and trigger abnormal alarms.

[0014] The technical effects and advantages of this invention's power plant material access control method and authentication system based on dynamic permission configuration are as follows: By analyzing historical operation logs, this invention automatically identifies and reclaims redundant permissions, and creates detailed roles for users who actually need them. This transforms the coarse, static permission configuration into a dynamic and refined management model based on actual usage data, fundamentally solving the problem of permission redundancy and adhering to the principle of permission minimization. By comprehensively evaluating multi-dimensional risk factors such as materials, operations, time, and user behavior, it dynamically determines authentication steps and strength, achieving a shift from a one-size-fits-all authentication to risk-adaptive authentication. This ensures the safety requirements of high-risk operations while avoiding unnecessary authentication burdens in low-risk scenarios, achieving a good balance between safety and efficiency. Based on a predefined set of mutually exclusive permission rules, the system can automatically detect and execute role separation, effectively avoiding internal security risks caused by the failure to separate responsibilities and improving the system's internal control level. The execution results of the entire control process will be recorded as new logs and fed back to the permission optimization stage, enabling the system to continuously iterate and optimize permission configuration based on the latest behavioral data, forming a self-improving closed-loop management system, which significantly improves the system's adaptability and long-term security. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the power plant material access control method based on dynamic permission configuration according to the present invention; Figure 2 This is a schematic diagram of the power plant material storage and retrieval authentication system based on dynamic permission configuration according to the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example Please see Figure 1 As shown, this invention discloses a power plant material access control method based on dynamic permission configuration, including the following steps: Step S1: Obtain the user set, role set, material set, and operation set from the power plant material access authentication system, and establish a user-role mapping relationship; generate an initial permission matrix based on roles, materials, and operation types to represent the authorization status of roles for performing operation types on materials; simultaneously export historical material access logs from the power plant material access authentication system to form a historical material access log set, providing a data foundation for subsequent permission statistical analysis and dynamic optimization; In step S1, this method first obtains the user set, role set, material set, and operation set from the power plant material access authentication system. These sets are collectively referred to as the permission element set, and the permission element set is initialized. This step is fundamental to the entire dynamic permission configuration process, and its main purpose is to establish the initial data structure and indicators required for subsequent analysis and strategy generation. Specifically, this includes the following aspects of permission element set initialization: extracting information on all current system users and their respective roles from the historical material access logs of the power plant material access authentication system to form the user set. and character collection Here, the user set Include Each user has a unique identifier, such as an employee ID, and identity attributes, such as department and job title; a set of roles. Include A set of predefined roles is defined, each representing a type of job and its responsibilities. For example, in a power plant materials management scenario, typical roles might include a warehouse manager responsible for material storage and retrieval registration, a maintenance engineer responsible for maintenance work and retrieving spare parts, and an operations supervisor responsible for operation monitoring and possibly having access to some materials. The set of roles is determined by analyzing business processes and job responsibilities. When acquiring user-role information, a mapping relationship between users and roles is simultaneously established. ,and ; It records which roles each user has been granted, for example Indicates user Having a role Permissions; for each user, record which role sets they currently possess. Where i is the role index, representing the role. The index corresponds to a specific role; j is the user index, representing the user. The index corresponds to a specific user; material and permission data acquisition involves obtaining a list of all controlled materials from the power plant's material access authentication system to form a material set. ,in These are the types of materials subject to access control; each type of material... Each item is assigned a unique identifier, such as a material code and attribute information, including material name, category, storage location, and importance level. For each type of material, a security level is assigned based on its importance. Where k is the material index, representing the material The index corresponds to a specific material; for example, it is represented by a value from 1 to 5. The security level can be manually set by factors such as the value and criticality of the material, or determined based on historical accident hazard levels. This security level data will be used for dynamic adjustment of authentication strength in subsequent policy configurations; for example, materials with higher security levels may require stricter access permissions and authentication methods. Based on the three basic data categories of users, roles, and materials, this step further establishes the initial permission configuration state; we define the permission set. This represents the authorized combination of all roles, resources, and operations; since resource access control involves two typical types of operations—deposit and retrieval—it is represented by an operation set. This represents two operation types: storage and retrieval; and 'o' is the operation type index, indicating the operation type and its value in set O, such as storage or retrieval; thus, each permission is formally represented as a ternary permission. This indicates assigning a role. Execute the material Operation Permissions; where for or In power plant material management scenarios, the primary concern is usually the authority to grant or deny access to materials. And the storage of supplies Typically, access is limited to specific management roles; however, if business needs require, permissions can be controlled separately for the two types of operations; based on the obtained permission set... Three-elemental permissions The definition is used to generate a character resource permission matrix as the initial permission matrix. Initial permission matrix The dimension is ;in, For the number of characters, For the quantity of supplies, To determine the number of operation types, enable ternary permissions. Indicates role Awarded the right to use materials Execute operation and With the given permissions, the initial matrix elements... Defined as: ; It indicates that when the role Awarded the right to use materials Execute operation The permissions, i.e. At that time, the initial matrix elements =1; When the role Not possessing resources To execute the permission for operation o, i.e. At that time, the initial matrix elements =0; For example, if the role of warehouse manager Having supplies If the extraction permission is granted, then ; The initial permission matrix is ​​derived from the existing permission configuration strategy and can be manually set according to job responsibilities or inherited from previous system permissions. During the state initialization phase, this matrix is ​​loaded into memory for subsequent analysis. Simultaneously, the system establishes a permission index structure to facilitate querying whether any user possesses specific operation permissions for a particular material. For example, by querying the correspondence between their role set and the permission matrix, a quick determination can be achieved. Furthermore, historical material access logs within a certain time range are collected from the power plant material access authentication system to form a historical material access log set. Historical Material Storage and Retrieval Logs Include Each historical material storage and retrieval operation record contains [number] records. It should include at least the following fields: user, role, resources, operation type, and timestamp; it can be represented as:

[0018] in, It is the operator user. It is their identity and role. It involves the supplies. It is the operation type. It is the time when the operation occurs. This log data reflects the actual material access behavior that occurred in the system over a past period, such as whether the operation was successful or rejected. By preprocessing and cleaning the logs, statistical information such as the actual usage frequency of each resource for each role can be obtained, laying the foundation for further permission optimization analysis. If the system did not have historical log data during initial deployment, then the historical material access log set at this time... This can be an empty set. The system can be configured for a cold start state, for example, by first setting initial permissions according to empirical rules and waiting for sufficient logs to accumulate before performing optimization analysis. In addition, a set of mutually exclusive permission rules should be imported during the initialization phase. This is used to identify which material operation permissions cannot be held by the same role or the same user simultaneously; it sets up a mutual exclusion permission rule set. The elements in can be represented as , indicating supplies Operation with supplies Operation There are conflicts of duty or risks that need to be isolated; for example, the approval and withdrawal operations for financial materials should be handled by different roles. These mutually exclusive rules are usually pre-defined by the company's internal control policies or security regulations, and are read and stored here for future reference. After completing the above data acquisition, the system has established a complete initial state, including the relationships between users, roles, and materials, and the initial permission matrix. Historical usage log This includes configuring relevant analysis thresholds and rules. Through these preparations, Step One provides the raw data foundation and initial permission status for subsequent steps. Before proceeding to Step Two, the acquired data can be checked for integrity and consistency, such as confirming that each user belongs to at least one role and that each permission rule corresponds to a valid role and material code. After verification, the system will carry the above initialization status and proceed to the next step of permission optimization and role splitting analysis. Step S2: Based on the initial permission matrix and the historical material access log set, for each role, each material, and each operation type, count the operation count within the preset analysis period and calculate the corresponding user coverage. Permissions with operation counts below the permission usage frequency threshold and user coverage below the role coverage threshold are marked as redundant candidate permissions, forming a redundant candidate permission set. The permissions in the redundant candidate permission set are processed, and the matrix elements corresponding to the redundant candidate permissions in the initial permission matrix are cleared. Users actually using the redundant candidate permissions are identified based on the historical material access log set, and new sub-roles are created for these users. Sub-roles and their permission configurations are added to the permission matrix and user-role mapping relationship. Permission conflict detection is performed on sub-roles and existing roles based on the mutual exclusion permission rule set. Role separation processing is performed on roles that simultaneously contain mutual exclusion permissions, ultimately obtaining the optimized role set, permission matrix, and user-role mapping relationship. Based on the initial data and status obtained in step S1, the system first performs statistical analysis during the period. Within, select timestamps that satisfy... Log entries are included in this period's statistics, for each role. and every supply The operation count is defined as the number of times the character successfully performs this operation on the resource within this cycle. , indicating role For supplies Execution Operation Type The number of successful operations; that is, maintaining an independent frequency count for each operation type: when hour, Indicates role Successfully executed the delivery of supplies Number of storage operations; when hour, Indicates role Successfully executed the delivery of supplies Number of extraction operations; Based on the above definition of operation counts, the frequency matrix X is obtained by summarizing the operation counts along the operation type dimension. The ; indicates the frequency with which the triple is used during the permission process; For example, if , indicating role Materials within the statistical period 15 extraction operations were successfully executed; and This indicates the role. Never successfully retrieved supplies ; To determine whether a particular permission is unnecessary for most users within a role, this step further calculates permission coverage from a user perspective. For any character Step S1 has given its subordinate user set, denoted as ;in, For user-role mapping during initialization, For the role The number of users included; based on the historical resource access log set L, for any ternary permission that exists in the initial permission matrix. That is, the initial matrix elements =1, defines the set of users who have actually used this permission within the statistical period. ; User set Each user in the system is assigned a role within the statistical period. Identity of supplies The operation 'o' was executed successfully, therefore the permission was indeed used; set cardinality. This reflects the scope of users within the role who can use this permission; based on this, this embodiment defines the permission. User coverage The semicolon indicates that when a role currently has no users, the coverage rate is recorded as 0 by default. Roles of this type can be reassessed later to determine whether to retain them. Normally, user coverage is... The smaller the value, the lower the proportion of users using that permission within the role; Define a permission usage frequency threshold for each operation type o. and role coverage threshold Among them, the frequency threshold for permission usage. Used to distinguish between high-frequency and low-frequency permissions, for example, based on non-zero values ​​in historical statistics. The mean or median is multiplied by a fixed coefficient, or, as specified by the system administrator, less than two uses within a quarter are considered low frequency. Role coverage threshold This threshold is used to reflect the prevalence of permissions within a role. For example, it can be set to 0.2, meaning that if the proportion of users actually using a certain permission within a role is less than 20%, then it is redundant for most members of that role. The above threshold is configured in the system parameter table, and once set, it directly participates in the comparison calculation according to the numerical value in the actual implementation. After clarifying the operation count Coverage and threshold , Next, this step provides a strict definition of the set of redundant candidate permissions from a global perspective; specifically, if a certain ternary permission... All three of the following conditions must be met: The permission does indeed exist in the initial permission matrix, that is... ; During the current analysis period, the number of successful operations for this permission is lower than the frequency threshold for the corresponding operation type. ; User coverage within the role is below the coverage threshold, i.e. ; In this embodiment, the permission is determined to be a redundant candidate permission; therefore, the set of redundant candidate permissions can be defined as follows: ; Redundant candidate permission set The elements in this set are permission items that are rarely accessed and used by only a few users within a complete analysis cycle; they are only included in this set if both the quantitative conditions of low frequency and low coverage are met simultaneously. After obtaining the set of redundant candidate permissions, for each potentially redundant ternary permission selected... The process involves splitting roles, which means separating these permissions from the original roles and creating more granular roles for management. The specific process for role splitting is as follows: In the role In the permission matrix, set the item corresponding to that permission to 0, that is, set the optimized... express No longer possessing resources Execute operation The permissions were reduced, eliminating redundant permissions and ensuring that ordinary holders of the role could no longer access resources they did not previously need. To preserve support for users who genuinely need this permission, the system determines the appropriate permissions based on the set. Create new sub-roles Specifically for authorized materials Operation This new role contains only a very few precisely defined permissions; generally, it may only include... This permission, or in certain situations, can group several material permissions belonging to the same professional field and used infrequently into a new role to simplify management; add a row for the new role in the permission matrix and set... For all Add mapping pairs to the user-role mapping relationship. This allows these users to retain the permissions by adding new sub-roles; after this process, the original roles... The scope of permissions is streamlined, while specific roles are concentrated to carry the special permissions that a small number of users truly need, achieving a structure where common permissions remain in the original roles and personalized permissions are migrated to specific roles; Furthermore, to ensure that there are no permission combinations within a role that violate the mutual exclusion rule set, this step also uses the mutual exclusion permission rule set initialized in step S1 to perform conflict detection on the optimized permission matrix; each rule in the mutual exclusion rule set can be represented as... The meaning is for materials Execute operation With regard to supplies Execute operation It should not be owned by the same character at the same time; for any character This step iterates through all mutual exclusion rules. If there exists a rule such that:

[0019] Then consider the role There is an internal permission conflict; For this type of conflicting permission pair, this embodiment uses a role-separation approach for adjustment: selecting one of the permissions, typically the one used less frequently or with higher risk, from the role... Remove from the middle, set the corresponding matrix element to zero, and create a conflict separation role for this permission. At the same time, the few users who actually need the permission are mapped to the new role; after this process, the original role retains only the other permission in the mutual exclusion pair, and the new role carries the removed permission. Combined with the management system, it can be further stipulated that a single user cannot be granted both roles at the same time, thus achieving separation of duties from both the role and user levels. Through the quantitative analysis and structural adjustments based on operation frequency, user coverage, and mutual exclusion rules, step S2 ultimately forms the optimized role set. Updated permission matrix The corresponding set of permissions And user-role mapping relationship ;in This will include existing roles that may have had some permissions removed, as well as several newly created, more detailed roles; This includes newly added user and role associations, and the potential removal of permission associations between some users and their original roles; permission sets. The system will then update accordingly to all currently valid role-material-operation authorization combinations. At the end of this step, these optimizations and adjustments are still in the strategy phase, meaning the updates are reflected in the system's permission configuration data model but have not yet been applied to the actual material access control execution level.

[0020] Step S3: The power plant material access authentication system receives material access requests from warehouse access control terminals or tool cabinet control terminals. Based on the optimized user-role mapping relationship and permission matrix, it performs basic authorization verification on the user, role, material, and operation type involved in the request. For material access requests that pass the basic authorization verification, it calculates a comprehensive risk index by comprehensively considering the material security level, operation type, time factor, and user and role risk information. Based on the comparison result between the comprehensive risk index and the preset risk threshold, it determines the number of authentication steps corresponding to the material access request. After completing redundant permission reduction and role splitting in step S2, the system has obtained an optimized set of roles. Permission matrix Permission sets And user-role mapping relationship The purpose of step S3 is to generate explicit access control policies and authentication configuration parameters for each real-time material access request based on the above dynamic permission configuration, so that the power plant material access authentication system can perform unified and traceable authentication processing accordingly. When a field terminal or a higher-level system initiates a material storage or retrieval operation, the system first abstracts the operation into a request quadruple. ,in The identifier of the user who initiated the request; For target materials; This is an operation type, belonging to the operation type, and belongs to O; For request time; based on user-role mapping relationship The user who initiated the request was obtained. Current set of characters Then in the permission matrix In the middle, check if a certain role exists. Authorization is granted for the target materials and operations, i.e., determining whether the existence condition is met. ;Yes ; If the above conditions are not met, it is assumed that the user does not have basic access permissions under the current dynamic permission configuration, and an access denial policy is directly generated, without further risk assessment or authentication configuration. If the conditions are met, the request is recorded as having passed the basic authorization verification and proceeds to the risk analysis stage; For requests that pass the basic authorization verification, in order to achieve strength authentication adaptation for different requests, this embodiment combines the material security level in step S1. Introducing operational risk coefficients and time factors: for operational types Preset operational risk coefficient For example, the coefficient of the OUT operation is greater than the coefficient of the IN operation; define the time function: The working time period is configured by the power plant management in the system parameters. To reflect the sensitivity of the role itself, the permission matrix based on step S2 is used. Calculate the role risk coefficient Statistical role For high-security materials, that is, meeting , Number of permissions for high security level threshold and roles Total number of permissions ;like ,but ;otherwise ; The larger the value, the higher the percentage of high-security-level resource permissions held by the character, and the greater the risk. For the user who initiated the request Its user risk coefficient Take its character set The maximum value of the risk coefficient of the middle role, that is ; Based on the above parameters, this request The comprehensive risk index is ;in The weighting factor is configured by the system administrator according to the security policy. For example, it can be... Set it to be relatively large to highlight the importance of material grade and operation type, and... Set to a medium level, this is used to adjust the final risk value; through this linear combination formula, a unique quantitative risk value is given for each request. ; To translate risk indicators into specific certification requirements, this embodiment pre-sets three sets of risk thresholds in the system parameters. According to risk indicators The range in which the request is located determines the number of authentication steps required for this request. Based on this, the corresponding combination of authentication methods will be selected; the specific rules are as follows: ;in, This refers to the number of authentication steps configured in the system for the highest risk range, and ; when At times, the system only requires users to complete single-factor authentication, such as using an access card or account password; when At times, the system requires two different combinations of credentials, such as access card + facial recognition; when When this happens, the system adds a one-time dynamic password or SMS verification code to the first two methods; when In addition to multi-factor authentication, a superior with approval authority is required to manually confirm the transaction on the terminal. Only after approval can the physical inbound / outbound operations continue. In one specific configuration of this embodiment, The value is 4; While determining the number of authentication steps, the system will also consider the security level of the materials. and operation type Specific authentication methods are tied to each step; for example, the OUT operation for high-level critical spare parts, even if the risk value is only slightly higher than the threshold, can be performed using specific authentication methods. Alternatively, the third step can be configured to be fixed as approver confirmation to meet stricter management requirements. All these mapping relationships are configured through parameter tables and rule tables, facilitating later adjustments; Based on the basic authorization result, risk indicators, and number of authentication steps, an access control policy record is generated for request q. This record should include at least: request identifier, target material and operation, whether basic authorization was passed, calculated risk value S(q), and number of authentication steps. The record will be passed to the authentication execution and log update unit in step S4. This unit will perform authentication, control door locks or storage devices according to policy requirements, and write the final execution result back to the log to provide a data source for subsequent periodic permission optimization.

[0021] Step S4: Based on the number of authentication steps determined in Step S3, execute the corresponding number of multi-factor authentication steps sequentially. Authentication methods include one or more combinations of access card authentication, account password authentication, biometric recognition authentication, one-time dynamic password authentication, and SMS verification code authentication. When all authentication steps are successfully completed, a control command is sent to the material storage and retrieval equipment to drive the equipment to perform the corresponding material storage and retrieval operation. After the operation is completed, an operation log is generated and written to the historical material storage and retrieval log set for subsequent statistical analysis and permission optimization iteration. When on-site terminals, such as warehouse access control terminals and tool cabinet control terminals, are collectively referred to as material storage and retrieval devices, and a user-initiated material storage and retrieval operation is detected, the request four-tuple is first obtained. and the corresponding access control policy record in step S3; this record shall include at least: the basic authorization judgment result, i.e., whether the role permissions are available, the comprehensive risk index S(q), and the number of authentication steps. And the corresponding authentication method configuration for each step; If the policy log indicates that basic authorization failed, the system will not perform any authentication actions, will directly return a permission denied result to the front end, and will issue a denial prompt to the user interface or audio-visual device, such as a buzzer alarm or a message indicating insufficient permissions; such events still need to be logged for auditing and subsequent analysis. If the basic authorization result is successful, the system will proceed according to the number of authentication steps given in the policy record. And the corresponding authentication method, execute each authentication step in sequence; for example, when The authentication process can proceed as follows: First, swipe the employee card or enter the account password to confirm the user's identity; second, collect and compare fingerprint or facial features; third, require the user to enter a one-time dynamic password or SMS verification code. The authentication module returns a success or failure flag after each step. If any step fails, the system immediately terminates the subsequent authentication process, deems the authentication request unsuccessful, and marks the reason for failure as "step n authentication failed"; at this time, no physical control commands will be issued, and relevant information will be recorded in the log; Once all authentication steps have returned success, the system translates the permitted execution instructions in the policy record into specific device control commands; for example, for an OUT operation, the system sends an unlock signal to the electronic lock or automatic cabinet of the corresponding storage location, allowing retrieval; for an IN operation, it sends an unlock signal, allowing insertion. Simultaneously, the system triggers the inventory management subsystem to update the quantity and status of materials; to ensure the accuracy of material objects, the execution process can also require scanning of material barcodes or RFID tags, comparing the scan results with the target materials in the request. If the materials do not match, the operation will be stopped and recorded as a material verification failure. After execution, the system sends a success or failure message to the front end, marking the end of the authentication and execution process and entering the logging phase. Regardless of whether the material storage and retrieval operation is ultimately successful or not, this embodiment requires generating log entries in a uniform format and appending them to the historical material storage and retrieval log set L; to maintain consistency with the log model in step S1, the newly generated log record in this step can be represented as follows: ;in For the user who initiated the request; To be used in basic authorization judgment to match specific roles for permissions, and when a user has multiple roles, a role that meets the following criteria can be selected. One of the roles; , S(q), These are the requested materials, operation type, overall risk value, and number of certification steps, respectively. and These represent the start and end times of the authentication process, respectively. This indicates the final result of this operation, and possible values ​​include success, basic authorization denied, authentication failed, approval denied, and material verification failed. Used to identify the detailed reasons for failure, such as lack of corresponding role permissions, failure of the second step fingerprint comparison, rejection by approver X, etc. Record the newly generated logs Add it to the historical resource access log set, that is, update it to L:=L ; While writing logs, the system can perform simple real-time rule checks on recent logs to detect abnormal behavior and trigger alarms. To this end, alarm time window length and failure thresholds can be preset in the system parameters. For example, an alarm can be triggered if the same user fails to authenticate 3 times within 5 minutes. After a new log is written, the system counts the number of failure records for the same user within a time window. If the number exceeds the threshold, a security alarm event is generated and the on-duty personnel can be notified via SMS, email, or the operations and maintenance platform. This type of judgment is based entirely on a clearly defined time window and counting threshold, and does not involve any fuzzy judgment.

[0022] Please see Figure 2 As shown, this invention discloses a power plant material access authentication system based on dynamic permission configuration, including the following modules: The permission element initialization module is used to obtain user sets, role sets, resource sets, and operation sets, and to establish initial user-role mapping relationships, initial permission matrices, historical resource access log sets, and mutual exclusion permission rule sets. The permission optimization module is used to calculate operation counts and user coverage, filter redundant candidate permissions, create new subdivided roles, detect and handle permission conflicts, and generate optimized role sets, permission matrices, and user-role mapping relationships. The policy generation module is used to receive material access requests, perform basic authorization verification, calculate comprehensive risk indicators, determine the number of authentication steps based on risk thresholds, and generate access control policies. The authentication execution module is used to perform multi-factor authentication according to access control policies, control the operation of material storage and retrieval equipment, generate operation logs and update the historical material storage and retrieval log set, preset alarm rules and trigger abnormal alarms.

[0023] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0024] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0025] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and inventive constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0026] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0027] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0028] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A power plant material access control method based on dynamic permission configuration, characterized in that, Includes the following steps: In the power plant material storage and retrieval authentication system, obtain user sets, role sets, material sets, and operation sets, establish user-role mapping relationships, and generate an initial permission matrix and a historical material storage and retrieval log set according to role, material, and operation type; Based on the obtained initial permission matrix and historical resource access log set, for each role, resource, and operation type, the operation count and user coverage are calculated. Permissions with operation counts lower than the permission usage frequency threshold and user coverage lower than the role coverage threshold are marked as redundant candidate permissions, thus obtaining a set of redundant candidate permissions. The process involves clearing the matrix elements corresponding to redundant candidate permissions in the initial permission matrix and creating new sub-roles for users who actually use the redundant candidate permissions. Permission conflicts in the newly created sub-roles are detected based on the mutual exclusion permission rule set, and conflicting permissions are separated into roles. This generates an optimized role set, permission matrix, and user-role mapping relationship. Upon receiving a request for access to supplies, basic authorization verification is performed based on the optimized user-role mapping and permission matrix; if authorization is successful, a comprehensive risk index is calculated; and the number of authentication steps is determined by comparing the comprehensive risk index with a preset risk threshold. Multi-factor authentication is performed sequentially based on the number of authentication steps; if all authentication steps are successful, the material storage and retrieval equipment is controlled to perform operations; operation logs are generated and the historical operation and historical material storage and retrieval log sets are updated.

2. The power plant material access control method based on dynamic permission configuration according to claim 1, characterized in that, After obtaining the user set, role set, resource set, and operation set, the process further includes: establishing a role-resource-permission matrix as an initial permission matrix based on roles, resources, and operation types. The initial permission matrix sets matrix elements with the number of roles, resources, and operation types as dimensions. When a role is granted permission to perform a certain operation type on a resource, the corresponding matrix element is set to 1; otherwise, it is set to 0. A historical material access log set is formed by collecting historical material access logs within a certain time range from the power plant material access authentication system. Each historical operation record in the historical material access log set includes at least the user, role, material, operation type, timestamp, and operation result fields. Each material has its pre-assigned security level, and the operation type corresponds to storage and retrieval operations. It also includes importing mutually exclusive permission rule sets, where elements represent conflicting combinations of material operation permissions that need to be isolated.

3. The power plant material access control method based on dynamic permission configuration according to claim 1, characterized in that, The operation count is calculated as follows: Within a preset statistical analysis period, log entries whose timestamps fall within the statistical analysis period and whose operation results are successful are selected from the historical material access log set. The log entries are categorized and accumulated according to role, material, and operation type to obtain the operation count of each role performing each operation type on each material. The operation count is then used as matrix elements to form a frequency matrix, which is used to characterize the frequency of use of each ternary permission within the statistical analysis period. In addition, a permission usage frequency threshold is preset for each operation type to distinguish between high-frequency and low-frequency permissions.

4. The power plant material access control method based on dynamic permission configuration according to claim 1, characterized in that, The calculation of user coverage includes: determining the set of subordinate users and the number of users for each role based on the user-role mapping relationship; for each ternary permission in the initial permission matrix, within the statistical analysis period, counting the set of users who performed the corresponding operation type on the corresponding material with the identity of the role to which the ternary permission belongs and whose operation result was successful from the historical material storage and retrieval log set, the user coverage is defined as the ratio of the number of users in the user set to the total number of subordinate users of the role to which the ternary permission belongs; when a role currently has no subordinate users, the user coverage corresponding to the role is recorded as 0; and a role coverage threshold is preset for each operation type to distinguish between permissions that are common within the role and redundant permissions.

5. The power plant material access control method based on dynamic permission configuration according to claim 1, characterized in that, To create new sub-roles for users who actually use redundant candidate permissions, the process includes: for each permission in the redundant candidate permission set, determining the set of users who actually use the permission within the statistical analysis period based on the historical material access log set; creating new sub-roles for users in the original roles who belong to the user set; adding corresponding rows for the sub-roles in the permission matrix to grant redundant candidate permissions; and simultaneously adding mappings between users in the user set and sub-roles in the user-role mapping relationship, thereby simplifying the permission scope of the original roles and allowing the sub-roles to centrally carry the special permissions that a small number of users truly need.

6. The power plant material access control method based on dynamic permission configuration according to claim 1, characterized in that, The method for detecting permission conflicts based on a set of mutually exclusive permission rules is as follows: Each mutually exclusive rule in the set of mutually exclusive permission rules is used to restrict the same role from having two material operation permissions specified therein at the same time. For any role, all mutually exclusive rules in the set of mutually exclusive permission rules are traversed. When it is detected in the permission matrix that the role has two material operation permissions specified by the mutually exclusive rules at the same time, it is determined that the role has a permission conflict. The role is then adjusted by separating the roles, removing at least one of the two material operation permissions from the original role, creating a new role for the removed material operation permission, and updating the permission matrix and user-role mapping relationship accordingly, thereby realizing the separation of responsibilities based on the set of mutually exclusive permission rules.

7. The power plant material access control method based on dynamic permission configuration according to claim 1, characterized in that, The calculation of the comprehensive risk index includes: setting a material security level for materials based on their importance, value, and safety requirements; pre-setting an operation risk coefficient for operation types, ensuring that the operation risk coefficient for retrieval operations is greater than that for storage operations; defining a time function based on the power plant's working and non-working time periods to differentiate the risk differences of material access requests initiated at different times; obtaining a role risk coefficient by calculating the ratio of the number of permissions a role has on high-security-level materials to the total number of permissions for that role based on the optimized permission matrix; for users initiating material access requests, the user risk coefficient is the maximum value of the role risk coefficients currently held by the user; and finally, the comprehensive risk index is obtained by weighted summation of the material security level, operation risk coefficient, time function value, role risk coefficient, and user risk coefficient according to a pre-set linear combination formula.

8. The power plant material access control method based on dynamic permission configuration according to claim 1, characterized in that, The number of authentication steps is determined by comparing the comprehensive risk index with the preset risk threshold. Specifically, multiple risk thresholds are preset in the parameters of the power plant material storage and retrieval authentication system, dividing the comprehensive risk index into at least three risk level ranges. When the comprehensive risk index falls into the lowest risk range, the number of authentication steps is set to 1, and only single-factor authentication is configured. When the comprehensive risk index falls into the middle risk range, the number of authentication steps is set to 2, and two-factor authentication with two different combinations of vouchers is configured. When the comprehensive risk index falls into the highest risk range, the number of authentication steps is set to greater than or equal to 3, and a manual confirmation step by a superior with approval authority is added on the basis of multi-factor authentication.

9. The power plant material access control method based on dynamic permission configuration according to claim 8, characterized in that, Multi-factor authentication includes one or more combinations of the following authentication methods: access card authentication, account password authentication, fingerprint recognition authentication, facial recognition authentication, one-time dynamic password authentication, and SMS verification code authentication; The combination of authentication methods is configured through parameters of the power plant material storage and retrieval authentication system: When configuring single-factor authentication, select any single authentication method from the available authentication options; When using two-factor authentication, two different authentication methods are selected to form a two-factor authentication process. When the comprehensive risk index falls into the highest risk range, a manual confirmation step by a superior with approval authority should be added, based on at least two different authentication methods.

10. A power plant material access authentication system based on dynamic permission configuration, used to implement the power plant material access control method based on dynamic permission configuration as described in any one of claims 1-9, characterized in that, Includes the following modules: The permission element initialization module is used to obtain user sets, role sets, resource sets, and operation sets, and to establish initial user-role mapping relationships, initial permission matrices, historical resource access log sets, and mutual exclusion permission rule sets. The permission optimization module is used to calculate operation counts and user coverage, filter redundant candidate permissions, create new subdivided roles, detect and handle permission conflicts, and generate optimized role sets, permission matrices, and user-role mapping relationships. The policy generation module is used to receive material access requests, perform basic authorization verification, calculate comprehensive risk indicators, determine the number of authentication steps based on risk thresholds, and generate access control policies. The authentication execution module is used to perform multi-factor authentication according to access control policies, control the operation of material storage and retrieval equipment, generate operation logs and update the historical material storage and retrieval log set, preset alarm rules and trigger abnormal alarms.

Images