Fine-grained dynamic permission distribution method and system based on artificial intelligence
By adopting a fine-grained dynamic permission distribution method based on artificial intelligence, the problems of coarse permission granularity, poor dynamic adaptability and insufficient automation in the existing permission management are solved, and precise and secure permission management is achieved, improving operation and maintenance efficiency and security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZHEJIANG WUXINSHUKE INFORMATION IND CO LTD
- Filing Date
- 2026-03-06
- Publication Date
- 2026-05-15
AI Technical Summary
Existing access control solutions suffer from problems such as coarse-grained permissions, poor dynamic adaptability, lack of automated authorization and revoke mechanisms, and unintuitive permission descriptions, resulting in low access control efficiency and security risks.
We adopt an AI-based fine-grained dynamic permission distribution method, which achieves precise matching and management of permissions through fine-grained permission definition, natural language description, work order task semantic parsing, automatic authorization and revocation.
It achieves a closed loop of end-to-end dynamic permission distribution, improves operation and maintenance and approval efficiency, enhances the understandability and security of permissions, reduces management costs, and conforms to the principle of least privilege and the zero-trust security concept.
Smart Images
Figure CN121808818B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information system security, and in particular to a fine-grained dynamic permission distribution method and system based on artificial intelligence. Background Technology
[0002] In existing technologies, access control primarily employs schemes such as Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). RBAC manages access by pre-defining roles, associating permissions with roles, and then assigning roles to users. For example, in an operations and maintenance management system, roles such as "Platform Administrator" and "Regular User" are set up, with each role assigned fixed operational permissions and data access scopes. Users obtain corresponding permissions by acquiring the corresponding role. ABAC, on the other hand, dynamically determines permissions based on attributes such as subject, object, and environment. For instance, users may have access to certain specific data depending on their operating terminal.
[0003] Disadvantages of existing technology:
[0004] Coarse-grained permissions: Existing solutions often assign permissions based on roles or coarse-grained sets of attributes, making it difficult to achieve precise control over specific data items and fine-grained operations, which can easily lead to excessive or insufficient permissions.
[0005] Poor dynamic adaptability: Permission allocation is mostly static or semi-static. When processing temporary work orders, manual intervention is required to adjust permissions. It cannot automatically match the required permissions based on events, resulting in low response efficiency.
[0006] Lack of automated authorization and revoke mechanisms: The process of applying for, granting, and revoking permissions relies on manual operation, which not only increases management costs, but may also lead to security risks due to human negligence that permissions are not revoked in a timely manner.
[0007] Permission descriptions are not intuitive: Permission definitions often use code or identifiers, which are difficult for non-technical personnel to understand and are not conducive to permission review and management.
[0008] In summary, a fine-grained dynamic permission distribution method and system based on artificial intelligence is needed to address the shortcomings of existing technologies. Summary of the Invention
[0009] To address the shortcomings of existing technologies, this invention provides a fine-grained dynamic permission distribution method and system based on artificial intelligence, aiming to solve the aforementioned problems.
[0010] To achieve the above objectives, the present invention provides the following technical solution: a fine-grained dynamic permission distribution method based on artificial intelligence, comprising the following steps:
[0011] Step S1: Define permissions in a fine-grained manner. Based on the fine-grained permissions, generate corresponding natural language descriptions through a rule engine combined with a natural language processing model, and store them in the permission description library.
[0012] Step S2: Receive the work order task, use a natural language understanding model to perform semantic parsing on the text content of the work order task, identify the data objects to be accessed and the target operation, and obtain the parsing result;
[0013] Step S3: Based on the parsing results, automatically match the corresponding fine-grained permissions in the preset permission library and generate a permission request;
[0014] Step S4: Process the permission request according to the preset authorization policy: if it is a low-risk permission, it is automatically authorized; if it is a high-risk permission, a manual approval process is triggered, and the authorization is completed after the approval is passed.
[0015] Step S5: After authorization is completed, issue permission credentials to the user or system component executing the work order task, and record the permission effective time and validity period;
[0016] Step S6: Automatically revoke the issued permissions when the permission validity period expires or the work order task is completed.
[0017] Optionally, the fine-grained permissions in step S1 include data permissions and operation permissions.
[0018] Data permissions can be defined through a visual configuration interface, supporting permission settings for database tables, specific data rows, columns, or specific data items;
[0019] Data permissions include at least item-level, row-level, or column-level data ranges, and the operation permissions include at least one of viewing, adding, modifying, deleting, or exporting.
[0020] Optionally, step S1 is implemented in the following manner:
[0021] Step A1: Define fine-grained permissions, defining data permissions to control the scope of accessible data and operation permissions to control the actions that can be performed, generating a structured permission object;
[0022] Step A2: Natural language description generation. The rule engine loads the preset business semantic mapping rule library, converts the technical fields into business language, matches the preset natural language template according to the permission type, and optimizes the preliminary description input into the fine-tuned NLP model.
[0023] Step A3: Store in the permission description library. Package the unique permission identifier, structured permission definition, and natural language description text into a permission description record, write it into the permission description library, create a unique index for the unique permission identifier, and establish data association with the permission definition module, AI matching module, and authorization module.
[0024] Optionally, step S2 is implemented in the following manner:
[0025] Step B1: Work order reception and preprocessing. Work order tasks are received from the alarm center of the operation and maintenance platform, work order dispatch, and internal approval process channels through standardized interfaces. The original work orders are cleaned and standardized.
[0026] Step B2: Semantic parsing using a natural language understanding model. This model is pre-trained on a general corpus and fine-tuned on historical work order data from enterprises. It categorizes work orders into preset intent categories, extracts structured parameters from the text, and obtains the parsing results.
[0027] Optionally, step S3 is implemented in the following manner:
[0028] Step C1: Design the permission library structure, pre-build and maintain a fine-grained permission library, and establish a multi-dimensional index;
[0029] Step C2: Execute the permission matching logic, receive the structured work order semantic results, and use a multi-dimensional fine-grained permission matching algorithm to filter all permission items in the permission library;
[0030] Step C3: Generate a permission request object. Combine the matched permission items with the current work order context to generate a standardized permission request object. If the permission template contains placeholders, inject the specific values from the parsing results to form a concrete permission.
[0031] Optionally, step S4 is implemented in the following manner:
[0032] Step D1: Receive permission requests and risk level identification. Receive structured permission requests from the AI permission matching module and load the configured authorization policy rule base. The policies are stored in JSON or rule engine format.
[0033] Step D2: Authorization processing. If the permission is determined to be low-risk, a unique authorization credential is generated, bound to the user's relevant information, the authorization status is marked as automatically approved, the permission issuance module is called, and the credential is pushed to the user or service account that executed the work order.
[0034] If a permission is deemed high-risk, an approval task will be automatically generated and pushed to a pre-set approver for manual approval.
[0035] Optionally, step S5 is implemented in the following manner:
[0036] Step E1: Permission credential generation. After the permission authorization module completes the authorization, the permission issuance and management module generates a structured permission credential and dynamically sets the validity period of the permission according to the preset strategy or work order context.
[0037] Step E2: Issuance of authorization credentials. The system identifies the executing entity of the work order task and issues the credentials using a secure issuance mechanism. The authorization takes effect immediately. When the executing entity subsequently accesses controlled resources, the authorization verification module will perform real-time authentication based on the credentials and record the authorization's effective time and validity period.
[0038] Optionally, the revocation of granted permissions in step S6 includes automatic revocation based on time and proactive revocation based on events:
[0039] Time-based automatic eviction: Each permission credential contains a specific time field when it is issued. The permission eviction module starts a background timed scanning task to traverse all permission credentials. If the current system time is equal to or exceeds the set time, the permission is marked as pending eviction.
[0040] Event-based proactive recycling: The system monitors the time when the status of a work order changes. When it receives a work order status that is "completed", it queries all active permission credentials associated with the work order and marks these permissions as "task completed" to trigger recycling.
[0041] A fine-grained dynamic permission distribution system based on artificial intelligence, employing the aforementioned fine-grained dynamic permission distribution method based on artificial intelligence, includes a permission definition and description module, a work order semantic parsing module, a permission matching module, an authorization decision module, a permission issuance and management module, and a permission revoke module;
[0042] The permission definition and description module is used to define fine-grained permissions, supporting data range control at the item level, row level, and column level. Permissions are configured through a visual interface. Using a rule engine and a fine-tuned natural language processing model, technical permission definitions are converted into business-readable natural language descriptions. The structured permission objects and natural language descriptions are packaged and stored in the permission description library, and a unique index is established.
[0043] The work order semantic parsing module is used to receive work order tasks dispatched from the alarm center channel of the operation and maintenance platform, clean and standardize the work order data, use a natural language understanding model finely tuned on the enterprise's historical work orders to identify the work order intent, extract the data objects to be accessed and the target operation, and output structured parsing results for subsequent permission matching.
[0044] The permission matching module is used to maintain a pre-built fine-grained permission library, supports multi-dimensional indexing, receives work order parsing results, executes multi-dimensional matching algorithms, selects the most matching permission items from the permission library, generates standardized permission request objects, and injects specific values to form concrete permissions if the permission template contains placeholders.
[0045] The authorization decision module is used to receive permission requests, load the configured authorization policy rule library, determine the permission risk level according to the policy, and automatically generate authorization credentials, mark them as automatic approval, and trigger the issuance if the risk is low. If the risk is high, an approval task is automatically generated, pushed to the preset approver, and authorization is completed after manual approval.
[0046] The permission issuance and management module is used to generate structured permission credentials after authorization is completed, dynamically set the permission validity period, and issue the credentials to the work order execution subject through a security mechanism. The permission takes effect immediately and is verified in real time by the authentication module when accessing resources. The module records the permission effective time and validity period.
[0047] The permission revocation module is used to automatically revoke permissions, ensuring the principle of least privilege, and supports two revocation mechanisms.
[0048] The beneficial effects of this invention are:
[0049] 1. In this invention, the method realizes an end-to-end dynamic permission distribution closed loop: from work order semantic understanding, automatic permission matching, risk-level authorization, voucher issuance and automatic eviction, the entire process does not require manual intervention, which greatly improves the efficiency of operation and maintenance and approval. By automatically parsing work order requirements and matching permissions through AI, it avoids over-authorization or permission loss caused by traditional manual authorization. Permissions are only valid during the execution of the work order and are automatically revoked after the task ends or expires, which complies with the principle of least privilege and the zero-trust security concept.
[0050] 2. In this invention, by finely defining data permissions and operation permissions and generating natural language descriptions for each permission, artificial intelligence is used to automatically and dynamically request corresponding permissions based on events when processing work orders. After authorization, permissions are issued, and usage logs are recorded. Permissions are automatically revoked upon expiration, achieving fine-grained control over permissions and improving the accuracy of permission allocation; enhancing the dynamism and automation of permission allocation for rapid response to work order requirements; improving the understandability of permissions through natural language descriptions for easier review and management; and improving system security and compliance through a comprehensive permission log recording and automatic revocation mechanism, while reducing management costs.
[0051] 3. In this invention, the aforementioned method is solidified into a deployable software system with engineering implementation capabilities. The modular architecture facilitates integration into the existing IT governance system, providing organizations with an intelligent, automated, and compliant dynamic access control solution to improve overall security performance. Attached Figure Description
[0052] Figure 1 This is a schematic diagram of a method flow of the present invention.
[0053] Figure 2 This is a schematic diagram of step S1 of the present invention.
[0054] Figure 3 This is a schematic diagram of step S2 of the present invention.
[0055] Figure 4 This is a schematic diagram of step S3 of the present invention.
[0056] Figure 5 This is a schematic diagram of step S4 of the present invention.
[0057] Figure 6 This is a schematic diagram of step S5 of the present invention.
[0058] Figure 7 This is a schematic diagram of a system structure according to the present invention. Detailed Implementation
[0059] To more clearly illustrate the technical solutions in the embodiments of the invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0060] like Figures 1 to 6 As shown, a fine-grained dynamic permission distribution method based on artificial intelligence includes the following:
[0061] Step S1: Define permissions in a fine-grained manner. Based on the fine-grained permissions, generate corresponding natural language descriptions through a rule engine combined with a natural language processing model, and store them in the permission description library.
[0062] Data permissions are divided into the following levels based on access granularity, and can be used in combination:
[0063] Table-level permissions: Allow access to a specific database table (such as the user_info table);
[0064] Row-level permissions: restrict access to specific data rows, usually filtered by primary key or business field (e.g., user_id='10000001').
[0065] Column-level permissions: restrict access to specific fields (e.g., only allow viewing of "phone");
[0066] Item-level permissions: These are permissions for a single data item (i.e., a specific value in a row or column), such as "the contact number for user ID 10000001".
[0067] Operation permissions are specified down to specific actions, including but not limited to: Read, Create, Update, Delete, Export, and Batch Update / Delete.
[0068] Permission configuration method: The system provides a visual permission management interface. Administrators can combine the above data ranges and operation types through drop-down menus, field selectors, and condition builders to generate structured permission objects. These objects are stored in the permission definition library in JSON or internal data structure format.
[0069] Natural Language Description Generation: The system employs a hybrid architecture combining a rule engine and a Natural Language Processing (NLP) model to generate natural language descriptions.
[0070] Rule engine: Preset syntax templates and keyword mapping rules (such as "update → modify", "phone → contact number"); NLP model: Uses a finely tuned BERT or T5 model to semantically refine structured permissions, improving language fluency and readability.
[0071] Generation process:
[0072] Step 1: Receive the structured permission object from the permission definition module;
[0073] Step 2: The rule engine converts field names, operators, etc. into business terms (e.g., phone → "contact phone number", user_id → "user ID").
[0074] Step 3: Fill in the preset template, for example: "Allow the field name of the row condition in the table name for the operation".
[0075] Step 4: Input the initial description into the NLP model for language optimization to generate more natural expressions;
[0076] Step 5: Output a standardized natural language description, store it in the permission description library, and bind it with the original permission ID.
[0077] The permission description library is stored in the form of key-value pairs or relational tables, and includes the following fields: permission_id (unique identifier of permission), structured_definition (structured definition), natural_language_desc (natural language description), and create_time, creator (meta-information).
[0078] Step S2: Receive the work order task, use a natural language understanding model to perform semantic parsing on the text content of the work order task, identify the data objects to be accessed and the target operation, and obtain the parsing result;
[0079] Work order source access: The system receives work order tasks from channels such as the operation and maintenance platform, work order dispatch, and internal approval processes through standardized interfaces (such as REST API, message queue Kafka / RabbitMQ, or enterprise work order system Webhook). Example work order text: "The XX repair work order has been returned to the network management center. Please arrange for other operation and maintenance personnel from companies other than A to carry out the repair."
[0080] Text cleaning and standardization involves the following preprocessing steps on the original work order text: removing irrelevant symbols, HTML tags, and line breaks; standardizing the formats of numbers, dates, and IDs (e.g., “User ID 10000001” → “user_id=10000001”); and identifying and labeling key entities (e.g., user ID, department name, time range, and field name).
[0081] Loading a pre-trained and fine-tuned NLU model: The system uses a natural language understanding model (such as a fine-tuned version of BERT, RoBERTa, or LLaMA) that is pre-trained on a general corpus and fine-tuned on historical enterprise work order data, and has the following capabilities:
[0082] Intent Detection, Named Entity Recognition (NER), and Semantic Role Labeling.
[0083] Intent recognition: Determine the work order type and operational requirements, and the model categorizes the work order into a preset intent category, for example:
[0084] update_user_phone (modifies user's phone number);
[0085] export_repair_records (export repair records);
[0086] Each intent corresponds to a set of expected operation permissions (such as "update") and data range mode.
[0087] Entity extraction: Identifying key data objects, the model extracts structured parameters from the text, including:
[0088] Subject: The executor;
[0089] Object: The target data table (e.g., user_info, expense_record);
[0090] Condition: Filtering conditions (e.g., user_id=10000001, department='Finance Department', date BETWEEN '2025-11-01' AND '2025-11-30').
[0091] Field: The specific column involved (such as phone, amount, status);
[0092] Action verbs: such as "modify", "export", "delete";
[0093] Semantic validation and ambiguity resolution
[0094] If the work order is vague (e.g., "handle that user's call"), the system triggers a clarification mechanism (e.g., returning an error code or requesting additional information); if there are multiple possible intentions, the model outputs a confidence score, and if the confidence score is low, it is transferred to manual review.
[0095] Step S3: Based on the parsing results, automatically match the corresponding fine-grained permissions in the preset permission library and generate a permission request;
[0096] The permission database stores content. The system pre-builds and maintains a fine-grained permission database, and each record contains the following structured fields:
[0097] permission_id: A unique identifier for permissions (e.g., perm_user_phone_update_001)
[0098] data_scope: Defines the data scope, including:
[0099] table: The target database table (e.g., user_info);
[0100] row_condition_template: Row-level condition template (e.g., user_id = {user_id})
[0101] columns: A list of fields that are allowed to be accessed (e.g., ["phone"]);
[0102] operation: Operation type (e.g., update, read, export);
[0103] risk_level: Risk level (low / medium / high, used for subsequent authorization strategy);
[0104] natural_language_desc: The corresponding natural language description (e.g., "Allow modification of the contact number of the specified user");
[0105] Permission index optimization: To improve matching efficiency, the permission database has been optimized with a multi-dimensional index, including:
[0106] Composite indexes by table + operation, inverted indexes by columns, and partitioned storage by risk level.
[0107] The permission matching logic is executed, the NLU parsing result is received, and the structured work order semantic parsing result is received from the previous stage.
[0108] The system employs a hierarchical matching strategy to execute a multi-dimensional matching algorithm, comparing the following dimensions sequentially:
[0109] (1) Table name matching: filter all permission items in the permission database with table = "user_info".
[0110] (2) Operation type matching: In the above results, the permission of operation = "update" is retained.
[0111] (3) Field coverage matching, which requires that the columns of the permission item must completely contain the fields in the request (i.e., ["phone"] ⊆ permission.columns).
[0112] If the permission is defined as ["phone", "email"], then requests that only require the phone number can be overridden.
[0113] (4) Line condition compatibility judgment
[0114] If the row_condition_template of the permission item is a wildcard (e.g., user_id = {user_id}), it is considered to be adaptable to any specific user_id; if it is a fixed value (e.g., user_id = 'admin'), it will only match if the request conditions are exactly the same; complex condition templates are supported (e.g., department = {dept} AND status = 'active'), and compatibility is verified through parameter binding.
[0115] The matching results are sorted and optimized. If multiple matches exist, the optimal permission is selected according to the following priority:
[0116] Prioritize those with the finest granularity (e.g., item level > row level > table level), those with the lowest risk level, and those with the most recent creation time (to ensure the use of the latest strategy).
[0117] Generate permission request object
[0118] Construct a permission request structure, combine the matched permission items with the current work order context, and generate a standardized permission request object.
[0119] Step S4: Process the permission request according to the preset authorization policy: if it is a low-risk permission, it is automatically authorized; if it is a high-risk permission, a manual approval process is triggered, and the authorization is completed after the approval is passed.
[0120] The system receives a structured permission request object from the AI permission matching module. This request contains the following key fields:
[0121] permission_id: The fine-grained permission identifier that was matched;
[0122] concrete_data_scope: The concrete data scope (such as table name, row conditions, field list);
[0123] operation: Target operation type;
[0124] risk_level: A predefined risk level (values can be "low", "medium" or "high");
[0125] natural_language_desc: The corresponding natural language description, used for manual approval display.
[0126] The system reads the preset authorization policy and loads the configured authorization policy rule library. The policy is stored in JSON or rule engine format and supports dynamic updates without restarting the service.
[0127] Automatic authorization processing determines permissions to be low-risk if the risk_level in the permission request is "low" and meets any of the following conditions:
[0128] The operation type is not in the high-risk operation list (e.g., not delete or export); the target data table is not in the sensitive table set; if automatic authorization is executed, the system will immediately perform the following actions:
[0129] Generate a unique authorization credential (such as a JWT Token or a temporary Access Key), bind it to the user's identity, permission ID, and validity period; mark the authorization status as "automatically approved"; call the permission distribution module to push the credential to the user or service account executing the work order; and write a complete authorization log to the logging module, including the time, permission description, authorization method, etc.
[0130] The manual approval process has been triggered and the permission request has been identified as high-risk. A permission request is considered high-risk if it meets any of the following conditions:
[0131] The risk level is "high"; the operation type is delete or export; and the requester role is an external person or a temporary account.
[0132] When a manual approval process is triggered, the system will perform the following actions:
[0133] Automatically generate approval tasks and push them to preset approvers (such as the head of the network management center or the head of the operation and maintenance unit).
[0134] The approval interface displays: the original work order content; a natural language description of the permission request; structured permission details (including data range, operation, and validity period suggestions); risk warning labels (such as "High Risk: Involves batch export of sensitive data"); and allows approvers to select "Approve", "Reject", or "Request Supplementary Explanation".
[0135] Step S5: After authorization is completed, issue permission credentials to the user or system component executing the work order task, and record the permission effective time and validity period;
[0136] Select the target, and the system will identify the entity responsible for executing the work order task:
[0137] If it is a manual work order (such as a network administrator handling a request from an operations and maintenance personnel), then a session token or temporary permission context will be issued to the operations and maintenance personnel.
[0138] If it is an automated task (such as a scheduled script or microservice call), it will be distributed to the corresponding system component or service account.
[0139] The method of issuing credentials will employ a secure issuance mechanism based on the type of executing entity:
[0140] For users: Inject authorization credentials into the authorization context of their current session, or return a temporary token via a secure channel (such as an HTTPS API);
[0141] For system components: Write credentials to a protected configuration center (such as Vault, Apollo) or issue short-lived JWTs through an internal authentication service;
[0142] Credentials are not exposed to the front end or logs in plaintext; they are transmitted securely only through encrypted channels or in memory.
[0143] Once activated, the permission takes effect immediately. When the executing entity subsequently accesses the controlled resources, the permission verification module will perform real-time authentication based on this credential.
[0144] Step S6: Automatically revoke the issued permissions when the permission validity period expires or the work order task is completed;
[0145] Revoke granted permissions, including time-based automatic revoke and event-based proactive revoke:
[0146] Time-based automatic eviction: Each permission credential contains a specific time field when it is issued. The permission eviction module starts a background timed scanning task to traverse all permission credentials. If the current system time is equal to or exceeds the set time, the permission is marked as pending eviction.
[0147] Event-based proactive recycling: The system monitors the time when the status of a work order changes. When it receives a work order status that is "completed", it queries all active permission credentials associated with the work order and marks these permissions as "task completed" to trigger recycling.
[0148] The entire process of permission application, authorization, use, and revocation is recorded, forming an auditable permission operation trajectory.
[0149] like Figure 7 As shown, an artificial intelligence-based fine-grained dynamic permission distribution system employs the aforementioned artificial intelligence-based fine-grained dynamic permission distribution method, including a permission definition and description module, a work order semantic parsing module, a permission matching module, an authorization decision module, a permission issuance and management module, and a permission revoke module;
[0150] The permission definition and description module is used to define fine-grained permissions, supporting data range control at the item, row, and column levels. Permissions are configured through a visual interface. Using a rule engine and a fine-tuned natural language processing model, technical permission definitions are converted into business-readable natural language descriptions. Structured permission objects and natural language descriptions are packaged and stored in the permission description library, and a unique index is established.
[0151] The work order semantic parsing module is used to receive work order tasks dispatched from the alarm center channel of the operation and maintenance platform, clean and standardize the work order data, use a natural language understanding model finely tuned on the enterprise's historical work orders to identify the work order intent, extract the data objects to be accessed and the target operation, and output structured parsing results for subsequent permission matching.
[0152] The permission matching module is used to maintain a pre-built fine-grained permission library, supports multi-dimensional indexing, receives work order parsing results, executes multi-dimensional matching algorithms, selects the most matching permission items from the permission library, generates standardized permission request objects, and injects specific values to form concrete permissions if the permission template contains placeholders.
[0153] The authorization decision module is used to receive permission requests, load the configured authorization policy rule library, determine the permission risk level according to the policy, and automatically generate authorization credentials, mark them as automatic approval, and trigger the issuance if the risk is low. If the risk is high, an approval task is automatically generated, pushed to the preset approver, and authorization is completed after manual approval.
[0154] The permission issuance and management module is used to generate structured permission credentials after authorization is completed, dynamically set the permission validity period, and issue the credentials to the work order execution subject through a security mechanism. The permission takes effect immediately and is verified in real time by the authentication module when accessing resources. The module records the permission effective time and validity period.
[0155] The permission revocation module is used to automatically revoke permissions, ensuring the principle of least privilege, and supports two revocation mechanisms.
[0156] Its working principle is as follows: First, the permission definition module completes the definition of fine-grained permissions, and the natural language description generation module generates the corresponding natural language description; when a work order task enters the system, the AI permission matching module parses the work order and matches the required permissions, and submits it to the permission authorization module for authorization; after authorization is approved, the permission issuance and management module issues the permissions to the executor, and the log recording module records the relevant information; after the permissions expire, the permission revocation module automatically revoks the permissions to ensure the security and controllability of permissions.
[0157] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A fine-grained dynamic permission distribution method based on artificial intelligence, characterized in that, Includes the following steps: Step S1: Define permissions in a fine-grained manner. Based on the fine-grained permissions, generate corresponding natural language descriptions through a rule engine combined with a natural language processing model, and store them in the permission description library. Implemented in the following ways: Step A1: Define fine-grained permissions, defining data permissions to control the scope of accessible data and operation permissions to control the actions that can be performed, generating a structured permission object; Step A2: Natural language description generation. The rule engine loads the preset business semantic mapping rule library, converts the technical fields into business language, matches the preset natural language template according to the permission type, and optimizes the initial description input into the fine-tuned natural language model. Step A3: Store in the permission description library. Package the unique permission identifier, structured permission definition, and natural language description text into a permission description record, write it into the permission description library, establish a unique index for the unique permission identifier, and establish data association with the permission definition module, AI matching module, and authorization module. Step S2: Receive the work order task, use a natural language understanding model to perform semantic parsing on the text content of the work order task, identify the data objects to be accessed and the target operation, and obtain the parsing result; Step S3: Based on the parsing results, automatically match the corresponding fine-grained permissions in the preset permission library and generate a permission request; Step S4: Process the permission request according to the preset authorization policy: if it is a low-risk permission, it is automatically authorized; if it is a high-risk permission, a manual approval process is triggered, and the authorization is completed after the approval is passed. Step S5: After authorization is completed, issue permission credentials to the user or system component executing the work order task, and record the permission effective time and validity period; Step S6: Automatically revoke the issued permissions when the permission validity period expires or the work order task is completed.
2. The fine-grained dynamic permission distribution method based on artificial intelligence according to claim 1, characterized in that, The fine-grained permissions in step S1 include data permissions and operation permissions. Data permissions can be defined through a visual configuration interface, supporting permission settings for database tables, specific data rows, columns, or specific data items; Data permissions include at least item-level, row-level, or column-level data ranges, and the operation permissions include at least one of viewing, adding, modifying, deleting, or exporting.
3. The fine-grained dynamic permission distribution method based on artificial intelligence according to claim 1, characterized in that, Step S2 is implemented in the following manner: Step B1: Work order reception and preprocessing. Work order tasks are received from the alarm center of the operation and maintenance platform, work order dispatch, and internal approval process channels through standardized interfaces. The original work orders are cleaned and standardized. Step B2: Semantic parsing using a natural language understanding model. This model is pre-trained on a general corpus and fine-tuned on historical work order data from enterprises. It categorizes work orders into preset intent categories, extracts structured parameters from the text, and obtains the parsing results.
4. The fine-grained dynamic permission distribution method based on artificial intelligence according to claim 1, characterized in that, Step S3 is implemented in the following manner: Step C1: Design the permission library structure, pre-build and maintain a fine-grained permission library, and establish a multi-dimensional index; Step C2: Execute the permission matching logic, receive the structured work order semantic results, and use a multi-dimensional fine-grained permission matching algorithm to filter all permission items in the permission library; Step C3: Generate a permission request object. Combine the matched permission items with the current work order context to generate a standardized permission request object. If the permission template contains placeholders, inject the specific values from the parsing results to form a concrete permission.
5. The fine-grained dynamic permission distribution method based on artificial intelligence according to claim 1, characterized in that, Step S4 is implemented in the following manner: Step D1: Receive permission requests and risk level identification. Receive structured permission requests from the AI permission matching module and load the configured authorization policy rule base. The policies are stored in JSON or rule engine format. Step D2: Authorization processing. If the permission is determined to be low-risk, a unique authorization credential is generated, bound to the user's relevant information, the authorization status is marked as automatically approved, the permission issuance module is called, and the credential is pushed to the user or service account that executed the work order. If a permission is deemed high-risk, an approval task will be automatically generated and pushed to a pre-set approver for manual approval.
6. The fine-grained dynamic permission distribution method based on artificial intelligence according to claim 1, characterized in that, Step S5 is implemented in the following manner: Step E1: Permission credential generation. After the permission authorization module completes the authorization, the permission issuance and management module generates a structured permission credential and dynamically sets the validity period of the permission according to the preset strategy or work order context. Step E2: Issuance of authorization credentials. The system identifies the executing entity of the work order task and issues the credentials using a secure issuance mechanism. The authorization takes effect immediately. When the executing entity subsequently accesses controlled resources, the authorization verification module will perform real-time authentication based on the credentials and record the authorization's effective time and validity period.
7. The fine-grained dynamic permission distribution method based on artificial intelligence according to claim 1, characterized in that, Step S6 involves revoking granted permissions, including time-based automatic revocation and event-based proactive revocation. Time-based automatic eviction: Each permission credential contains a specific time field when it is issued. The permission eviction module starts a background timed scanning task to traverse all permission credentials. If the current system time is equal to or exceeds the set time, the permission is marked as pending eviction. Event-based proactive recycling: The system monitors the time when the status of a work order changes. When it receives a work order status that is "completed", it queries all active permission credentials associated with the work order and marks these permissions as "task completed" to trigger recycling.
8. A fine-grained dynamic permission distribution system based on artificial intelligence, employing the fine-grained dynamic permission distribution method based on artificial intelligence as described in any one of claims 1-7, characterized in that, It includes a permission definition and description module, a work order semantic parsing module, a permission matching module, an authorization decision module, a permission issuance and management module, and a permission revoke module; The permission definition and description module is used to define fine-grained permissions, supporting data range control at the item, row, and column levels. Permissions are configured through a visual interface. Using a rule engine and a fine-tuned natural language processing model, technical permission definitions are converted into business-readable natural language descriptions. Structured permission objects and natural language descriptions are packaged and stored in the permission description library, and a unique index is established. The work order semantic parsing module is used to receive work order tasks dispatched from the alarm center channel of the operation and maintenance platform, clean and standardize the work order data, use a natural language understanding model finely tuned on the enterprise's historical work orders to identify the work order intent, extract the data objects to be accessed and the target operation, and output structured parsing results for subsequent permission matching. The permission matching module is used to maintain a pre-built fine-grained permission library, supports multi-dimensional indexing, receives work order parsing results, executes multi-dimensional matching algorithms, selects the most matching permission items from the permission library, generates standardized permission request objects, and injects specific values to form concrete permissions if the permission template contains placeholders. The authorization decision module is used to receive permission requests, load the configured authorization policy rule library, determine the permission risk level according to the policy, and automatically generate authorization credentials, mark them as automatic approval, and trigger the issuance if the risk is low. If the risk is high, an approval task is automatically generated, pushed to the preset approver, and authorization is completed after manual approval. The permission issuance and management module is used to generate structured permission credentials after authorization is completed, dynamically set the permission validity period, and issue the credentials to the work order execution subject through a security mechanism. The permission takes effect immediately and is verified in real time by the authentication module when accessing resources. The module records the permission effective time and validity period. The permission revoke module is used to automatically revoke permissions, ensuring the principle of least privilege. It supports two revoke mechanisms: time-based automatic revoke and event-based proactive revoke.