A pre-judgment permission binding method, device and equipment and storage medium

Abstract

The application relates to a pre-judgment type permission binding method and device, equipment and a storage medium, and belongs to the field of permission management. User intention feature data is analyzed to obtain an intention analysis result; environment constraint factors are generated based on dynamic environment data; user historical behavior data, user intention feature data and environment constraint factors are input into a long short-term memory network behavior prediction model to output a user behavior prediction result containing a predicted operation; a decision is made based on the intention analysis result, the environment constraint factors and the user behavior prediction result to determine a target temporary permission, the consistency of a user actual operation and the predicted operation is monitored in real time within the effective period of the target temporary permission, the change of dynamic environment data is monitored, and if preset recovery conditions are met, the target temporary permission is automatically recovered; the application can solve the problems of traditional authorization lag and low efficiency, improve permission matching accuracy, realize permission whole life cycle management and control by combining real-time monitoring and automatic recovery, and balance permission management safety and business efficiency.

Description

Technical Field

[0001] This application relates to the technical field of access control, and in particular to a predictive access control method, apparatus, device, and storage medium. Background Technology

[0002] In the field of access control, traditional access control models are mainly static authorization and reactive authorization. Access control configuration relies on manual settings or user application-administrator approval processes. The timing of authorization triggering lags behind business operation needs, making it difficult to adapt to the dynamic access control needs across scenarios and devices in enterprise digital transformation, thus hindering the improvement of business processing efficiency.

[0003] While existing technologies offer two types of improvement solutions, both have significant drawbacks: one type automates authorization by pre-setting a fixed mapping relationship between roles and permissions, but because roles and permissions are statically bound, they cannot be flexibly adjusted according to the user's real-time intent and dynamic environment, which can easily lead to security risks of excessive permissions or business interruptions due to insufficient permissions; the other type recommends permissions based on the user's historical behavior, but it only relies on a single behavioral dimension and does not combine the user's deeper intent and dynamic environmental factors, resulting in low accuracy of permission matching and frequent occurrences of misauthorization and missed authorization.

[0004] Furthermore, existing technologies generally lack the ability to dynamically manage permissions throughout their entire lifecycle, further exacerbating the conflict between security and efficiency: on the one hand, the permission application and approval process is cumbersome, disrupting the continuity of business processing and significantly reducing operational efficiency; on the other hand, there is no real-time monitoring or intelligent revocation mechanism after permissions are granted, which can easily lead to hidden dangers such as idle permissions and unauthorized use, and the usage trajectory of permissions lacks traceability records, failing to meet compliance audit requirements; as enterprise business scenarios become richer and user behavior becomes more complex, traditional fixed-rule permission management technologies can no longer adapt to dynamic business environments, and the industry urgently needs a permission management solution that can accurately predict permission needs, dynamically adapt to environmental changes, and balance security and efficiency. Summary of the Invention

[0005] This application provides a predictive permission binding method, device, equipment, and storage medium. It achieves predictive permission issuance through multi-dimensional data fusion, which solves the problems of lagging and inefficient traditional authorization, improves the accuracy of permission matching, and achieves full lifecycle management of permissions by combining real-time monitoring and automatic revocation. It balances the security of permission management with business efficiency and is suitable for dynamic business scenarios.

[0006] Firstly, this application provides a predictive permission binding method, comprising: collecting multi-dimensional data, wherein the multi-dimensional data includes user intent feature data, dynamic environment data, and user historical behavior data; performing deep analysis on the user intent feature data to obtain intent analysis results; and generating environmental constraint factors based on the dynamic environment data; inputting the user historical behavior data, the intent analysis results, and the environmental constraint factors into a pre-trained long short-term memory network behavior prediction model, and outputting user behavior prediction results, wherein the user behavior prediction results include prediction operations; making decisions based on the intent analysis results, the environmental constraint factors, and the user behavior prediction results to determine target temporary permissions, and issuing the target temporary permissions to user sessions or devices; during the validity period of the target temporary permissions, monitoring the consistency between the user's actual operations and the predicted operations in real time, and monitoring changes in the dynamic environment data; and automatically revoking the target temporary permissions if the monitoring results meet preset revoke conditions.

[0007] In one possible implementation, the user intent feature data includes user input text, schedule information, project tags, and historical task-permission association records.

[0008] In one possible implementation, the deep analysis of the user intent feature data to obtain intent parsing results specifically includes: using a natural language processing model to perform semantic analysis on the user input text to obtain initial intent tags; classifying the initial intent tags based on a multi-dimensional intent classification system to obtain target intent classification results; when the target intent classification result is a core intent or related intent, integrating the schedule information and the project tag for contextual consistency verification; when the target intent classification result is a risky intent, calling the historical task-permission association record for security compliance verification; correcting the target intent classification result based on the verification result to generate precise intent tags and corresponding precise intent permission requirement types; prioritizing the precise intent tags based on the project urgency, task importance, and user role weight associated with the precise intent tags to determine the intent priority corresponding to the precise intent tags; and using the precise intent tags, the corresponding target intent classification results, the precise intent permission requirement types, and the intent priority as intent parsing results.

[0009] In one possible implementation, the dynamic environment data includes time environment data, location environment data, business environment data, and system environment data.

[0010] In one possible implementation, generating environmental constraint factors based on the dynamic environmental data specifically includes: quantifying the time environment data to obtain a time environment quantization factor; quantifying the location environment data to obtain a location environment quantization factor; quantifying the business environment data to obtain a business environment quantization factor; and quantifying the system environment data to obtain a system environment quantization factor; and then weighting the time environment quantization factor, the location environment quantization factor, the business environment quantization factor, and the system environment quantization factor based on preset weights to obtain an environmental constraint factor.

[0011] In one possible implementation, the pre-training process of the Long Short-Term Memory network behavior prediction model specifically includes: extracting multiple operation records from the user's historical behavior data to form historical permission usage data; wherein each operation record contains historical operation information and its corresponding historical permission identifier; constructing a permission co-occurrence graph based on the historical permission usage data, wherein the nodes of the permission co-occurrence graph represent different operation permissions, and the edge weights represent the correlation strength of different operation permissions appearing successively in the historical permission usage data; and constructing a training sample set based on the historical permission usage data, wherein each training sample in the training sample set includes a historical preceding operation sequence. The training sample includes a sequence of preceding operations, historical subsequent operations, and the historical operation permissions corresponding to those preceding operations. For each preceding operation sequence in the training sample, association features related to the permissions contained in the preceding operation sequence are extracted from the permission co-occurrence graph, and these association features are used as auxiliary input features corresponding to the preceding operation sequence. The preceding operation sequence and its corresponding auxiliary input features in the same training sample are used as model inputs, and the preceding operations and their corresponding historical operation permissions are used as prediction targets. The long short-term memory network behavior prediction model is trained to obtain a pre-trained long short-term memory network behavior prediction model.

[0012] In one possible implementation, the long short-term memory network behavior prediction model includes a sequence processing layer, a vector fusion layer, and a prediction output layer.

[0013] In one possible implementation, the user's historical behavior data, the intent parsing result, and the environmental constraint factors are input into a pre-trained Long Short-Term Memory (LSTM) network behavior prediction model, and a user behavior prediction result is output. The user behavior prediction result includes prediction operations, specifically: inputting the user's historical behavior data, the intent parsing result, and the environmental constraint factors into the pre-trained LTM network behavior prediction model; vectorizing the user's historical behavior data based on the LTM network behavior prediction model to obtain an operation sequence vector; vectorizing the intent parsing result to obtain an intent feature vector; and vectorizing the environmental constraint factors to obtain an environmental feature vector; inputting the operation sequence vector into the sequence processing layer to generate a sequence encoding vector representing the historical behavior context; inputting the sequence encoding vector, the intent feature vector, and the environmental feature vector into the vector fusion layer for fusion processing to form a comprehensive state vector; inputting the comprehensive state vector into the prediction output layer for prediction processing; outputting the predicted operation and the corresponding prediction operation permission; and using the predicted operation and the corresponding prediction operation permission as the user behavior prediction result.

[0014] In one possible implementation, the decision-making process based on the intent parsing result, the environmental constraint factor, and the user behavior prediction result to determine the target temporary permission specifically includes: forming a set of permissions to be granted based on the precise intent permission requirement type in the intent parsing result and the predicted operation permission in the user behavior prediction result; comparing the set of permissions to be granted with a static permission baseline based on user roles, and when a conflict is detected, pruning the set of permissions to be granted according to the principle of least privilege to obtain a subset of permissions to be granted; determining the effective conditions for each target permission in the subset of permissions to be granted based on the intent priority in the intent parsing result and the environmental constraint factor, wherein the effective conditions include at least one of the following: effective duration, number of uses, and applicable environmental scope; and generating the target temporary permission based on the subset of permissions to be granted and the effective conditions.

[0015] In one possible implementation, the consistency between the user's actual operation and the predicted operation is monitored in real time, and changes in the dynamic environment data are monitored. If the monitoring results meet preset reclamation conditions, the target temporary permission is automatically revoked. Specifically, this includes: comparing the user's actual operation and the predicted operation in real time to calculate the behavior deviation; continuously collecting current dynamic environment data and generating a real-time environment constraint factor corresponding to the current dynamic environment data; if the target temporary permission is not used within its effective duration, the behavior deviation exceeds a preset security threshold, or the real-time environment constraint factor does not meet the applicable environment range in the effective conditions of the target temporary permission, then the automatic reclamation operation of the target temporary permission is triggered. The automatic reclamation operation includes: immediately revoking the target temporary permission and terminating the access capability of the user session or device corresponding to the target temporary permission.

[0016] Secondly, this application provides a predictive permission binding device, comprising: a data acquisition module, a data parsing module, a user behavior prediction module, a decision-making module, and an automatic permission revocation module; wherein, the data acquisition module is used to collect multi-dimensional data, including user intent feature data, dynamic environment data, and user historical behavior data; the data parsing module is used to perform deep analysis on the user intent feature data to obtain intent analysis results; and generate environmental constraint factors based on the dynamic environment data; the user behavior prediction module is used to combine the user historical behavior data, the intent analysis results, and the environmental constraints... Factors are input into a pre-trained long short-term memory network behavior prediction model, which outputs user behavior prediction results, including prediction operations. The decision module is used to make decisions based on the intent parsing results, the environmental constraint factors, and the user behavior prediction results, determine the target temporary permission, and issue the target temporary permission to the user session or device. The automatic permission revoke module is used to monitor the consistency between the user's actual operation and the predicted operation in real time during the validity period of the target temporary permission, and monitor the changes in the dynamic environmental data. If the monitoring results meet the preset revoke conditions, the target temporary permission is automatically revoked.

[0017] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0018] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.

[0019] This application provides a predictive permission binding method, apparatus, device, and storage medium, which has the following advantages compared with the prior art:

[0020] The technical solution of this application first collects multi-dimensional data on user intent features, dynamic environment, and user historical behavior. Then, it performs in-depth analysis of the user intent feature data to obtain intent analysis results. Simultaneously, it generates environmental constraint factors based on dynamic environment data. Combining multi-dimensional data, user historical behavior data, intent analysis results, and environmental constraint factors, it inputs them into a pre-trained long short-term memory network behavior prediction model. The model accurately outputs user behavior prediction results containing predicted operations. Based on this, it determines and issues target temporary permissions, replacing the traditional static authorization and reactive authorization modes. It no longer relies on cumbersome processes such as manual configuration or user application-administrator approval, fundamentally solving the problem of traditional authorization lagging behind business needs. It significantly improves the efficiency of permission granting and achieves permission prediction through multi-dimensional data fusion analysis rather than single-dimensional judgment, effectively improving the accuracy of matching permissions with users' actual business needs. At the same time, within the validity period of the target temporary permission, it monitors the consistency between the user's actual operation and the predicted operation in real time, monitors changes in dynamic environmental data, and automatically revoks permissions when preset conditions are met. It realizes dynamic management of the entire lifecycle of permissions from issuance to revocation, effectively avoiding security risks such as excessive, idle, and unauthorized use of permissions. It improves the efficiency of business operations while ensuring the security of permission management, achieving a balance between the two and adapting to the dynamic and cross-scenario permission management needs of enterprises in the process of digital transformation. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0024] Figure 1 This is a flowchart illustrating an embodiment of the predictive permission binding method provided in this application;

[0025] Figure 2This is a schematic diagram of the structure of one embodiment of the predictive permission binding device provided in this application;

[0026] Figure 3 This is a schematic diagram of the structure of a computer device provided in this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0029] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0030] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0031] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0032] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrases "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0033] Example 1, see Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the predictive permission binding method provided in this application, as shown below. Figure 1 As shown, the method includes steps 101-105, as detailed below:

[0034] Step 101: Collect multi-dimensional data, including user intent feature data, dynamic environment data, and user historical behavior data.

[0035] In one embodiment, the user intent feature data is collected from multiple sources, including user interaction terminals, enterprise collaborative office systems, and permission management systems, and includes user input text, schedule information, project tags, and historical task-permission association records.

[0036] Specifically, the user input text is captured in real time through system text input boxes, voice interaction modules, and other entry points to capture the user's intention expression content, such as task descriptions and search keywords.

[0037] Specifically, the schedule information is automatically retrieved from the user's bound system built-in schedule and the enterprise office platform schedule management module, extracting core information such as the task content, planned execution time, and related projects corresponding to the schedule, thereby realizing the association between the user's schedule and business scenarios.

[0038] Specifically, the project tags are extracted from the business management system currently logged into by the user, and unique project tags are generated based on the user's project, responsible business module, and project participation role, accurately representing the user's current business affiliation.

[0039] Specifically, the historical task-permission association records are synchronized in real time from the permission management system ledger, extracting the full-process association data of permission application, approval, granting, use, and revocation when users complete various business tasks in the past, and establishing the correspondence between tasks and permissions.

[0040] In one embodiment, the dynamic environmental data revolves around dynamic information in four dimensions: time, location, business, and system environment. It is collected through automatic system perception and real-time monitoring, including time environment data, location environment data, business environment data, and system environment data.

[0041] Specifically, the time environment data is automatically collected by the system's built-in time module to obtain the current timestamp, including time information such as operation period, weekday / holiday, peak / off-peak business periods.

[0042] Specifically, the location environment data, with the user's authorization, collects information such as the user's physical location and network access environment, including office area / remote location / external network.

[0043] Specifically, the business environment data is retrieved in real time from the enterprise business middle platform and project management system, including project stages, team collaboration status, etc., wherein the project stages include the project intensive phase / routine phase.

[0044] Specifically, the system environment data is continuously collected by the system background monitoring module, covering system operation information such as system load, network security level, and device health status.

[0045] In one embodiment, the user's historical behavior data is automatically extracted in full from the system's backend data interface, containing all valid operation records of the user within a reasonable business period in the past. Each operation record contains historical operation information and its corresponding historical permission identifier.

[0046] Specifically, each valid operation record undergoes field splitting and information extraction to obtain standardized historical operation information, which includes core fields such as operation subject, operation time, operation terminal, operation type, operation object, operation path, and operation result. Based on the enterprise's preset binding relationship between operation behavior and permissions, each standardized historical operation information is precisely associated with the corresponding historical permission identifier, clarifying the permission type and permission level corresponding to each operation. The operation records with the completed historical permission identifier association are structured and integrated, and the historical operation information and historical permission identifier of each operation record are standardized according to a unified data format, ultimately forming standardized historical permission usage data, providing a sample basis for subsequent behavior prediction model training.

[0047] In one embodiment, the user intent feature data, the dynamic environment data, and the user historical behavior data are further preprocessed. The preprocessing includes denoising, normalization, and feature vector transformation operations to remove noise interference from the data, unify data dimensions and units, and transform unstructured / semi-structured data into computable feature vectors. After preprocessing, all data is stored in a blockchain trusted database to ensure the immutability of the data and to provide data support for subsequent full-process auditing and traceability of permissions.

[0048] Step 102: Perform deep analysis on the user intent feature data to obtain intent analysis results; and generate environmental constraint factors based on the dynamic environment data.

[0049] In one embodiment, the deep analysis of the user intent feature data to obtain intent parsing results specifically includes: using a natural language processing model to perform semantic parsing on the user input text to obtain initial intent tags; classifying the initial intent tags based on a multi-dimensional intent classification system to obtain target intent classification results; when the target intent classification result is a core intent or related intent, integrating the schedule information and the project tag for contextual consistency verification; when the target intent classification result is a risky intent, calling the historical task-permission association record for security compliance verification; correcting the target intent classification result based on the verification result to generate precise intent tags and corresponding precise intent permission requirement types; prioritizing the precise intent tags based on the project urgency, task importance, and user role weight associated with the precise intent tags to determine the intent priority corresponding to the precise intent tags; and using the precise intent tags, the corresponding target intent classification results, the precise intent permission requirement types, and the intent priority as intent parsing results.

[0050] Specifically, the natural language processing model includes, but is not limited to, NLP models such as BERT / RoBERTa.

[0051] Specifically, when using a natural language processing model to perform semantic parsing on the user input text to obtain initial intent tags, the natural language processing model is used to perform deep semantic parsing on the text. Through the model's semantic understanding and feature extraction capabilities, the core intents such as operational needs and business goals contained in the user input text are identified. The corresponding intent tags are matched from the preset intent tag library to generate initial intent tags, and the intent confidence corresponding to the initial intent tags is output.

[0052] Preferably, the intent tags include, but are not limited to, data export, process approval, and device control.

[0053] Specifically, the initial intent tags are classified based on a multi-dimensional intent classification system. When obtaining the target intent classification result, the initial intent tags are accurately classified based on the constructed multi-dimensional intent classification system, which includes core intent, related intent, and risk intent. Figure 3The system is divided into three main categories: core intent, which refers to the user's direct core operational needs, such as viewing data or editing files; related intent, which refers to derivative needs that are operationally related to the core intent, such as exporting data after viewing a report; and risky intent, which refers to intents that pose security risks such as unauthorized access or sensitive data operations. Based on the definitions and judgment rules of each category, the initial intent tags are classified and their respective intent categories are clarified, resulting in target intent classification results. This achieves a hierarchical and refined definition of user intents.

[0054] Specifically, based on the different target intent classification results, a differentiated verification process is initiated to ensure the accuracy and compliance of intent recognition. When the target intent classification result is a core intent or a related intent, the collected user schedule information and project tags are integrated to perform contextual consistency verification, checking whether the core intent or related intent matches the user's current schedule tasks and the stage of the project, and verifying the rationality and scenario adaptability of the intent. If the target intent classification result is a risky intent, historical task-permission association records are retrieved for security compliance verification. Combining the user's past task execution and permission usage records, it is checked whether the risky intent is within the user's operation permission scope and whether there is a possibility of unauthorized operation, thus verifying the compliance of the intent from a security perspective.

[0055] Specifically, based on the above verification results, the target intent classification results are modified accordingly. If the verification passes, the original classification results are retained; if the verification fails, the intent category is adjusted or the initial intent label is modified according to the actual scenario. After the classification results are modified, accurate intent labels are generated. At the same time, the user operation requirements corresponding to the label are combined to match the required permission type, clarify the accurate intent permission requirement type, and achieve precise binding between intent and permission requirements, providing clear permission guidance for subsequent permission prediction.

[0056] Specifically, based on the generated precise intent tags, a multi-dimensional priority evaluation index is constructed, comprehensively considering the associated project urgency, task importance, and user role weight. For example, intents corresponding to the critical phase of a project and core business tasks have higher priority, and user roles in different positions correspond to different permission weights and intent priorities. By quantitatively evaluating the weight values ​​of each priority evaluation index and performing weighted calculations, the precise intent tags are prioritized to determine the intent priority corresponding to each precise intent tag, thereby realizing the priority definition of multiple intents and adapting to the priority requirements of subsequent permission allocation.

[0057] Specifically, the precise intent tags, their corresponding target intent classification results, precise intent permission requirement types, and intent priorities are integrated as the final intent parsing results, providing an intent-level basis for subsequent permission decisions.

[0058] In one embodiment, generating environmental constraint factors based on the dynamic environmental data specifically includes: quantifying the time environment data to obtain a time environment quantization factor; quantifying the location environment data to obtain a location environment quantization factor; quantifying the business environment data to obtain a business environment quantization factor; and quantifying the system environment data to obtain a system environment quantization factor; and weighting the time environment quantization factor, the location environment quantization factor, the business environment quantization factor, and the system environment quantization factor based on preset weights to obtain an environmental constraint factor.

[0059] Specifically, when the time environment data is quantified to obtain the time environment quantification factor, it is assigned a value based on characteristics such as weekdays / holidays, peak / off-peak business periods, and preset task execution time. For example, the peak business period is assigned a value of 0.9 and the off-peak period is assigned a value of 0.5 to generate the time environment quantification factor. The quantification result reflects the degree of constraint of the time dimension on permission granting.

[0060] Specifically, the location environment data is quantified to obtain a location environment quantification factor. This factor is quantified based on location attributes such as intranet / extranet / remote access. For example, an intranet office area is assigned a value of 1.0, and an extranet remote area is assigned a value of 0.6. This generates a location environment quantification factor that reflects the security constraint level of the location scenario.

[0061] Specifically, when quantifying the business environment data to obtain the business environment quantification factor, business characteristics such as project intensive / routine phases and team collaboration tightness are combined. For example, the project intensive phase is assigned a value of 1.2 and the routine business phase is assigned a value of 0.8 to generate the business environment quantification factor and match the permission adaptation requirements of the business scenario.

[0062] Specifically, the system environment data is quantified to obtain a system environment quantification factor. This factor is quantified based on system operating characteristics such as system load, network security level, and device health status. For example, a system with low load and high security level is assigned a value of 1.0, and a system with high load is assigned a value of 0.7. This generates a system environment quantification factor that takes into account both the resource and security constraints of system operation.

[0063] Specifically, based on the business scenario requirements and security control requirements of permission management, differentiated weight coefficients are preset for four single-dimensional environment quantification factors: time environment, location environment, business environment, and system environment. The weight coefficients are configured according to the degree of influence of each dimension on permission binding. For example, the location environment is set to a weight of 0.35 as a core security dimension, the business environment is set to a weight of 0.3 as a core scenario adaptation dimension, and the time environment and system environment are each set to a weight of 0.175. The sum of the weight coefficients is 1, and the weight coefficients can be flexibly adjusted according to the actual application scenario.

[0064] Specifically, based on preset weights, the time environment quantification factor, the location environment quantification factor, the business environment quantification factor, and the system environment quantification factor are weighted and calculated to obtain the environmental constraint factor. The calculation formula is: Environmental constraint factor = Time environment quantification factor × Time environment weight + Location environment quantification factor × Location environment weight + Business environment quantification factor × Business environment weight + System environment quantification factor × System environment weight. Through this calculation method, multi-dimensional environmental constraints are integrated into a comprehensive numerical factor. The magnitude of the factor value intuitively reflects the comprehensive constraint degree of the current overall environment on permission granting, usage, and timeliness, providing a unified environmental quantification basis for subsequent predictive permission binding.

[0065] Step 103: Input the user's historical behavior data, the intent parsing result, and the environmental constraint factors into the pre-trained long short-term memory network behavior prediction model, and output the user behavior prediction result, wherein the user behavior prediction result includes prediction operations.

[0066] In one embodiment, the pre-training process of the Long Short-Term Memory Network behavior prediction model specifically includes: extracting multiple operation records from the user's historical behavior data to form historical permission usage data; wherein each operation record contains historical operation information and its corresponding historical permission identifier; constructing a permission co-occurrence graph based on the historical permission usage data, wherein the nodes of the permission co-occurrence graph represent different operation permissions, and the edge weights represent the correlation strength of different operation permissions appearing successively in the historical permission usage data; constructing a training sample set based on the historical permission usage data, wherein each training sample in the training sample set includes a historical preceding operation sequence, a historical sequence of operations, and a historical sequence of operations. The training sample identifies subsequent historical operations and the corresponding historical operation permissions. For each preceding historical operation sequence in the training sample, association features related to the permissions contained in the preceding historical operation sequence are extracted from the permission co-occurrence map, and these association features are used as auxiliary input features corresponding to the preceding historical operation sequence. The preceding operation sequence and its corresponding auxiliary input features in the same training sample are used as model input, and the preceding historical operations and their corresponding historical operation permissions are used as prediction targets to train the long short-term memory network behavior prediction model, thereby obtaining a pre-trained long short-term memory network behavior prediction model.

[0067] Specifically, precise data filtering and extraction are performed on the collected user historical behavior data. This involves extracting multiple operation records containing complete operation chains. Each operation record must include historical operation information and corresponding historical permission identifiers. These structured operation records are then integrated to form a standardized historical permission usage dataset, providing a core data source for subsequent graph construction and sample production. At the same time, invalid and duplicate operation records are removed to ensure data accuracy.

[0068] Specifically, based on the aforementioned historical permission usage data, a visualized permission co-occurrence graph is constructed to uncover the correlation patterns between different permissions. In this graph, different operation permissions serve as nodes, and the edge weights between nodes are calculated based on the frequency and probability of different operation permissions appearing sequentially in the historical permission usage data. Higher frequency and stronger temporal correlation result in larger edge weights, intuitively reflecting the strength of the correlation between permissions. For example, if the permissions to view project reports and export report data frequently appear sequentially, the corresponding node edge weights will be higher. This graph effectively captures the temporal correlation features of permission usage, providing supplementary information for model training.

[0069] Specifically, based on historical permission usage data, the data is split according to the logic of preceding operation - subsequent operation - corresponding permission to construct the training sample set required for model training. Each training sample contains a historical preceding operation sequence, the historical subsequent operation that occurred after the historical preceding operation sequence, and the historical operation permission corresponding to the historical subsequent operation. For example, a training sample can be represented as [view data - edit data] (historical preceding operation sequence) - export data (historical subsequent operation) - export permission (historical operation permission). In this way, unstructured behavioral data is transformed into labeled samples that the model can recognize. At the same time, the samples are divided into training set and validation set according to the proportion to prepare for model training and effect verification.

[0070] Specifically, for each sample in the training sample set, the associated features are extracted from the constructed permission co-occurrence graph and used as auxiliary input for model training. Specifically, all permission identifiers contained in the historical preceding operation sequence are first decomposed, and then the associated nodes and corresponding edge weights of these permission nodes are found in the permission co-occurrence graph. The associated permission types and associated strength values ​​are integrated into structured associated features. For example, if the preceding sequence contains the permission to view reports, the associated export permission (weight 0.8) and print permission (weight 0.5) features are extracted. These auxiliary features can supplement the permission association information of the preceding sequence and improve the model's prediction accuracy for subsequent operations and permissions.

[0071] Specifically, the historical preceding operation sequence and corresponding auxiliary input features in each training sample are used as input data for the Long Short-Term Memory (LSTM) network behavior prediction model. The historical subsequent operations plus the corresponding historical operation permissions are used as the prediction target of the model. Gradient descent and other optimization algorithms are used to iteratively train the LSM network behavior prediction model. During the training process, the prediction accuracy of the model is monitored in real time through the validation set, and the hyperparameters such as the hidden layer dimension and learning rate of the model are dynamically adjusted until the prediction error of the model drops below the preset threshold. Finally, the pre-trained LSM network behavior prediction model is obtained. This model can accurately predict subsequent operations and corresponding permission requirements based on the user's operation sequence and permission association features.

[0072] In one embodiment, the long short-term memory network behavior prediction model includes a sequence processing layer, a vector fusion layer, and a prediction output layer.

[0073] In one embodiment, the user's historical behavior data, the intent parsing result, and the environmental constraint factors are input into a pre-trained Long Short-Term Memory (LSTM) network behavior prediction model to output a user behavior prediction result. The user behavior prediction result includes prediction operations, specifically: inputting the user's historical behavior data, the intent parsing result, and the environmental constraint factors into the pre-trained LTM network behavior prediction model; vectorizing the user's historical behavior data based on the LTM network behavior prediction model to obtain an operation sequence vector; vectorizing the intent parsing result to obtain an intent feature vector; and vectorizing the environmental constraint factors to obtain an environmental feature vector; inputting the operation sequence vector into the sequence processing layer to generate a sequence encoding vector representing the historical behavior context; inputting the sequence encoding vector, the intent feature vector, and the environmental feature vector into the vector fusion layer for fusion processing to form a comprehensive state vector; inputting the comprehensive state vector into the prediction output layer for prediction processing; outputting the predicted operation and the corresponding prediction operation permission; and using the predicted operation and the corresponding prediction operation permission as the user behavior prediction result.

[0074] Specifically, before inputting user historical behavior data, intent parsing results, and environmental constraint factors into the pre-trained Long Short-Term Memory (LSTM) network behavior prediction model, the three types of data are first vectorized. This transforms the non-numerical, structurally differentiated input data into a vector form that the model can recognize. Specifically, for user historical behavior data, core features such as operation sequences and permission usage timelines are extracted. Discrete operation identifiers and permission identifiers are mapped to continuous numerical vectors through an embedding layer, generating operation sequence vectors with uniform dimensions, thus fully preserving the temporal characteristics of user behavior. For intent parsing results, structured information such as precise intent labels, intent classifications, permission request types, and intent priorities are integrated and transformed into intent feature vectors according to preset feature encoding rules, quantitatively reflecting the user's core permission request tendencies. For environmental constraint factors, single numerical comprehensive constraint factors are expanded into multi-dimensional vectors containing weights for time, location, business, and system dimensions, generating environmental feature vectors that reflect the degree of constraint of the current environment on user behavior.

[0075] Specifically, the vectorized operation sequence vector is input into the sequence processing layer of the Long Short-Term Memory Network (LSTM) behavior prediction model. This layer relies on the gating mechanism of the LTM model to capture long-term dependencies in the user's historical behavior sequence, filter out invalid behavior noise, and extract key temporal features of behavior. Through progressive processing and information integration of the operation sequence vector, a sequence encoding vector that can represent the complete context of the user's historical behavior is generated. This vector not only contains the features of a single operation but also integrates the temporal correlation between operations and the order of permission usage, providing core behavioral basis for subsequent multi-feature fusion.

[0076] Specifically, sequence encoding vectors, intent feature vectors, and environmental feature vectors are simultaneously input into the model's vector fusion layer. An attention mechanism is used to perform weighted fusion processing on the three types of vectors. For example, based on the influence weights of behavior, intent, and environment in different scenarios, differentiated attention coefficients are assigned to each vector, prioritizing features that are more decisive for behavior prediction. Through vector concatenation, weighted summation, and other operations, the three independent feature vectors are integrated into a comprehensive state vector containing the user's historical behavior, core intent, and current environment. This achieves deep fusion of multi-dimensional information and avoids prediction bias caused by single-dimensional features.

[0077] Specifically, the comprehensive state vector is input into the model's prediction output layer. This layer uses a fully connected network to perform feature decoding and probability calculation on the comprehensive state vector. Based on the behavior-permission association patterns learned during the pre-training phase, it predicts the most likely subsequent action the user will take and matches the required permissions for that action. The output is presented in a probability ranking format, providing not only the core predicted action and its corresponding permissions but also the prediction confidence level. Finally, the predicted action and its permissions are integrated into a complete user behavior prediction result, providing accurate behavioral and permission requirements for subsequent predictive permission binding.

[0078] Step 104: Based on the intent parsing results, the environmental constraint factors, and the user behavior prediction results, make a decision to determine the target temporary permissions and issue the target temporary permissions to the user session or device.

[0079] In one embodiment, the step of determining target temporary permissions based on the intent parsing results, the environmental constraint factors, and the user behavior prediction results specifically includes: forming a set of permissions to be granted based on the precise intent permission requirement type in the intent parsing results and the predicted operation permissions in the user behavior prediction results; comparing the set of permissions to be granted with a static permission baseline based on user roles, and when a conflict is detected, pruning the set of permissions to be granted according to the principle of least privilege to obtain a subset of permissions to be granted; determining the effective conditions for each target permission in the subset of permissions to be granted based on the intent priority in the intent parsing results and the environmental constraint factors, wherein the effective conditions include at least one of the following: effective duration, number of uses, and applicable environmental scope; and generating target temporary permissions based on the subset of permissions to be granted and the effective conditions.

[0080] Specifically, the precise intent permission requirement types are extracted from the intent parsing results, and the predicted operation permissions are extracted from the user behavior prediction results. The two types of permission information are merged and deduplicated, and duplicate permission items are removed. The remaining permissions are integrated into a set of permissions to be granted. This set comprehensively covers the permission requirements corresponding to the user's subjective intent and the permission requirements corresponding to the objective behavior prediction, ensuring the completeness of permission requirements.

[0081] Specifically, the set of permissions to be granted is comprehensively compared with the static permission baseline corresponding to the user role to verify the rationality and compliance of the permissions. The static permission baseline is a basic permission range preset based on the user's position, rank, department, and other role information, and serves as the basic principle for granting permissions. If the comparison detects that there are permission items in the set of permissions to be granted that exceed the static permission baseline, i.e., a permission conflict occurs, the set is strictly pruned according to the principle of least privilege. Only the basic permissions necessary for the user to complete the core intent and predictive operation are retained, and unnecessary excess permission items are removed. After pruning, a subset of permissions to be granted is formed, which satisfies the user's actual operational needs while avoiding the security risks caused by excessive permissions.

[0082] Specifically, based on the intent priority in the intent parsing results and the environmental constraint factors corresponding to the dynamic environment, personalized activation conditions are formulated for each permission in the subset of permissions to be granted. The activation conditions must include at least one of the following: validity period, number of uses, and applicable environment scope, to ensure that the granting of permissions is highly adapted to the actual scenario. Differentiated activation rules are assigned according to the priority of intent. For example, for permissions corresponding to high-priority core business intents, the validity period can be appropriately extended and the number of uses can be increased. The applicable environment scope is defined in combination with the numerical characteristics of the environmental constraint factors. For example, when the environmental constraint factors reflect the security scenario of external network and remote location, the applicable environment scope of the permission is narrowed, allowing it to be used only in the specified network environment. At the same time, the validity period is shortened and the number of uses is limited, so that the activation conditions of the permission match the importance of the user intent and the current environmental constraints.

[0083] Specifically, the trimmed subset of permissions to be granted is bound one by one with the personalized activation conditions corresponding to each permission, forming structured permission configuration information. Based on this information, target temporary permissions are finally generated. Each target temporary permission contains specific permission content and clear activation rules. The permission content clearly defines the scope of operations that the user can perform, and the activation conditions limit the usage time, frequency, and applicable environment of the permission, realizing fine-grained and temporary permission configuration. Target temporary permissions are only valid within the preset activation conditions, which can accurately match the user's short-term permission needs, and through strict control of activation conditions, avoid long-term idleness or abuse of permissions, providing a compliant and secure permission solution for predictive permission binding.

[0084] Step 105: During the validity period of the target temporary permission, monitor the consistency between the user's actual operation and the predicted operation in real time, and monitor the changes in the dynamic environment data. If the monitoring results meet the preset revoke conditions, the target temporary permission will be automatically revoked.

[0085] In one embodiment, the real-time monitoring of the consistency between the user's actual operation and the predicted operation, and the monitoring of changes in the dynamic environment data, automatically reclaims the target temporary permission if the monitoring results meet preset reclamation conditions. Specifically, this includes: comparing the user's actual operation with the predicted operation in real time and calculating the behavior deviation; continuously collecting current dynamic environment data and generating a real-time environment constraint factor corresponding to the current dynamic environment data; and triggering an automatic reclamation operation for the target temporary permission if the target temporary permission is not used within its effective duration, the behavior deviation exceeds a preset security threshold, or the real-time environment constraint factor does not meet the applicable environment range in the effective conditions of the target temporary permission. The automatic reclamation operation includes: immediately revoking the target temporary permission and terminating the access capabilities of the user session or device corresponding to the target temporary permission.

[0086] Specifically, during the validity period of the target temporary permission, the user's actual operation behavior is collected in real time throughout the entire process, capturing core information such as the type of operation, the operation object, and the execution result of each step of the user's operation. This information is then compared precisely with the predicted operation output by the pre-trained long short-term memory network behavior prediction model, dimension by dimension. Based on the preset deviation calculation rules, the behavioral deviation between the two is quantitatively calculated from dimensions such as operation matching degree, operation timing consistency, and operation target relevance. The higher the value, the greater the deviation between the user's actual operation and the predicted operation. If the behavioral deviation is within the preset safety threshold, it means that the user's operation is consistent with the prediction, and the permission is valid. If it exceeds the threshold, a warning mechanism for permission revocation is triggered.

[0087] Preferably, the preset deviation calculation rule is to calculate the behavioral deviation degree by weighted summation of multi-dimensional sub-deviations, with an overall value range of 0-1, as shown in the calculation formula:

[0088] ;

[0089] in, These are the weight coefficients for each dimension, and It can be flexibly configured according to business scenarios.

[0090] Specifically, the sub-bias of the operation matching degree is calculated as follows: Sub-bias of operation matching degree = 1 - (number of matched operation types / total number of predicted operation types); for example, if the predicted operation is to export a report and view data, but the actual operation is only to view data, then the number of matches is 1, the total number of predictions is 2, and the sub-bias = 1 - 1 / 2 = 0.5; if the actual operation is to delete data, that is, there are no matches, then the sub-bias = 1.

[0091] Specifically, for the timing consistency sub-bias: the difference between the actual operation sequence and the predicted operation sequence is calculated using the "edit distance algorithm" and then normalized to the 0-1 interval. The formula is: timing consistency sub-bias = edit distance (actual sequence, predicted sequence) / max (actual sequence length, predicted sequence length); for example, the predicted sequence is viewing data - exporting report, and the actual sequence is exporting report - viewing data. The edit distance is 1, the maximum sequence length is 2, and the sub-bias = 1 / 2 = 0.5.

[0092] Specifically, the calculation formula for the sub-deviation of the operational target relevance is: target relevance sub-deviation = 1 - (number of intersections / number of unions between actual and predicted operational targets); for example, the predicted operational target is project A report, and the actual operational target is project B report, the intersection is 0, then the sub-deviation = 1; if the actual operational target includes project A report + project C report, the intersection is 1 and the union is 2, then the sub-deviation = 0.5.

[0093] Specifically, the system simultaneously initiates continuous monitoring and collection of dynamic environmental data, standardizes the latest collected environmental data, and generates real-time environmental constraint factors that accurately reflect the current environmental status. These real-time environmental constraint factors are compared in real time with the environmental constraint factors when the target temporary permissions take effect and the preset applicable environmental range to determine whether the current environment still meets the environmental requirements for the use of permissions.

[0094] Specifically, a multi-condition permission revoke determination mechanism is established, using the usage status of the target temporary permission, behavioral deviation, and real-time environmental constraint factors as the core determination criteria. As long as any preset revoke condition is met, the automatic revoke operation of the target temporary permission is immediately triggered. The specific determination conditions include: the target temporary permission has not been invoked by the user within the preset effective period, resulting in permission idleness; the deviation between the user's actual operation and the predicted operation exceeds the preset security threshold, posing a risk of operation deviating from the prediction; and the real-time environmental constraint factors do not meet the applicable environment range specified in the effective conditions of the target temporary permission, such as the user switching from the intranet office area to the external network, or the business scenario changing from the regular stage to the special control stage.

[0095] Specifically, when an automatic revocation operation is triggered, the permission management system immediately executes the permission revocation instruction. First, it immediately revokes the target temporary permission on the user's session or device, removing the permission from the user's available permission list. Simultaneously, it updates the permission management ledger, recording the time, reason, and operator of the permission revocation. Second, it directly terminates the access capabilities of the user's current session or operating device corresponding to the target temporary permission, cutting off the access links to system resources, business data, and operational functions corresponding to the target temporary permission. This ensures that the user can no longer use the revoked temporary permission in any way, fundamentally avoiding security risks caused by idle permissions, unauthorized use, and incompatible environments. At the same time, all revocation operation logs are synchronously stored in a blockchain trusted database, providing complete evidence for subsequent compliance audits and traceability.

[0096] Example 2, see Figure 2 , Figure 2 This is a schematic diagram of an embodiment of a predictive permission binding device provided in this application. Corresponding to the above-described predictive permission binding method, this application also provides a predictive permission binding device. This predictive permission binding device includes modules for executing the above-described predictive permission binding method, and can be configured in terminals such as desktop computers, tablet computers, and laptops; specifically, the predictive permission binding device includes a data acquisition module 201, a data parsing module 202, a user behavior prediction module 203, a decision-making module 204, and an automatic permission revocation module 205.

[0097] The data acquisition module 201 is used to collect multi-dimensional data, including user intent feature data, dynamic environment data, and user historical behavior data.

[0098] The data parsing module 202 is used to perform deep parsing on the user intent feature data to obtain intent parsing results; and to generate environmental constraint factors based on the dynamic environment data.

[0099] The user behavior prediction module 203 is used to input the user's historical behavior data, the intent parsing result, and the environmental constraint factors into a pre-trained long short-term memory network behavior prediction model, and output the user behavior prediction result, wherein the user behavior prediction result includes a prediction operation.

[0100] The decision module 204 is used to make a decision based on the intent parsing result, the environmental constraint factor and the user behavior prediction result, determine the target temporary permission, and issue the target temporary permission to the user session or device.

[0101] The automatic permission revocation module 205 is used to monitor the consistency between the user's actual operation and the predicted operation in real time during the validity period of the target temporary permission, and to monitor the changes in the dynamic environment data. If the monitoring results meet the preset revocation conditions, the target temporary permission will be automatically revoked.

[0102] In one embodiment, the user intent feature data includes user input text, schedule information, project tags, and historical task-permission association records.

[0103] In one embodiment, the data parsing module 202 is used to perform deep parsing of the user intent feature data to obtain intent parsing results. Specifically, this includes: using a natural language processing model to perform semantic parsing on the user input text to obtain initial intent tags; classifying the initial intent tags based on a multi-dimensional intent classification system to obtain target intent classification results; when the target intent classification result is a core intent or related intent, integrating the schedule information and the project tag for contextual consistency verification; when the target intent classification result is a risky intent, calling the historical task-permission association record for security compliance verification; correcting the target intent classification result based on the verification result to generate precise intent tags and corresponding precise intent permission requirement types; prioritizing the precise intent tags based on the project urgency, task importance, and user role weight associated with the precise intent tags to determine the intent priority corresponding to the precise intent tags; and using the precise intent tags, the corresponding target intent classification results, the precise intent permission requirement types, and the intent priority as intent parsing results.

[0104] In one embodiment, the dynamic environment data includes time environment data, location environment data, business environment data, and system environment data.

[0105] In one embodiment, the data parsing module 202 is used to generate environmental constraint factors based on the dynamic environmental data, specifically including: quantifying the time environment data to obtain a time environment quantization factor; quantifying the location environment data to obtain a location environment quantization factor; quantifying the business environment data to obtain a business environment quantization factor; and quantifying the system environment data to obtain a system environment quantization factor; and performing a weighted calculation on the time environment quantization factor, the location environment quantization factor, the business environment quantization factor, and the system environment quantization factor based on preset weights to obtain an environmental constraint factor.

[0106] In one embodiment, the pre-training process of the Long Short-Term Memory Network behavior prediction model specifically includes: extracting multiple operation records from the user's historical behavior data to form historical permission usage data; wherein each operation record contains historical operation information and its corresponding historical permission identifier; constructing a permission co-occurrence graph based on the historical permission usage data, wherein the nodes of the permission co-occurrence graph represent different operation permissions, and the edge weights represent the correlation strength of different operation permissions appearing successively in the historical permission usage data; constructing a training sample set based on the historical permission usage data, wherein each training sample in the training sample set includes a historical preceding operation sequence, a historical sequence of operations, and a historical sequence of operations. The training sample identifies subsequent historical operations and the corresponding historical operation permissions. For each preceding historical operation sequence in the training sample, association features related to the permissions contained in the preceding historical operation sequence are extracted from the permission co-occurrence map, and these association features are used as auxiliary input features corresponding to the preceding historical operation sequence. The preceding operation sequence and its corresponding auxiliary input features in the same training sample are used as model input, and the preceding historical operations and their corresponding historical operation permissions are used as prediction targets to train the long short-term memory network behavior prediction model, thereby obtaining a pre-trained long short-term memory network behavior prediction model.

[0107] In one embodiment, the long short-term memory network behavior prediction model includes a sequence processing layer, a vector fusion layer, and a prediction output layer.

[0108] In one embodiment, the user behavior prediction module 203 is used to input the user's historical behavior data, the intent parsing result, and the environmental constraint factors into a pre-trained long short-term memory network behavior prediction model, and output a user behavior prediction result. The user behavior prediction result includes prediction operations, specifically including: inputting the user's historical behavior data, the intent parsing result, and the environmental constraint factors into the pre-trained long short-term memory network behavior prediction model; vectorizing the user's historical behavior data based on the long short-term memory network behavior prediction model to obtain an operation sequence vector; and vectorizing the intent parsing result. The process involves: obtaining an intent feature vector; vectorizing the environmental constraint factors to obtain an environmental feature vector; inputting the operation sequence vector into the sequence processing layer to generate a sequence encoding vector representing the historical behavior context; inputting the sequence encoding vector, the intent feature vector, and the environmental feature vector into the vector fusion layer for fusion processing to form a comprehensive state vector; inputting the comprehensive state vector into the prediction output layer for prediction processing, outputting the predicted operation and the corresponding predicted operation permission, and using the predicted operation and the corresponding predicted operation permission as the user behavior prediction result.

[0109] In one embodiment, the decision module 204 is used to make a decision based on the intent parsing result, the environmental constraint factor, and the user behavior prediction result to determine the target temporary permission. Specifically, this includes: forming a set of permissions to be granted based on the precise intent permission requirement type in the intent parsing result and the predicted operation permission in the user behavior prediction result; comparing the set of permissions to be granted with a static permission baseline based on user roles, and when a conflict is detected, pruning the set of permissions to be granted according to the principle of least privilege to obtain a subset of permissions to be granted; determining the effective conditions of each target permission in the subset of permissions to be granted based on the intent priority in the intent parsing result and the environmental constraint factor, wherein the effective conditions include at least one of the following: effective duration, number of uses, and applicable environmental scope; and generating the target temporary permission based on the subset of permissions to be granted and the effective conditions.

[0110] In one embodiment, the automatic permission revocation module 205 is used to monitor the consistency between the user's actual operation and the predicted operation in real time, and to monitor changes in the dynamic environment data. If the monitoring result meets the preset revocation conditions, the target temporary permission is automatically revoked. Specifically, this includes: comparing the user's actual operation with the predicted operation in real time and calculating the behavior deviation degree; continuously collecting the current dynamic environment data and generating a real-time environment constraint factor corresponding to the current dynamic environment data; if the target temporary permission is not used within its effective duration, the behavior deviation degree exceeds a preset security threshold, or the real-time environment constraint factor does not meet the applicable environment range in the effective conditions of the target temporary permission, then the automatic revocation operation of the target temporary permission is triggered. The automatic revocation operation includes: immediately revoking the target temporary permission and terminating the access capability of the user session or device corresponding to the target temporary permission.

[0111] The aforementioned predictive permission binding device can implement the predictive permission binding method of the above method embodiments. The options in the above method embodiments are also applicable to this embodiment, and will not be detailed here.

[0112] like Figure 3 As shown, Figure 3 This is a schematic diagram of the structure of a computer device provided in this application; it includes a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112 and the memory 113 communicate with each other through the communication bus 114, and the memory 113 is used to store computer programs.

[0113] In one embodiment of this application, when the processor 111 executes the program stored in the memory 113, it implements the predictive permission binding method provided in any of the foregoing method embodiments.

[0114] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0115] Therefore, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the steps of the predictive permission binding method provided in any of the foregoing method embodiments.

[0116] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.

[0117] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0118] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0119] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0120] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0121] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0122] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Since these modifications and variations fall within the scope of the claims and their equivalents, this application also intends to include these modifications and variations.

[0123] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A predictive permission binding method, characterized in that, include: Collect multi-dimensional data, including user intent feature data, dynamic environment data, and user historical behavior data; The user intent feature data is subjected to deep analysis to obtain intent analysis results; and environmental constraint factors are generated based on the dynamic environment data. The user's historical behavior data, the intent parsing results, and the environmental constraint factors are input into a pre-trained long short-term memory network behavior prediction model, and the user behavior prediction results are output, wherein the user behavior prediction results include prediction operations. Based on the precise intent permission request type in the intent parsing results and the predicted operation permissions in the user behavior prediction results, a set of permissions to be granted is formed. The set of permissions to be granted is compared with the static permission baseline based on user roles. When a conflict is detected, the set of permissions to be granted is pruned according to the principle of least privilege to obtain a subset of permissions to be granted. Based on the intent priority in the intent parsing results and the environmental constraint factor, the effective conditions of the pruned permissions are determined, wherein the effective conditions include at least one of the following: effective duration, number of uses, and applicable environmental scope. Based on the subset of permissions to be granted and the effective conditions, a target temporary permission is generated and the target temporary permission is issued to the user session or device. During the validity period of the target temporary permission, the user's actual operation is compared with the predicted operation in real time, and the behavior deviation is quantitatively calculated from the dimensions of operation matching degree, operation timing consistency, and operation target relevance; the current dynamic environment data is continuously collected, and the real-time environment constraint factor corresponding to the current dynamic environment data is generated; if the target temporary permission is not used within the validity period, the behavior deviation exceeds the preset security threshold, or the real-time environment constraint factor does not meet the applicable environment range in the effective conditions of the target temporary permission, the automatic recycling operation of the target temporary permission is triggered, wherein the automatic recycling operation includes: immediately revoking the target temporary permission and terminating the access capability of the user session or device corresponding to the target temporary permission.

2. The method as described in claim 1, characterized in that, The user intent feature data includes user input text, schedule information, project tags, and historical task-permission association records; the deep analysis of the user intent feature data to obtain intent analysis results specifically includes: The user input text is semantically parsed using a natural language processing model to obtain initial intent labels; The initial intent tags are classified based on a multi-dimensional intent classification system to obtain the target intent classification result; When the target intent classification result is a core intent or a related intent, the schedule information and the project tag are combined to perform contextual consistency verification. When the target intent classification result is a risky intent, the historical task-permission association record is invoked for security compliance verification; Based on the verification results, the target intent classification results are corrected to generate accurate intent tags and corresponding accurate intent permission requirement types; Based on the project urgency, task importance, and user role weight associated with the precise intent tags, the precise intent tags are prioritized to determine the intent priority corresponding to the precise intent tags; The precise intent tag, the target intent classification result corresponding to the precise intent tag, the precise intent permission requirement type, and the intent priority are used as the intent parsing result.

3. The method as described in claim 1, characterized in that, The dynamic environment data includes time environment data, location environment data, business environment data, and system environment data; the generation of environmental constraint factors based on the dynamic environment data specifically includes: The time environment data is quantized to obtain a time environment quantization factor; the location environment data is quantized to obtain a location environment quantization factor; the business environment data is quantized to obtain a business environment quantization factor; and the system environment data is quantized to obtain a system environment quantization factor. Based on preset weights, the time environment quantification factor, the location environment quantification factor, the business environment quantification factor, and the system environment quantification factor are weighted and calculated to obtain the environmental constraint factor.

4. The method as described in claim 2, characterized in that, The pre-training process of the long short-term memory network behavior prediction model specifically includes: Multiple operation records are extracted from the user's historical behavior data to form historical permission usage data; each operation record contains historical operation information and its corresponding historical permission identifier. Based on the historical permission usage data, a permission co-occurrence graph is constructed, wherein the nodes of the permission co-occurrence graph represent different operation permissions, and the edge weights represent the correlation strength of the successive occurrence of different operation permissions in the historical permission usage data. A training sample set is constructed based on the historical permission usage data, wherein each training sample in the training sample set includes a historical preceding operation sequence, a historical subsequent operation, and the historical operation permission corresponding to the historical subsequent operation. For each historical preceding operation sequence in the training sample, extract the associated features related to the permissions contained in the historical preceding operation sequence from the permission co-occurrence graph, and use the associated features as the auxiliary input features corresponding to the historical preceding operation sequence; The preceding operation sequence and its corresponding auxiliary input features in the same training sample are used as model input, and the historical subsequent operations and their corresponding historical operation permissions are used as prediction targets to train the long short-term memory network behavior prediction model, thereby obtaining a pre-trained long short-term memory network behavior prediction model.

5. The method as described in claim 4, characterized in that, The Long Short-Term Memory (LSTM) network behavior prediction model includes a sequence processing layer, a vector fusion layer, and a prediction output layer. The user's historical behavior data, the intent parsing results, and the environmental constraint factors are input into the pre-trained LTM network behavior prediction model, and the user behavior prediction result is output. The user behavior prediction result includes a prediction operation, specifically including: The user's historical behavior data, the intent parsing result, and the environmental constraint factors are input into a pre-trained long short-term memory network behavior prediction model. Based on the long short-term memory network behavior prediction model, the user's historical behavior data is vectorized to obtain an operation sequence vector, the intent parsing result is vectorized to obtain an intent feature vector, and the environmental constraint factors are vectorized to obtain an environmental feature vector. The operation sequence vector is input into the sequence processing layer to generate a sequence encoding vector representing the context of historical behavior; The sequence encoding vector, the intent feature vector, and the environment feature vector are input into the vector fusion layer for fusion processing to form a comprehensive state vector. The comprehensive state vector is input into the prediction output layer for prediction processing, and the predicted operation and the corresponding prediction operation permission are output. The predicted operation and the corresponding prediction operation permission are used as the user behavior prediction result.

6. A predictive permission binding device, characterized in that, include: The system includes a data acquisition module, a data parsing module, a user behavior prediction module, a decision-making module, and an automatic permission revoke module. The data acquisition module is used to collect multi-dimensional data, including user intent feature data, dynamic environment data, and user historical behavior data. The data parsing module is used to perform deep analysis on the user intent feature data to obtain intent parsing results; and to generate environmental constraint factors based on the dynamic environment data. The user behavior prediction module is used to input the user's historical behavior data, the intent parsing result, and the environmental constraint factors into a pre-trained long short-term memory network behavior prediction model, and output the user behavior prediction result, wherein the user behavior prediction result includes a prediction operation. The decision-making module is used to form a set of permissions to be granted based on the precise intent permission requirement type in the intent parsing result and the predicted operation permissions in the user behavior prediction result; compare the set of permissions to be granted with the static permission baseline based on user roles, and when a conflict is detected, prune the set of permissions to be granted according to the principle of least privilege to obtain a subset of permissions to be granted; determine the effective conditions of the pruned permissions based on the intent priority in the intent parsing result and the environmental constraint factor, wherein the effective conditions include at least one of the following: effective duration, number of uses, and applicable environmental scope; generate target temporary permissions based on the subset of permissions to be granted and the effective conditions, and issue the target temporary permissions to the user session or device; The automatic permission revocation module is used to compare the user's actual operation with the predicted operation in real time during the validity period of the target temporary permission, and to quantify the behavior deviation degree from the dimensions of operation matching degree, operation timing consistency, and operation target relevance; continuously collect current dynamic environment data, and generate a real-time environment constraint factor corresponding to the current dynamic environment data; if the target temporary permission is not used within the validity period, the behavior deviation degree exceeds a preset security threshold, or the real-time environment constraint factor does not meet the applicable environment range in the effective conditions of the target temporary permission, then the automatic revocation operation of the target temporary permission is triggered, wherein the automatic revocation operation includes: immediately revoking the target temporary permission and terminating the access capability of the user session or device corresponding to the target temporary permission.

7. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, can implement the method as described in any one of claims 1-5.

Images