Authority adaptive adjustment method and device, electronic equipment and storage medium

Abstract

The invention provides a permission adaptive adjustment method and device, electronic equipment and a storage medium, and the method comprises the steps: responding to an access request initiated by a user for a protected resource, and collecting multi-dimensional scene features associated with the access request in real time; determining a risk assessment result of the access request based on the multi-dimensional scene features; inputting a state vector jointly formed by the multi-dimensional scene features and the risk assessment result into a reinforcement learning decision model, and outputting a corresponding permission adjustment action by the reinforcement learning decision model; and adjusting the access permission of the access request according to the permission adjustment action. Thus, the system can automatically adjust the authority strategy according to the specific scene and the risk level of each access, timely protection can be achieved when abnormal access occurs, normal service operation is prevented from being excessively limited, and therefore effective balance between safety management and control and user experience is achieved in a complex and changeable actual environment.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to a method, apparatus, electronic device and storage medium for adaptive permission adjustment. Background Technology

[0002] In the field of information technology, secure and reliable access control of system resources is a fundamental and critical requirement. How to accurately determine a user's access permissions in a specific scenario has always been a key research focus in the industry.

[0003] The mainstream solution currently adopts a role-based access control model. This solution authorizes users by pre-assigning fixed roles and binding access permissions to these roles. When a user initiates an access request, the system queries the user's assigned role and, based on the fixed mapping relationship between roles and permissions, decides whether to grant the user access to the target resource.

[0004] However, the existing permission granting mechanism is static and fixed, and cannot be dynamically and adaptively adjusted according to the specific scenario of the access request and its potential risks, making it difficult to balance security and user experience in complex and ever-changing real-world application environments. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and storage medium for adaptive permission adjustment to solve the problem that the permission granting mechanism in the prior art is static and fixed, and cannot be dynamically and adaptively adjusted according to the specific scenario of the access request and its potential risks, making it difficult to balance security and user experience in complex and ever-changing real-world application environments.

[0006] Firstly, this application provides a method for adaptive permission adjustment, including: In response to a user's request to access protected resources, multi-dimensional scene features associated with the access request are collected in real time. Based on the aforementioned multi-dimensional scenario characteristics, the risk assessment result of the access request is determined; The state vector, which is composed of the multi-dimensional scene features and the risk assessment results, is input into the reinforcement learning decision model, and the reinforcement learning decision model outputs the corresponding permission adjustment action. The access permissions of the access request are adjusted according to the permission adjustment action.

[0007] In one possible implementation, determining the risk assessment result of the access request based on the multi-dimensional scenario features includes: The multi-dimensional scene features are preprocessed to obtain a comprehensive feature vector; Calculate the similarity between the comprehensive feature vector and the feature vectors in the preset risk feature library; The risk probability is determined based on the similarity, and the risk probability is used as the risk assessment result.

[0008] In one possible implementation, the method further includes: Monitor the results of the operation after adjusting the access permissions of the access request; Based on the results of the operation, a reward value is generated; The reinforcement learning decision model is updated using the reward value.

[0009] In one possible implementation, the operation result includes risk event triggering information and user operation experience data. Generating a reward value based on the operation result includes: Determine the security assessment value based on the triggering circumstances of the aforementioned risk events; Based on the operation experience data, the user interference level is determined, wherein the operation experience data includes the additional operation time caused by permission adjustments, and / or the number of operation failures; The reward value is calculated based on the security assessment value and the user interference level.

[0010] In one possible implementation, adjusting the access permissions of the access request according to the permission adjustment action includes: When the permission adjustment action is a downgrade of the resource operation type, identify the first operation type intended to be performed in the access request; Map the first operation type to the second operation type, wherein the permission level of the second operation type is lower than that of the first operation type; The access request is processed based on the second operation type.

[0011] In one possible implementation, adjusting the access permissions of the access request according to the permission adjustment action includes: If the permission adjustment action triggers secondary verification, the access request is paused, and a verification request is generated and sent to the user. Upon receiving correct verification information that matches the verification request, the access request is resumed.

[0012] In one possible implementation, the multi-dimensional scene features include: behavioral features, wherein the real-time acquisition of multi-dimensional scene features associated with the access request includes: Record a series of requests initiated by the user in the current session to form a real-time operation sequence; Based on the real-time operation sequence, the operation frequency is determined; Calculate the similarity between the real-time operation sequence and the user's historical operation sequence during the same period to obtain the historical operation similarity; The real-time operation sequence, the operation frequency, and the historical operation similarity are collectively used as the behavioral features.

[0013] Secondly, this application provides a permission adaptive adjustment device, comprising: The data acquisition module is used to respond to user-initiated access requests to protected resources and collect multi-dimensional scene features associated with the access requests in real time. The determination module is used to determine the risk assessment result of the access request based on the multi-dimensional scenario characteristics; The input module is used to input the state vector formed by the multi-dimensional scene features and the risk assessment results into the reinforcement learning decision model, and the reinforcement learning decision model outputs the corresponding permission adjustment action. The adjustment module is used to adjust the access permissions of the access request according to the permission adjustment action.

[0014] In one possible implementation, the determining module is specifically used for: The multi-dimensional scene features are preprocessed to obtain a comprehensive feature vector; Calculate the similarity between the comprehensive feature vector and the feature vectors in the preset risk feature library; The risk probability is determined based on the similarity, and the risk probability is used as the risk assessment result.

[0015] In one possible implementation, the device further includes a feedback module for: Monitor the results of the operation after adjusting the access permissions of the access request; Based on the results of the operation, a reward value is generated; The reinforcement learning decision model is updated using the reward value.

[0016] In one possible implementation, the operation result includes risk event triggering status and user operation experience data, and the feedback module is specifically used for: Determine the security assessment value based on the triggering circumstances of the aforementioned risk events; Based on the operation experience data, the user interference level is determined, wherein the operation experience data includes the additional operation time caused by permission adjustments, and / or the number of operation failures; The reward value is calculated based on the security assessment value and the user interference level.

[0017] In one possible implementation, the adjustment module is specifically used for: When the permission adjustment action is a downgrade of the resource operation type, identify the first operation type intended to be performed in the access request; Map the first operation type to the second operation type, wherein the permission level of the second operation type is lower than that of the first operation type; The access request is processed based on the second operation type.

[0018] In one possible implementation, the adjustment module is further configured to: If the permission adjustment action triggers secondary verification, the access request is paused, and a verification request is generated and sent to the user. Upon receiving correct verification information that matches the verification request, the access request is resumed.

[0019] In one possible implementation, the multi-dimensional scene features include: behavioral features, and the acquisition module is specifically used for: Record a series of requests initiated by the user in the current session to form a real-time operation sequence; Based on the real-time operation sequence, the operation frequency is determined; Calculate the similarity between the real-time operation sequence and the user's historical operation sequence during the same period to obtain the historical operation similarity; The real-time operation sequence, the operation frequency, and the historical operation similarity are collectively used as the behavioral features.

[0020] Thirdly, this application provides an apparatus comprising: a processor and a memory, the processor being configured to execute a permission adaptive adjustment program stored in the memory to implement the permission adaptive adjustment method described in any one of the first aspects.

[0021] Fourthly, this application provides a storage medium storing one or more programs that can be executed by one or more processors to implement the permission adaptive adjustment method described in any one aspect.

[0022] Compared with the prior art, the technical solution provided in this application has the following advantages: First, the method provided in this application collects multi-dimensional scenario features related to access requests in real time, breaking through the limitation of traditional permission systems that rely solely on user roles. This provides a comprehensive real-time data foundation for permission decisions. Then, risk assessment results are generated based on these features, and the scenario features and risk assessment results are combined to form a state vector, which is input into a reinforcement learning decision model. The model outputs permission adjustment actions that match the current risk level. Finally, access permissions are adjusted in real time according to the output permission adjustment actions, achieving differentiated permission control. Through this solution, the system can automatically adjust permission policies according to the specific scenario and risk level of each access, providing timely protection in case of abnormal access while avoiding excessive restrictions on normal business operations. This achieves an effective balance between security control and user experience in complex and ever-changing real-world environments. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0024] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0026] Figure 1 A flowchart illustrating an embodiment of a permission adaptive adjustment method provided in this application; Figure 2 A flowchart illustrating an embodiment of another permission adaptive adjustment method provided in this application; Figure 3 A flowchart illustrating another embodiment of the permission adaptive adjustment method provided in this application; Figure 4 A flowchart illustrating an adaptive permission adjustment method provided in this application embodiment; Figure 5 A block diagram illustrating an embodiment of a permission adaptive adjustment device provided in this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0029] To address the technical problem that existing permission granting mechanisms are static and fixed, unable to dynamically and adaptively adjust according to the specific scenario and potential risks of access requests, thus making it difficult to balance security and user experience in complex and ever-changing real-world application environments, this application provides a permission adaptive adjustment method. The system can automatically adjust the permission policy according to the specific scenario and risk level of each access, providing timely protection in case of abnormal access while avoiding excessive restrictions on normal business operations, thereby achieving an effective balance between security control and user experience in complex and ever-changing real-world environments.

[0030] Figure 1 This is a flowchart illustrating an embodiment of a permission adaptive adjustment method provided in this application. Figure 1 As shown, the method includes the following steps: Step 101: In response to a user's request to access the protected resource, collect multi-dimensional scene features associated with the access request in real time.

[0031] Protected resources refer to data, files, APIs (Application Programming Interfaces), or functional modules in the system that require access control.

[0032] Multi-dimensional scenario features: refers to a data set collected from multiple independent categories such as environment, behavior, and resources, used to comprehensively describe the specific context of an access request.

[0033] In this embodiment, when a user attempts to access a protected resource (e.g., a database query API containing customer bank card information), the access request is intercepted by a filter component deployed at the gateway or application layer, and the API is invoked to extract data in real time from the following dimensions: Environmental characteristics: including login time (accurate to the minute), IP (Internet Protocol Address) location (country / city / administrative region), network type (internal network / external network / WIFI / 4G), and device fingerprint (hardware serial number hash, operating system version, browser fingerprint); Behavioral characteristics: including operation sequence (e.g., "login → query → export → modify"), operation frequency (number of requests per unit time), and historical operation similarity (e.g., matching degree with operations in the same period of the past 30 days); Resource characteristics: including the type of resource requested for access (e.g., "user sensitive data", "ordinary business data") and operation type (view / modify / delete / export). These characteristics are encapsulated into a unified structured object (e.g., SceneFeature) and stored in a distributed cache (e.g., Redis) for subsequent steps, thereby providing a comprehensive and dynamic data foundation for risk assessment that transcends the user's role.

[0034] Step 102: Based on the multi-dimensional scenario characteristics, determine the risk assessment result of the access request.

[0035] Risk assessment result: refers to a quantitative value used to characterize the potential security threat level of the current access request.

[0036] In this embodiment, the system reads the SceneFeature object from the cache and performs feature preprocessing: non-numerical features such as IP address and operation type are one-hot encoded and converted into binary vectors in numerical form; numerical features such as login time and operation frequency are normalized and mapped to the range of 0 to 1. This process converts the original features into a 100-200 dimensional pure numerical feature vector. Subsequently, the system calculates the cosine similarity between this feature vector and samples in a preset "risk benchmark library" (which stores feature vectors and risk levels of historical risk events), and outputs a risk probability P between 0 and 1 as the risk assessment result based on the matching degree, thus achieving accurate quantification of security risks.

[0037] Step 103: Input the state vector formed by the multi-dimensional scene features and the risk assessment results into the reinforcement learning decision model, and the reinforcement learning decision model outputs the corresponding permission adjustment action.

[0038] State vector: refers to a comprehensive data structure composed of preprocessed multi-dimensional scene feature vectors and risk assessment results, used to fully describe the system state when the reinforcement learning decision model makes a decision.

[0039] Reinforcement learning decision-making model: refers to a machine learning model in which an agent interacts with the environment and optimizes its decision-making strategy based on the reward signals it receives.

[0040] Permission adjustment action: refers to the specific instructions output by the reinforcement learning decision model regarding how to adjust user access permissions.

[0041] In this embodiment, the system constructs a state vector S from the feature vector generated in step 102 and the risk probability P, and inputs it into a reinforcement learning decision model trained with the Q-Learning algorithm. This model internally maintains a Q-table, storing the long-term value Q-values ​​of various permission adjustment actions (including maintaining permissions, downgrading permissions, freezing high-risk permissions, triggering secondary verification, etc.) under different state vectors. The model queries the Q-table based on the current state S, selects and outputs the action with the highest value, thereby transforming permission decision-making from static rule matching to dynamic intelligent decision-making based on state awareness.

[0042] It should be noted that the permission adjustment actions output by the reinforcement learning decision model in this embodiment are based on a training dataset constructed from historical access data and risk events. Once the permission adjustment process corresponding to the current access request is fully executed, the system will automatically record the multi-dimensional scenario characteristics, risk assessment results, permission adjustment actions, and final execution effects (such as operational compliance feedback, security event trigger status, etc.) of this access. This complete information will be stored in the training dataset as sample data for the next iteration of the reinforcement learning model, continuously optimizing the model's decision-making accuracy and dynamic adaptability to permission policies, thus achieving a closed-loop evolution of the security management system.

[0043] Step 104: Adjust the access permissions of the access request according to the permission adjustment action.

[0044] In this embodiment, the system intercepts access requests to the protected resource using Java dynamic proxy technology. Differential control is executed based on the specific action output in step 103, generally including the following four cases: 1. If the action is to maintain the current permissions, the system will directly allow the access request, and the user will enjoy all the permissions inherent to their role. This is suitable for low-risk scenarios and ensures a seamless and smooth user experience.

[0045] 2. If the action is a downgrade of permissions, the high-risk operation type in the request (such as "delete" or "export") will be mapped and replaced with a low-risk operation type (such as "modify" or "view"), or the full data access permission will be restricted to a partial data access permission before being allowed, thus achieving fine-grained and appropriate reduction of permissions.

[0046] 3. If the action is to freeze high-risk permissions, the system will completely prohibit the specific dangerous operations in the request (such as prohibiting any form of "export" or "delete"), but may allow other low-risk operations (such as "view") to continue to be executed, thereby accurately cutting off the threat path when the risk is high.

[0047] 4. If the action triggers two-factor authentication (A4), the request execution process is paused, and the SMS interface or authentication application is called to send a verification code to the user. The original request is only resumed after the user submits the correct verification information and passes the verification, thus adding a security barrier for high-risk operations.

[0048] Through the above methods, this step achieves a fundamental shift in access control from a binary "allow / deny" decision to a multi-layered, progressive management approach.

[0049] The technical solution provided in this application firstly collects multi-dimensional scenario features related to access requests in real time, breaking through the limitations of traditional permission systems that rely solely on user roles. This provides a comprehensive real-time data foundation for permission decisions. Then, risk assessment results are generated based on these features, and the scenario features and risk assessment results are combined to form a state vector, which is input into a reinforcement learning decision model. The model outputs permission adjustment actions that match the current risk level. Finally, access permissions are adjusted in real time according to the output permission adjustment actions, achieving differentiated permission control. Through this solution, the system can automatically adjust permission policies based on the specific scenario and risk level of each access, providing timely protection in case of abnormal access while avoiding excessive restrictions on normal business operations. This achieves an effective balance between security control and user experience in complex and ever-changing real-world environments.

[0050] In one embodiment, the multi-dimensional scene features collected in real time in step 101 include behavioral features, which are collected through the following steps: recording a series of requests initiated by the user in the current session to form a real-time operation sequence; determining the operation frequency based on the real-time operation sequence; calculating the similarity between the real-time operation sequence and the user's historical operation sequence to obtain historical operation similarity; and using the real-time operation sequence, the operation frequency, and the historical operation similarity together as the behavioral features.

[0051] Current session: The complete operation cycle from a user's successful login to a secure logout.

[0052] Real-time operation sequence: refers to the chain of operations formed by a series of access requests initiated by the user to the system in the current session, arranged in chronological order of occurrence. Its specific form is, for example, "login account -> query customer information -> modify contact details -> export data report".

[0053] Operation frequency: refers to the average number of requests made by a user within a specific unit of time (e.g., per minute or per hour) based on the real-time operation sequence.

[0054] Historical concurrent operation sequence: refers to the typical representative of the user's habitual operation sequence in the history of multiple time periods with the same or similar time attributes as the current time (such as the same working day in the past 30 days). It can be obtained through statistical modeling.

[0055] Historical operation similarity: refers to the quantitative value of the matching degree between the current real-time operation sequence and the historical operation sequence, calculated by a specific string similarity algorithm or sequence matching algorithm (such as an algorithm based on edit distance or longest common subsequence). It is usually expressed as a percentage or a value between 0 and 1.

[0056] In this embodiment, the system continuously monitors and records all access requests issued by the user within a valid session period through a background service, and sorts them according to their timestamps to form a real-time operation sequence. Subsequently, the system calculates the real-time operation frequency based on the total number of requests contained in this sequence within a set statistical time window (such as the most recent 5 minutes). At the same time, it accesses the user behavior log database, retrieves the corresponding historical operation sequences of the same period, and uses a similarity algorithm to calculate the matching degree between the current sequence and the historical sequences. Finally, the real-time operation sequence (as the original behavior trajectory), operation frequency (as the behavior intensity indicator), and historical operation similarity (as the behavior anomaly indicator) are combined together to form a set of behavioral features that comprehensively describe the user's dynamic behavior pattern.

[0057] This solution enables the system to accurately capture and quantify the dynamic changes and abnormal deviations in user behavior, providing key dynamic behavioral insights that are completely lacking in traditional static permission solutions for subsequent risk assessment. This significantly improves the sensitivity and accuracy of identifying covert security threats such as account theft and internal violations.

[0058] Figure 2 A flowchart illustrating an embodiment of another permission adaptive adjustment method provided in this application. Figure 2 The process shown is in Figure 1 Based on the illustrated process, the following steps are included: Step 201: Preprocess the multi-dimensional scene features to obtain a comprehensive feature vector.

[0059] Comprehensive feature vector: refers to the transformation of original scene features of different types and dimensions into a unified, purely numerical high-dimensional vector through standardization processing.

[0060] In this embodiment, the system reads the encapsulated multi-dimensional scene features (such as SceneFeature objects) and performs standardized encoding processing on them: First, non-numerical features such as "IP location" and "operation type" are one-hot encoded and converted into binary vectors. For example, "delete" is encoded as [0,0,1] and "modify" is encoded as [0,1,0]. Second, numerical features such as "login timestamp" and "operation frequency" are subjected to max-min normalization processing, linearly mapping them to the [0,1] interval. Finally, all encoded features are concatenated into a 100-200 dimensional numerical comprehensive feature vector, providing standardized data input for subsequent similarity calculations.

[0061] Step 202: Calculate the similarity between the comprehensive feature vector and the feature vectors in the preset risk feature library.

[0062] Pre-built risk feature library: refers to a pre-built and continuously updated database that stores the feature vectors and risk labels corresponding to historically confirmed risk events.

[0063] In this embodiment, the system accesses the risk feature database, which contains feature vectors of a large number of historical risk events (such as malicious logins, data theft, etc.). The system uses a cosine similarity algorithm to calculate the cosine value of the angle between the current request's comprehensive feature vector and each or more representative risk feature vectors in the risk database. This value is between -1 and 1. The larger the value, the closer the vector directions are, meaning the higher the similarity between the current feature pattern and the historical risk pattern.

[0064] Step 203: Determine the risk probability based on the similarity, and set the risk probability as the risk assessment result.

[0065] Risk probability: refers to a value calculated based on feature similarity, used to quantify the likelihood that the current access request is a risk event. Its value ranges from 0 to 1, and the higher the value, the higher the risk level.

[0066] In this embodiment, the system uses a preset mapping rule to convert the calculated similarity into a risk probability. Specifically, the system directly maps the highest cosine similarity value calculated in step 202 to a risk probability P in the 0-1 interval using a linear or nonlinear function. For example, when the highest similarity is 0.8, the risk probability P is directly mapped to 0.8; or a piecewise function is used, mapping low risk (P<0.3) when the similarity is below 0.3, linear mapping when the similarity is between 0.3 and 0.7, and high risk (P>0.7) when the similarity is above 0.7. Furthermore, the system also supports a weighted calculation method for multi-feature vector matching, that is, simultaneously calculating the similarity between the current feature vector and multiple historical risk feature vectors in the risk feature database, and taking the weighted average of the top k highest similarities as the final risk probability P.

[0067] pass Figure 2 As shown in the process, the system establishes a deterministic mathematical relationship from feature similarity to risk probability, transforming abstract similarity indicators into probability values ​​with clear security significance. This provides an intuitive and reliable quantitative basis for subsequent permission decisions, enabling the system to implement differentiated security policies based on precise risk probability values. This avoids excessive restrictions on low-risk operations while ensuring effective control over high-risk access.

[0068] Based on the permission decision-making mechanism driven by the above-mentioned quantitative risk assessment results, the following detailed explanation of the execution process of permission adjustment actions is provided through specific examples: In one embodiment, step 104 may specifically include the following steps: when the permission adjustment action is to downgrade the resource operation type, identify the first operation type intended to be performed in the access request; map the first operation type to a second operation type, wherein the permission level of the second operation type is lower than that of the first operation type; and process the access request based on the second operation type.

[0069] First operation type: refers to the high-privilege level operation originally intended to be performed in the access request, such as "delete" or "export".

[0070] Second operation type: refers to the system's preset alternative operation that has a lower permission level than the first operation type, such as "modify" or "view".

[0071] Permission levels: refers to the classification and sorting of different operation types according to their risk level and security impact. Among them, the permission level of deletion operation is higher than that of modification operation, and the permission level of modification operation is higher than that of view operation.

[0072] In this embodiment, after the system intercepts the access request using Java dynamic proxy technology, it first parses the request parameters to identify the first operation type that the user intends to perform; then it queries a predefined permission downgrade mapping table to map the first operation type to the corresponding second operation type, for example, mapping the "delete" operation in the "delete order" request to the "modify" operation; finally, the system re-encapsulates the modified request parameters and submits them to the backend business system for processing.

[0073] This solution enables precise control over high-risk operations, ensuring data security while maintaining the availability of business functions. It avoids business interruptions caused by completely prohibiting operations and effectively prevents data security risks that high-risk operations may bring, significantly improving the granularity of access control and user experience.

[0074] In another embodiment, step 104 may further include the following steps: if the permission adjustment action triggers secondary verification, suspend the execution of the access request and generate a verification request to send to the user; after receiving the correct verification information that matches the verification request, resume the execution of the access request.

[0075] Verification request: refers to a system-generated instruction message that requires the user to perform additional identity verification, including one-time verification credentials.

[0076] Correct verification information: refers to valid authentication data provided by the user that completely matches the credentials in the verification request, such as a verification code.

[0077] In this embodiment, after the system intercepts the access request through a dynamic proxy, it immediately suspends the current request processing flow and simultaneously calls the integrated SMS gateway interface to send a verification request containing a 6-digit verification code to the user's registered mobile phone number. The system starts a timer to wait for user input. When the system receives the verification code submitted by the user through the front-end interface within a preset time, and the verification code is completely consistent with the sent verification code, the system automatically resumes the execution of the previously suspended original access request.

[0078] This solution establishes an effective security interception mechanism in medium- to high-risk scenarios. Through lightweight secondary verification, it ensures the security of sensitive operations while avoiding the impact of mandatory verification throughout the process on user experience, achieving the best balance between security control and ease of operation.

[0079] Figure 3 A flowchart illustrating another embodiment of the permission adaptive adjustment method provided in this application. Figure 3 The process shown is in Figure 1 Based on the illustrated process, the following steps are included: Step 301: Monitor the results of the operation after adjusting the access permissions of the access request.

[0080] Operation results: refers to the quantitative data about security status and user experience recorded by the system after the permission adjustment action is executed.

[0081] In this embodiment, after completing the permission adjustment, the system initiates a monitoring cycle to continuously collect the following data: For security, it records whether any risk events have occurred; for user experience, it records the additional operation time and number of operation failures caused by the permission adjustment. This data is encapsulated into structured logs and saved to the training database. By implementing this scheme, the system establishes a complete decision-making effectiveness evaluation system, providing a reliable feedback data foundation for model optimization.

[0082] Step 302: Generate a reward value based on the operation result.

[0083] Reward value: refers to a quantitative evaluation index calculated based on the operation results and used to guide the optimization of reinforcement learning models.

[0084] In this embodiment of the application, the operation result includes the risk event triggering situation and the user's operation experience data. Step 302 may specifically include the following steps: determining a security assessment value based on the risk event triggering situation; determining the user interference level based on the operation experience data, wherein the operation experience data includes the additional operation time caused by permission adjustment and / or the number of operation failures; and calculating the reward value based on the security assessment value and the user interference level.

[0085] Security Assessment Value: This refers to a numerical security assessment result assigned based on the occurrence of risk events. A positive value indicates a good security status, while a negative value indicates the existence of security threats. User Interference Level: This is a quantitative measure of the impact on user experience caused by permission adjustments. A higher value indicates greater interference with users.

[0086] In this embodiment, the system analyzes operation result data and first determines a security assessment value based on risk event monitoring records: if no risk event occurs after permission adjustment, a positive score is assigned; if a risk event occurs, a negative score is assigned. Simultaneously, the system calculates the additional operation time and number of operation failures caused by permission adjustments, and then uses normalization to calculate the user interference degree. Finally, the system weights the security assessment value and the user interference degree according to preset weights to generate the final reward value. Through this scheme, the system establishes a dual-dimensional evaluation mechanism that considers both security and user experience, enabling the reinforcement learning model to simultaneously learn the security protection effect and the degree of user impact. This guides the model to converge to the optimal permission strategy that effectively controls risks while minimizing user interference, achieving an intelligent balance between security control and user experience.

[0087] Step 303: Update the reinforcement learning decision model using the reward value.

[0088] In this embodiment, the system uses the current state vector, the executed permission adjustment action, the obtained reward value, and the subsequent state as training data, and uses the temporal difference algorithm to update the model decision parameters.

[0089] pass Figure 3 As shown in the process, the system constructs a complete self-optimization closed loop, enabling the permission decision-making strategy to continuously adapt to changes in user behavior and new risk patterns, thereby continuously improving the user experience while ensuring security and realizing the autonomous evolution of the permission management system.

[0090] To facilitate understanding of the reinforcement learning-based dynamic permission adaptive adjustment method provided in this application, the overall process and specific implementation of this method are described in detail below with reference to the accompanying drawings. Figure 4 As shown, this method constructs a dynamic closed loop of "scene feature collection - risk quantification - permission decision - execution feedback", enabling the system to autonomously learn the relationship between user behavior patterns and risks, and achieve adaptive adjustment of permissions.

[0091] 1. Scene Feature Acquisition When a user initiates an access request to protected resources, the system collects multi-dimensional scene features in real time, including: Environmental characteristics: Login time (accurate to the minute), IP location (country / city / administrative region), network type (internal network / external network / WIFI / 4G), device fingerprint (hardware serial number hash value, operating system version, browser fingerprint, etc.); Behavioral characteristics: operation sequence (such as continuous operations of "login → query → export → modify"), operation frequency (number of requests per unit time), and historical operation similarity (the degree of matching with operations in the same period of the past 30 days). Resource characteristics: The type of resource requested (such as sensitive user data, ordinary business data, etc.) and the type of operation (view, modify, delete, export, etc.); During the data collection process, the system intercepts user requests, calls the system application programming interface (API) to extract feature data in real time, and encapsulates it into structured feature objects (such as SceneFeature objects) and stores them in a distributed cache (such as Redis) for subsequent processing.

[0092] 2. Quantification of Risk Status The system standardizes the collected multi-dimensional scene features: Non-numerical features (such as IP address location and operation type) are encoded using one-hot encoding and converted into binary vectors; Numerical features (such as login timestamps and operation frequency) are normalized and mapped to the 0-1 interval; The above processing generates 100-200 dimensional numerical feature vectors.

[0093] Based on this feature vector, the system calculates its cosine similarity with the feature vectors of historical risk events in the preset risk feature library, and generates a quantified risk probability P (0≤P≤1) based on the similarity matching result, where a higher P value indicates a higher level of current operational risk.

[0094] 3. Strengthen learning decision-making The system combines the scene feature vector and the risk probability P to form a state vector S, which is then input into the reinforcement learning decision model. This model, based on the Q-Learning algorithm, includes the following elements: State space: A state vector S consisting of scene feature vectors and risk probabilities; Action space: Includes four permission adjustment actions: maintain current permissions (A1), downgrade permissions (A2), freeze high-risk permissions (A3), and trigger two-factor authentication (A4); Reward function: Defined as R = α × S_safe - β × C_exp, where S_safe represents the security score (1 point for no risk event, -1 point for a risk event), C_exp represents the user experience loss (such as time spent on secondary verification, operation failure due to permission downgrade, etc., with a value of 0-0.5), and α and β are weighting coefficients (default α=0.6, β=0.4). The values ​​of α and β can be adjusted according to the actual situation. For example, in financial transaction systems with extremely high security requirements, α can be increased to 0.8 and β can be decreased to 0.2, making the model more inclined to trigger strict measures such as secondary verification or permission downgrade; while in online reading applications that prioritize user experience, α can be decreased to 0.4 and β can be increased to 0.6, making the model maintain the current permissions as much as possible and reduce interference with normal user operations. During real-time decision-making, the agent queries the Q table based on the current state S and selects the action A with the highest value as the permission adjustment strategy.

[0095] 4. Permission Execution and Feedback The system intercepts resource access requests using Java dynamic proxy technology and executes the permission adjustment actions output by the reinforcement learning decision model. If the action is a permission downgrade (A2), then the high-risk operation type (such as "delete") will be mapped to the low-risk operation type (such as "modify"); If the action triggers two-factor authentication (A4), then the request execution is paused, a verification request is sent to the user, and execution resumes after successful verification. After execution, the system monitors the operation results, including the occurrence of risk events and user experience data, calculates the reward value R, and uses the temporal difference algorithm to update the Q-table parameters of the reinforcement learning decision model to achieve continuous optimization of the model.

[0096] This method achieves dynamic self-optimization of access control through the aforementioned closed-loop process. The system can autonomously quantify risks based on real-time scenario characteristics and output the optimal access control policy based on a reinforcement learning model. While ensuring security, it minimizes interference with normal operations, effectively solving the technical problem that traditional static access control mechanisms struggle to balance security and user experience in complex and ever-changing environments.

[0097] Figure 5 This is a block diagram illustrating an embodiment of a permission adaptive adjustment device provided in this application. Figure 5 As shown, the device includes: The acquisition module 51 is used to respond to a user's access request for protected resources and collect multi-dimensional scene features associated with the access request in real time. The determination module 52 is used to determine the risk assessment result of the access request based on the multi-dimensional scenario features; Input module 53 is used to input the state vector formed by the multi-dimensional scene features and the risk assessment results into the reinforcement learning decision model, and the reinforcement learning decision model outputs the corresponding permission adjustment action. The adjustment module 54 is used to adjust the access permissions of the access request according to the permission adjustment action.

[0098] In one possible implementation, the determining module is specifically used for: The multi-dimensional scene features are preprocessed to obtain a comprehensive feature vector; Calculate the similarity between the comprehensive feature vector and the feature vectors in the preset risk feature library; The risk probability is determined based on the similarity, and the risk probability is used as the risk assessment result.

[0099] In one possible implementation, the device further includes a feedback module for: Monitor the results of the operation after adjusting the access permissions of the access request; Based on the results of the operation, a reward value is generated; The reinforcement learning decision model is updated using the reward value.

[0100] In one possible implementation, the operation result includes risk event triggering status and user operation experience data, and the feedback module is specifically used for: Determine the security assessment value based on the triggering circumstances of the aforementioned risk events; Based on the operation experience data, the user interference level is determined, wherein the operation experience data includes the additional operation time caused by permission adjustments, and / or the number of operation failures; The reward value is calculated based on the security assessment value and the user interference level.

[0101] In one possible implementation, the adjustment module is specifically used for: When the permission adjustment action is a downgrade of the resource operation type, identify the first operation type intended to be performed in the access request; Map the first operation type to the second operation type, wherein the permission level of the second operation type is lower than that of the first operation type; The access request is processed based on the second operation type.

[0102] In one possible implementation, the adjustment module is further configured to: If the permission adjustment action triggers secondary verification, the access request is paused, and a verification request is generated and sent to the user. Upon receiving correct verification information that matches the verification request, the access request is resumed.

[0103] In one possible implementation, the multi-dimensional scene features include: behavioral features, and the acquisition module is specifically used for: Record a series of requests initiated by the user in the current session to form a real-time operation sequence; Based on the real-time operation sequence, the operation frequency is determined; Calculate the similarity between the real-time operation sequence and the user's historical operation sequence during the same period to obtain the historical operation similarity; The real-time operation sequence, the operation frequency, and the historical operation similarity are collectively used as the behavioral features.

[0104] like Figure 6 As shown in the figure, this application provides a device including a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114. Memory 113 is used to store computer programs; In one embodiment of this application, when the processor 111 executes a program stored in the memory 113, it implements the permission adaptive adjustment method provided in any of the foregoing method embodiments, including: In response to a user's request to access protected resources, multi-dimensional scene features associated with the access request are collected in real time. Based on the aforementioned multi-dimensional scenario characteristics, the risk assessment result of the access request is determined; The state vector, which is composed of the multi-dimensional scene features and the risk assessment results, is input into the reinforcement learning decision model, and the reinforcement learning decision model outputs the corresponding permission adjustment action. The access permissions of the access request are adjusted according to the permission adjustment action.

[0105] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the permission adaptive adjustment method provided in any of the foregoing method embodiments.

[0106] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0107] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0108] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0109] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for adaptively adjusting permissions, characterized in that, The method includes: In response to a user's request to access protected resources, multi-dimensional scene features associated with the access request are collected in real time. Based on the aforementioned multi-dimensional scenario characteristics, the risk assessment result of the access request is determined; The state vector, which is composed of the multi-dimensional scene features and the risk assessment results, is input into the reinforcement learning decision model, and the reinforcement learning decision model outputs the corresponding permission adjustment action. The access permissions of the access request are adjusted according to the permission adjustment action.

2. The method according to claim 1, characterized in that, The process of determining the risk assessment result of the access request based on the multi-dimensional scenario features includes: The multi-dimensional scene features are preprocessed to obtain a comprehensive feature vector; Calculate the similarity between the comprehensive feature vector and the feature vectors in the preset risk feature library; The risk probability is determined based on the similarity, and the risk probability is used as the risk assessment result.

3. The method according to claim 1, characterized in that, The method further includes: Monitor the results of the operation after adjusting the access permissions of the access request; Based on the results of the operation, a reward value is generated; The reinforcement learning decision model is updated using the reward value.

4. The method according to claim 3, characterized in that, The operation results include risk event triggering information and user operation experience data. Generating a reward value based on the operation results includes: Determine the security assessment value based on the triggering circumstances of the aforementioned risk events; Based on the operation experience data, the user interference level is determined, wherein the operation experience data includes the additional operation time caused by permission adjustments, and / or the number of operation failures; The reward value is calculated based on the security assessment value and the user interference level.

5. The method according to claim 1, characterized in that, The step of adjusting the access permissions of the access request according to the permission adjustment action includes: When the permission adjustment action is a downgrade of the resource operation type, identify the first operation type intended to be performed in the access request; Map the first operation type to the second operation type, wherein the permission level of the second operation type is lower than that of the first operation type; The access request is processed based on the second operation type.

6. The method according to claim 1, characterized in that, The step of adjusting the access permissions of the access request according to the permission adjustment action includes: If the permission adjustment action triggers secondary verification, the access request is paused, and a verification request is generated and sent to the user. Upon receiving correct verification information that matches the verification request, the access request is resumed.

7. The method according to claim 1, characterized in that, The multi-dimensional scene features include: behavioral features; the real-time collection of multi-dimensional scene features associated with the access request includes: Record a series of requests initiated by the user in the current session to form a real-time operation sequence; Based on the real-time operation sequence, the operation frequency is determined; Calculate the similarity between the real-time operation sequence and the user's historical operation sequence during the same period to obtain the historical operation similarity; The real-time operation sequence, the operation frequency, and the historical operation similarity are collectively used as the behavioral features.

8. A permission adaptive adjustment device, characterized in that, The device includes: The data acquisition module is used to respond to user-initiated access requests to protected resources and collect multi-dimensional scene features associated with the access requests in real time. The determination module is used to determine the risk assessment result of the access request based on the multi-dimensional scenario characteristics; The input module is used to input the state vector formed by the multi-dimensional scene features and the risk assessment results into the reinforcement learning decision model, and the reinforcement learning decision model outputs the corresponding permission adjustment action. The adjustment module is used to adjust the access permissions of the access request according to the permission adjustment action.

9. An electronic device, characterized in that, include: A processor and a memory, the processor being configured to execute a permission adaptive adjustment program stored in the memory to implement the permission adaptive adjustment method according to any one of claims 1-7.

10. A storage medium, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the permission adaptive adjustment method according to any one of claims 1-7.

Images