Multi-dimensional system parameter configuration method and system based on authority management

Abstract

The invention relates to the technical field of access control, in particular to a multi-dimensional system parameter configuration method and system based on authority management, and the method comprises the following steps: analyzing a configuration request and extracting authority identification resource sensitivity level task type environment credibility, and then completing normalization inference to generate multi-dimensional features; the method comprises the following steps: constructing a multi-dimensional feature set, splitting rule conditions and carrying out clustering matching to obtain fragments, comparing interval endpoints and calculating a difference division fragment result, accumulating weights based on a chain state and carrying out difference compensation to form a dynamic decision, and combining task type determination operation to generate a final configuration result. Similarity clustering and interval difference values are combined to form a comparable condition chain, so that a multi-fragment relation is dynamically quantified, difference values compensate and balance failure fragment influences, task type matching strengthens scene consistency, relevance inference and chain decision relieve static comparison stiffness and deviation problems, and permission judgment is more coherent and accurate.

Description

Technical Field

[0001] This invention relates to the field of access control technology, and in particular to a multi-dimensional system parameter configuration method and system based on permission management. Background Technology

[0002] The field of access control technology mainly focuses on the management of data resources and operation permissions in information systems. Its core aspects include identifying and verifying the identity of the subject, classifying permissions for the object resources, verifying access requests, and dynamically adjusting permission relationships. Its overall technical system typically covers the construction of permission models, the setting of permission rules, the criteria for judging access requests, the methods for limiting permission boundaries, and the processing logic for permission changes, in order to ensure that different subjects can access and operate system resources in accordance with established rules in various business scenarios.

[0003] Traditional multi-dimensional system parameter configuration methods and systems based on permission management refer to establishing multi-dimensional permission control relationships for system parameters in complex business environments. Typically, it is necessary to sort out the configurable range of each parameter, and then formulate corresponding permission conditions according to dimensions such as organizational level, role structure, business type or operation scenario. During the configuration process, it is necessary to determine whether the setting of the target parameter is allowed based on the subject identity judgment, parameter item dimension matching, data field constraints and rule order judgment. The traditional method generally records the subject type, parameter category and configurable value range in a preset permission table, and then compares the dimension permission corresponding to the subject with the dimension attribute corresponding to the parameter item during configuration to complete the configuration limitation of multi-dimensional system parameters.

[0004] Existing technologies rely on static permission tables for item-by-item comparison in multi-dimensional system parameter configuration. Permission conditions are often directly mapped to fixed-dimensional attributes, lacking a comprehensive judgment on the correlation between multiple source elements. This leads to problems such as coarse condition decomposition, rigid dimension boundaries, and inflexible rule response in complex business scenarios. When faced with changes in task type, fluctuations in environmental credibility, or differences in resource sensitivity levels, matching deviations are prone to occur. Permission restriction results are prone to misjudgment under different combinations of conditions, resulting in inaccurate configuration scope division, increased request verification burden, and unstable resource access control effect. Summary of the Invention

[0005] To address the technical problems existing in the prior art, embodiments of the present invention provide a multi-dimensional system parameter configuration method based on permission management, including the following steps: S1: Obtain and parse the configuration request submitted by the user, extract the user permission identifier, resource sensitivity level, task type, and environment trustworthiness, and combine them into a configuration request parameter set. At the same time, normalize and perform conditional probability inference to generate a multi-dimensional permission feature set. S2: Obtain the content of the permission rule base, split the conditions, perform similarity clustering on the split conditions, and combine the multi-dimensional permission feature set to perform condition matching to generate a permission fragment matching set; S3: Based on the permission fragment matching set, obtain the condition interval endpoints of each fragment, perform interval comparison item by item in combination with the configuration request parameter set and perform error calculation, divide the successful or failed fragments according to the positive or negative difference, and generate a permission fragment result set; S4: Based on the permission fragment result set and sequentially analyze the chain state structure, obtain the state values ​​of multiple fragments and perform weight accumulation, compensate for the difference of failed fragments, and generate a dynamic chain decision set. S5: Based on the dynamic chain decision set, obtain the cumulative weight result of each segment in the chain, and perform parameter operation type judgment on the configuration request parameter set. Match the determined operation type with the task type to generate system parameter configuration result.

[0006] As a further embodiment of the present invention, the multi-dimensional permission feature set includes user permission identifier, resource sensitivity level, task type, and environment credibility; the permission fragment matching set includes split conditions and similarity clustering results; the permission fragment result set includes successful fragments, failed fragments, and difference positive / negative judgment results; the dynamic chain decision set includes multi-fragment state values, weight accumulation results, and failed fragment compensation results; and the system parameter configuration results include operation type matching items, task type corresponding items, and parameter configuration items.

[0007] As a further aspect of the present invention, the specific steps of S1 are as follows: S101: Based on the configuration request submitted by the user, the system parses the user permission identifier, resource sensitivity level, task type, and environment trustworthiness, and performs normalization transformation on the four parameters according to their value range to generate a permission feature set. S102: Call the permission feature set, perform conditional probability inference on the normalized components of the four parameters in the feature set, perform joint operation on the multiple components based on their positions in the feature set, perform numerical product analysis on the probability values ​​of adjacent components to form a continuous probability chain, and obtain a probability association sequence. S103: Based on the probability association sequence, perform aggregation processing on all probability values ​​in the sequence according to their arrangement order in the sequence, and compare multiple probability values ​​with the aggregation threshold during the aggregation to filter out components with lower weights. Then, vectorize and encode the remaining components according to the sequence to obtain a multi-dimensional permission feature set.

[0008] As a further aspect of the present invention, the aggregation threshold is set by statistically analyzing the sum of the mean of all probability values ​​in the sequence and the standard deviation of a multiple of 3.

[0009] As a further aspect of the present invention, the specific steps of S2 are as follows: S201: Based on the multi-dimensional permission feature set, obtain the content of the permission rule base and split it, perform a comparison according to the length of the character sequence in the condition, calculate the difference between the length of the character sequence and the condition splitting benchmark value during the comparison, adjust the division boundary of the condition fragment according to the difference result, and generate a condition fragment set; S202: Based on the multi-condition fragments in the conditional fragment set, perform similarity calculation according to the character sequence position in the fragment, and filter out abnormal fragments during the similarity calculation. Then, cluster the remaining fragments according to the character content to obtain fragment clusters. S203: Based on the fragment clusters, perform matching judgment on the character sequences of multiple fragments within the clusters and the feature values ​​in the multi-dimensional permission feature set, calculate the numerical difference between the character sequences and feature values ​​and filter the fragments, and then integrate and encode the filtered fragments according to the clusters to obtain the permission fragment matching set.

[0010] As a further aspect of the present invention, the condition splitting benchmark value is set by analyzing the character sequence length of all permission conditions in the permission rule base, and by analyzing the sum of the average character sequence length of all permission conditions and the standard deviation of a multiple of 3.

[0011] As a further aspect of the present invention, the specific steps of S3 are as follows: S301: Based on the permission fragment matching set, retrieve the interval symbol position for the multi-character sequence, and compare the values ​​on the left and right sides of the symbol according to the character order. During the comparison, adjust the interval boundary according to the positive and negative values ​​of the difference between the left and right values, and record the adjusted endpoint value pairs to generate an interval endpoint group. S302: Call the interval endpoint group and the configuration request parameter set, perform interval comparison between the values ​​of multiple endpoints in the endpoint group and the corresponding parameters in the request parameter set, and calculate the difference between the endpoint values ​​and the request parameter values ​​during the comparison to obtain the interval difference sequence. S303: For the interval difference sequence, perform classification judgment based on the positive or negative of multiple differences within the sequence, and perform aggregation encoding on the classification results according to the segment index during the judgment period to obtain the permission segment result set.

[0012] As a further aspect of the present invention, the specific steps of S4 are as follows: S401: Based on the permission fragment result set, perform a chain-like state structure sequence retrieval for the multi-fragment state identifiers in the result set, and perform analysis on adjacent state identifiers in the sequence according to the index order. During the analysis, compare the values ​​of adjacent state identifiers to generate a multi-fragment state value group. S402: Call the multi-segment state value group, and according to the weight parameters of the multi-state values ​​in the chained state structure, perform cumulative calculation on the multi-state values ​​and corresponding weight parameters in the state value group. During the calculation, record the cumulative value sequence according to the state value index to obtain the chained cumulative weight value sequence. S403: For the chained cumulative weight value sequence, according to the difference of failed segments recorded in the permission segment result set, perform difference compensation on the corresponding index position in the cumulative weight value sequence, and during the compensation period, aggregate and encode the compensation results in a chained order to obtain a dynamic chained decision set.

[0013] As a further aspect of the present invention, the specific steps of S5 are as follows: S501: Based on the dynamic chain decision set, perform weight accumulation retrieval for multiple segments within the decision set, and determine the operation type for each segment's weight accumulation value according to the parameters of the configuration request parameter set. During the determination, match the operation type with the parameter value to generate a weight accumulation result group. S502: Call the weight accumulation result group, and filter each operation type according to the task type requirements. Compare the filtering results with the parameter information in the configuration request parameter set. Record the matching situation during the comparison to obtain the operation type matching sequence. S503: Based on the operation type matching sequence, perform task type verification on the matching result, confirm the matched operation type and task type during the verification, and generate system parameter configuration results.

[0014] A multi-dimensional system parameter configuration system based on access control includes: The data parsing module obtains and parses the configuration requests submitted by users, extracts user permission identifiers, resource sensitivity levels, task types, and environment trustworthiness, and combines them into a configuration request parameter set. At the same time, it normalizes and performs conditional probability inference to generate a multi-dimensional permission feature set and passes it to the rule clustering module. The rule clustering module obtains the content of the permission rule library, performs condition splitting, performs similarity clustering on the split conditions, and performs condition matching in combination with the multi-dimensional permission feature set to generate a permission fragment matching set and pass it to the interval comparison module. The interval comparison module obtains the condition interval endpoints of each segment based on the permission segment matching set, performs interval comparison item by item in combination with the configuration request parameter set and performs error calculation, divides the segments into successful or failed segments according to the positive or negative difference, generates a permission segment result set and passes it to the chain decision module. The chain decision module analyzes the chain state structure sequentially based on the permission fragment result set, obtains multiple fragment state values ​​and performs weight accumulation, compensates for the difference of failed fragments, generates a dynamic chain decision set and passes it to the parameter configuration module. The parameter configuration module, based on the dynamic chain decision set, obtains the cumulative weight result of each segment in the chain, performs parameter operation type judgment on the configuration request parameter set, matches the determined operation type with the task type, and generates system parameter configuration result.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, by normalizing request attributes and constructing a multi-dimensional permission feature set, and combining conditional similarity clustering and interval difference calculation to form a continuous and comparable conditional chain, permission relationships are dynamically quantified in the state of multi-segment association. The difference compensation mechanism balances failed segments in weight accumulation, and the configuration results achieve more scenario-appropriate operation judgment under task type matching. The overall processing process compensates for the rigid response and matching deviation caused by traditional static comparison with correlation inference and chain decision-making, so that permission judgment maintains consistency and accuracy as conditions change. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the steps of the present invention; Figure 2 This is a detailed schematic diagram of S1 of the present invention; Figure 3 This is a detailed schematic diagram of S2 of the present invention; Figure 4 This is a detailed schematic diagram of S3 of the present invention; Figure 5 This is a detailed schematic diagram of S4 of the present invention; Figure 6 This is a detailed schematic diagram of S5 of the present invention; Figure 7 This is a system module diagram of the present invention. Detailed Implementation

[0018] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0019] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0020] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0021] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0022] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0023] Please see Figure 1 This invention provides a multi-dimensional system parameter configuration method based on permission management, including the following steps: S1: Obtain and parse the configuration request submitted by the user, extract the user permission identifier, resource sensitivity level, task type, and environment trustworthiness, and combine them into a configuration request parameter set. At the same time, normalize and perform conditional probability inference to generate a multi-dimensional permission feature set. S2: Obtain the content of the permission rule base, split the conditions, perform similarity clustering on the split conditions, and combine them with the multi-dimensional permission feature set to perform condition matching and generate a permission fragment matching set. S3: Based on the permission fragment matching set, obtain the condition interval endpoints of each fragment, perform interval comparison item by item in combination with the configuration request parameter set and perform error calculation, divide the successful or failed fragments according to the positive or negative difference, and generate the permission fragment result set; S4: Based on the permission fragment result set and sequentially analyze the chain state structure, obtain the state values ​​of multiple fragments and perform weight accumulation, compensate for the difference of failed fragments, and generate a dynamic chain decision set; S5: Based on a dynamic chain decision set, obtain the cumulative weight result of each segment in the chain, and perform parameter operation type judgment on the configuration request parameter set. Match the determined operation type with the task type to generate system parameter configuration results.

[0024] The multidimensional permission feature set includes user permission identifier, resource sensitivity level, task type, and environment credibility. The permission fragment matching set includes the split conditions and similarity clustering results. The permission fragment result set includes successful fragments, failed fragments, and positive / negative difference judgment results. The dynamic chain decision set includes multi-fragment state values, weight accumulation results, and failed fragment compensation results. The system parameter configuration results include operation type matching items, task type corresponding items, and parameter configuration items.

[0025] Please see Figure 2 The specific steps of S1 are as follows: S101: Based on the configuration request submitted by the user, the system parses the user permission identifier, resource sensitivity level, task type, and environment trustworthiness, and performs normalization transformation on the four parameters according to their value range to generate a permission feature set. The system receives database access request packets from clients and uses a regular expression matching engine to parse the header and payload of the packets, extracting the user ID, target resource object identifier, operation command code, and source IP address context information. Based on a pre-defined authentication database (LDAP directory), using the user ID as the index key, it retrieves the corresponding static permission identifier value for the user. This permission identifier value is defined as an integer from 0 to 100, with the range [0, 20] for ordinary visitors, [21, 60] for operators, and [61, 100] for administrators. The system synchronously calls the resource attribute table, retrieving the resource sensitivity level based on the target resource object identifier. This level is quantified as a discrete integer from 1 to 10. Based on the operation command code (such as SELECT, UPDATE, DROP), it matches the corresponding task type strength value in the operation dictionary, with a value range of 1 to 5. Finally, it queries the threat intelligence database and IP reputation database to obtain the trust score of the current source IP environment, with a score range of 0 to 100. The processor reads the four original parameter values ​​retrieved above: permission identifier, resource sensitivity level, task type strength, and environment trustworthiness score, and performs normalization transformation operations in sequence. The normalization process uses a linear mapping method, dividing the original values ​​of each parameter by their corresponding maximum domain upper limit, thereby mapping the four heterogeneous parameters uniformly to the closed interval of double-precision floating-point numbers in the range [0, 1]. This step aims to eliminate the impact of dimensional differences on subsequent calculations. The four normalized floating-point numbers generated are strictly arranged in the order of permission, resource, task, and environment, constructing a four-dimensional permission feature set. For example, in a real audit business access scenario, the parsed permission identifier value is 85 (senior auditor), the resource sensitivity level is 8 (core financial table), the task type is 2 (read operation), and the environment trustworthiness is 90 (internal network security zone). Perform normalization: Permission feature component 85 ÷ 100 = 0.85; Sensitivity feature component 8 ÷ 10 = 0.8; Task type component 2 ÷ 5 = 0.40; Environment trustworthiness component 90 ÷ 100 = 0.90. The generated permission feature set is represented as an ordered array {0.85, 0.80, 0.40, 0.90}.

[0026] S102: Call the permission feature set, perform conditional probability inference on the normalized components of the four parameters in the feature set, perform joint operation on the multiple components based on their positions in the feature set, perform numerical product analysis on the probability values ​​of adjacent components to analyze the continuous probability chain, and obtain the probability association sequence. Based on the generated permission feature set {0.85, 0.80, 0.40, 0.90}, conditional probability inference is performed sequentially on each normalized component within the set. This process, based on a pre-set risk transition probability matrix, treats each component as a prior probability of an independent risk event, and derives the posterior probability value of each component inducing a security violation at the current moment through matrix multiplication. Specifically, the risk weight coefficients corresponding to the four parameters are set as α=1.1, β=1.2, γ=0.9, and δ=1.0, respectively, and the inferred probability correction values ​​are calculated. The operation here is numerical multiplication: 0.85×1.1=0.935, 0.80×1.2=0.96, 0.40×0.9=0.36, 0.90×1.0=0.90. Subsequently, a joint operation is performed based on the physical arrangement position in the feature set, constructing a probability chain using a strategy of continuous multiplication of adjacent components. This strategy specifies multiplying the corrected probability values ​​at position i and position i+1 to characterize the coupling risk strength between adjacent dimensions. The specific execution process is as follows: multiply the first corrected value 0.935 with the second corrected value 0.96 to obtain the first correlation value 0.935 × 0.96 ≈ 0.8976; multiply the second corrected value 0.96 with the third corrected value 0.36 to obtain the second correlation value 0.96 × 0.36 ≈ 0.3456; multiply the third corrected value 0.36 with the fourth corrected value 0.90 to obtain the third correlation value 0.36 × 0.90 = 0.3240. The advantage of this approach is that, through the product coupling of adjacent dimensions, it can keenly capture the difference between high-privilege users accessing highly sensitive resources (high product of the first two terms) and low-risk tasks executing in a secure environment (low product of the latter two terms), thereby amplifying the characteristic signals of anomalous combinations at the numerical level. Arranging the three calculated product results in the order of calculation yields the probability association sequence {0.8976, 0.3456, 0.3240}. This result indicates that the current access behavior has a high coupling risk in the "permission-resource" dimension, while the coupling risk in the "resource-task" and "task-environment" dimensions is relatively low, consistent with the characteristics of high-level users performing low-risk read tasks.

[0027] S103: Based on the probability association sequence, all probability values ​​in the sequence are aggregated according to their order in the sequence. During the aggregation, multiple probability values ​​are compared with the aggregation threshold to filter out components with lower weights. The remaining components are vectorized and encoded according to the sequence to obtain a multi-dimensional permission feature set. The received probability correlation sequence {0.8976, 0.3456, 0.3240} is first subjected to a filtering operation before aggregation processing on all probability values ​​within the sequence. A preset aggregation threshold is invoked. This threshold was determined through a binary classification experiment on historical normal access logs and attack logs, aiming to maximize the distinction between normal business and abnormal attacks. In the experiment, the threshold step was set to 0.05, traversing the interval [0.2, 0.8], and a critical value of 0.45 was selected as the aggregation threshold for this implementation, ensuring a false positive rate below 0.1% and a false negative rate below 0.5% (as shown in Table 1). The filtering logic is defined as follows: if the value of a probability component in the sequence is greater than or equal to the threshold 0.45, then the component is determined to be a valid high-risk coupling feature and is retained; if the value is less than 0.45, then it is determined to be low-risk noise and is filtered out (set to zero or discarded). Substituting the data into this example for comparison and judgment: the first item, 0.8976 > 0.455, is selected to be retained; the second item, 0.3456 < 0.45, is selected to be discarded; the third item, 0.3240 < 0.45, is selected to be discarded. After filtering, the retained component set is {0.8976} (the unretained items are placed with 0 as placeholders, resulting in {0.8976, 0, 0}). Subsequently, vectorized encoding is performed on the retained components, and the interval mapping encoding method is used to obtain the multi-dimensional permission feature set. The encoding rules are set as follows: the numerical range [0.45, 0.60) is mapped to the code "01", (0.60, 0.80) is mapped to "10", (0.80, 1.00) is mapped to "11", and the filtered items are mapped to "00". In this example, the first item, 0.8976, falls within the range [0.80, 1.00] and is encoded as "11"; the second and third items are 0 and are encoded as "00". The generated encoded sequence is concatenated to form "110000", which is the final output multi-dimensional permission feature set. This result shows that the access request has significant risk characteristics in the core dimension, requiring a high-level secondary verification process, while the low-risk characteristics in subsequent dimensions are effectively filtered, reducing computational redundancy.

[0028] Table 1. Experimental data for determining the aggregation threshold.

[0029] As shown in Table 1, by comparing the false alarm rate and false negative rate data under different threshold settings, the threshold of 0.45 corresponding to Group-C group maintains a low false alarm rate while ensuring an extremely low false alarm rate. Therefore, it was selected as the benchmark aggregation threshold in this embodiment.

[0030] Please see Figure 3 The specific steps of S2 are as follows: S201: Based on the multi-dimensional permission feature set, obtain the content of the permission rule base and split it. Perform a comparison based on the length of the character sequence in the condition. During the comparison, calculate the difference between the length of the character sequence and the condition splitting benchmark value and adjust the division boundary of the condition fragment according to the difference result to generate a condition fragment set. The generated multi-dimensional permission feature set is invoked, and the corresponding permission rule base storage partition is located based on the header identifier in the feature set. The complete permission control rule string involved in the current request is retrieved from the rule base; for example, if the retrieved rule string is "AUTH-LEVEL>80&ZONE=SECURE&TIME-RANGE=WORK", a character counter is first started to traverse the string to obtain the character sequence length. In this example, the counter reads characters one by one and accumulates, determining the character sequence length of the rule string to be 35. Subsequently, a preset conditional splitting baseline value is read. The setting of this baseline value relies on a balance test between parsing efficiency and memory usage. The test process selected rule samples with lengths ranging from 5 to 50 for parsing time statistics, as shown in Table 2. According to the experimental data in Table 2, when the baseline value is set to 10, the overall performance index of parsing time and memory usage is optimal. Therefore, this embodiment sets the conditional splitting baseline value... Next, the difference calculation is performed, subtracting the obtained character sequence length from the conditional splitting baseline value: 35 − 10 = 25. Based on this difference result of 25, the splitting granularity is determined. Since the difference is greater than 0, the processor activates the splitting logic, cutting the string according to logical connectors (such as "&" or "|"), and dynamically adjusting the maximum allowed length of each segment based on the difference. In this example, the string is split into three initial conditional segments: "AUTH-LEVEL>80", "ZONE=SECURE", and "TIME-RANGE=WORK". The length of each segment is checked again to confirm that none exceed the dynamically adjusted boundary limit, and then these three text segments are stored in a temporary buffer to generate a conditional segment set.

[0031] Table 2. Experimental Data Table for Determining the Baseline Values ​​of Conditional Splitting

[0032] As shown in Table 2, the experimental data clearly reflect the impact of the baseline value setting on system performance. The Test-03 group exhibited the shortest parsing time and lowest memory usage when the baseline value was set to 10. This result indicates that using a 10-character length as the splitting baseline most effectively processes rule strings in the current system environment, avoiding resource waste caused by overly fine splitting or decreased parsing accuracy caused by overly coarse splitting.

[0033] S202: Based on multiple conditional fragments in the conditional fragment set, similarity calculation is performed according to the character sequence position in the fragment, and abnormal fragments are screened out during the similarity calculation. Then, the remaining fragments are clustered according to the character content to obtain fragment clusters. Iterate through each conditional fragment in the conditional fragment set, for example, selecting the fragment "AUTH-LEVEL>80" as the current processing object. Call the standard semantic template library, which stores the predefined standard field structure "KEY-OPERATOR-VALUE". Based on the character's position in the sequence, compare the fragment content with the template structure character by character to perform similarity calculation. The calculation logic is set as follows: if the position... If the character type (letter, symbol, number) at a given location matches the template, it is recorded as a matching point. For example, "AUTH-LEVEL" corresponds to the KEY position (pure letters) of the template, ">" corresponds to the OPERATOR position (symbols), and "80" corresponds to the VALUE position (numbers). The total number of matching points is counted and divided by the total length of the fragment to obtain the similarity score. For the fragment "AUTH-LEVEL>80", its structural similarity is calculated to be 0.95. During this period, a screening operation is performed, setting the similarity retention threshold to 0.80. This threshold is set based on the distribution characteristics of malformed rules (such as garbled characters caused by OCR errors) in historical logs. Fragments with a similarity lower than 0.80 are judged as off-target fragments and removed from the set. The fragment is then preserved. Subsequently, a clustering operation is performed on the preserved fragment. The clustering is based on the semantic hash value of the "KEY" portion of the fragment. The hash value of "AUTH-LEVEL" is calculated and assigned to the "Permission Attribute" cluster; the hash value of "ZONE=SECURE" for "ZONE" is calculated and assigned to the "Environment Attribute" cluster. Through this process, the three originally discrete fragments are reorganized into semantically related fragment clusters, where the "Permission Attribute" cluster contains the data items {"AUTH-LEVEL", ">", "80"}, providing structured preparation for subsequent numerical matching.

[0034] S203: Based on the fragment clusters, perform matching judgment on the character sequences of multiple fragments within the clusters and the feature values ​​in the multi-dimensional permission feature set, calculate the numerical difference between the character sequences and feature values ​​and filter the fragments, and then integrate and encode the filtered fragments according to the clusters to obtain the permission fragment matching set; The generated fragment clusters are read, and the corresponding numerical components in the generated multidimensional permission feature set are extracted. In the embodiment of S103, the permission feature component calculation result is 0.8976 (corresponding to the "AUTH-LEVEL" dimension). First, the text conditions in the clusters are converted into numerical form. For the condition "AUTH-LEVEL>80", according to the preset mapping table, the level requirement "80" is mapped to the normalized value 0.80. Then, a matching judgment is performed, and the numerical difference between the feature value and the condition value is calculated. Specifically, the feature value 0.8976 is subtracted from the condition value 0.80. At this point, invoking the matching tolerance filtering logic requires introducing a matching threshold for judgment. The determination of this threshold is based on the matching accuracy experimental data shown in Table 3, aiming to balance security stringency and business availability. When the threshold is set to 0.15, the false rejection rate for legitimate users is lowest while blocking unauthorized access; therefore, this threshold is set... The calculated numerical difference of 0.0976 is compared with the threshold of 0.15. The judgment logic is: if the absolute value of the numerical difference is less than or equal to the threshold, and the sign condition is met (i.e., the feature value is greater than the condition value, and the difference is positive), then the match is considered successful. In this example, Since the value is positive, the feature is determined to meet the rule requirements. The matching result is then encoded: a successful match is encoded as "1", and a failed match as "0". For the environment attribute cluster "ZONE=SECURE", its mapping value is set to 0.90, and the environment feature value in S103 is also 0.90, with a difference of 0, which is also encoded as "1". The encoding results of each cluster are integrated according to priority to generate the final permission fragment matching set "11". This result shows that the user's current permission features and environment features both meet the admission criteria in the rule base, and the verification is successful.

[0035] Table 3. Experimental data table for setting matching threshold

[0036] As shown in Table 3, by monitoring system behavior under different matching thresholds, the Match-C group (threshold 0.15) maintained a high interception accuracy of 99.2% while keeping the false rejection rate at an extremely low level of 0.3%, significantly better than other control groups. This result indicates that a numerical difference tolerance of 0.15 is the optimal dividing line between legitimate privilege fluctuations and unauthorized attempts, ensuring the continuity of normal business processes while strictly enforcing security policies.

[0037] Please see Figure 4 The specific steps of S3 are as follows: S301: Based on the permission fragment matching set, retrieve the position of the interval symbol for the multi-character sequence, and compare the values ​​on the left and right sides of the symbol according to the character order. During the comparison, adjust the interval boundary according to the positive and negative values ​​of the difference between the left and right values, and record the adjusted endpoint value pairs to generate the interval endpoint group. Based on the generated permission fragment matching set, which contains rule strings with textual logical descriptions verified by previous steps, such as "TIME-RANGE=09.00-17.00", the parser is started to perform a multi-character sequence scan on the numerical domain portion of the string, identifying and locating the index position of the connecting symbol (such as the hyphen "-") representing the interval range in the character sequence. Taking "09.00-17.00" as an example, after locating the hyphen position, the starting boundary value 9.00 on the left side of the symbol and the ending boundary value 17.00 on the right side of the symbol are extracted. The processor then executes the numerical comparison logic according to the character order, calculating the span difference between the two: 17.00−9.00=8.00. During this process, a "boundary relaxation coefficient" δ is introduced to dynamically adjust the interval boundary to accommodate minor jitter caused by network transmission delays or clock skew. The setting of this coefficient δ is determined based on the boundary fault tolerance test experimental data shown in Table 4. During the experiment, access requests under different network latency environments were simulated to test the impact of different δ values ​​on the false interception rate (FRR) of legitimate requests and the false rejection rate (FAR) of illegitimate requests. According to the data in Table 4, when δ is set to 0.25, the false interception rate can be reduced to the optimal level while maintaining the false rejection rate below 0.05%. Therefore, this embodiment sets the boundary relaxation coefficient δ=0.25. Based on this coefficient, positive and negative interval boundary adjustment operations are performed on the original boundary values: for the starting value on the left, a subtraction operation 9.00−0.25=8.75 is performed; for the ending value on the right, an addition operation 17.00+0.25=17.25 is performed. After adjustment, the generated numerical pair (8.75, 17.25) is encapsulated into a double-precision floating-point array, combined with the unique index ID of the rule fragment, and stored in the cache to generate an interval endpoint group.

[0038] S302: Call the interval endpoint group and the configuration request parameter set, perform interval comparison between the values ​​of multiple endpoints in the endpoint group and the corresponding parameters in the request parameter set, and calculate the difference between the endpoint values ​​and the request parameter values ​​during the comparison to obtain the interval difference sequence. The generated interval endpoint group (8.75, 17.25) is invoked, and the corresponding real-time parameter values ​​are simultaneously extracted from the configuration request parameter set submitted by the user. In this embodiment, the request parameter value after the timestamp of the user's request is parsed and converted to floating-point format is set to 17.15 (i.e., 17:09). An interval comparison operation is performed between the multiple endpoint values ​​in the endpoint group and this request parameter value. The processor first calls the lower limit of the interval = 8.75 and the request value 17.15 to perform the first difference calculation: D1 = 17.15 − 8.75 = 8.40; then it calls the upper limit of the interval 17.25 and the request value 17.15 to perform the second difference calculation: D2 = 17.25 − 17.15 = 0.10. This calculation process strictly follows the "inward convergence" difference logic, that is, calculating the inward distance of the request value relative to the interval boundary. If the other set of request parameters received is 17.30 (i.e., 5:18 PM), the corresponding calculation results are: D1′=17.30−8.75=8.55, and D2′=17.25−17.30=−0.05. The difference pairs calculated for each request are stored in the memory stack in the order of calculation, forming a sequence of interval differences. For a request value of 17.15, the generated sequence is {8.40, 0.10}; for a request value of 17.30, the generated sequence is {8.55, −0.05}. This step transforms the abstract logical judgment of "whether it is within the interval" into a concrete numerical measure through numerical difference calculation. Positive values ​​represent a safety margin for the request being inside the boundary, while negative values ​​intuitively quantify the degree of violation of the request exceeding the boundary.

[0039] S303: For interval difference sequences, perform classification judgment based on the positive or negative of multiple differences within the sequence, and perform aggregation encoding on the classification results by segment index during the judgment period to obtain the permission segment result set; When the difference is positive or zero, it indicates that the parameter falls within the valid range, and it is classified as a valid segment. When the difference is negative, it indicates that the parameter does not meet the threshold requirement, and it is classified as a failed segment. This negative value is directly retained as a measure of the error magnitude. The final generated permission segment result set not only contains status identifiers but also carries specific numerical differences. This design provides an essential quantitative data foundation for subsequent steps to dynamically compensate for non-critical failure segment differences using weighted accumulation, thereby enabling flexible decision-making in system configuration.

[0040] Based on the generated interval difference sequence, sign bit detection and classification are performed on the multiple difference elements contained in the sequence. The preset judgment logic is: if and only if all differences in the sequence are non-negative (i.e., ≥0), the request parameter is determined to fall within the permitted range; if any negative number exists in the sequence, the request parameter is determined to be out of bounds. For the sequence {8.40, 0.10}, two positive components are detected, indicating that the request time 17.15 is within the adjusted permitted range [8.75, 17.25], and there is still a time margin of 0.10 from the upper limit boundary, so the judgment result is "pass". For the sequence {8.55, −0.05}, the second component is detected to be negative, indicating that the request time 17.30 exceeds the upper limit boundary by 0.05 units, so the judgment result is "reject". During the judgment, aggregation encoding is performed on the classification results according to the fragment index. The encoding rule is set as follows: fragments that pass the verification are marked with binary code "1", and those that fail are marked with "0". In this embodiment, for a request of 17.15, the output is encoded as "1". If another rule (such as IP segment verification) exists for parallel processing and fails, outputting "0", then the encoded results of each segment are concatenated in a predetermined order. For example, concatenating the time rule (passed) and the IP rule (failed) yields the encoded string "10". Finally, this encoded string is encapsulated to obtain the permission segment result set. This result indicates that the current user's access request meets the relaxed security policy requirements in the time dimension, but there may be risks in the set IP dimension or other parallel dimensions. The specific access control decision will be made based on the combined state of this result set.

[0041] Table 4. Experimental Data for Setting Boundary Relaxation Coefficient

[0042] As shown in Table 4, the coefficient 0.25 for Test-Group-3 achieved the best balance among the various indicators. Compared to Test-Group-1 (with a false interception rate as high as 4.85%), which did not have a relaxation coefficient, the coefficient 0.25 significantly reduced false positives caused by critical jitter. Meanwhile, compared to Test-Group-4 and Test-Group-5, which had larger coefficients, its missed interception rate remained extremely low at 0.04%, ensuring the seriousness of the security boundary. This experimental data validates the rationality and necessity of setting 0.25 as the baseline value.

[0043] Please see Figure 5 The specific steps of S4 are as follows: S401: Based on the permission fragment result set, perform a chain-like state structure sequence retrieval for the multi-fragment state identifiers in the result set, and perform analysis on adjacent state identifiers in the sequence according to the index order. During the analysis, compare the values ​​of adjacent state identifiers to generate a multi-fragment state value group. Based on the output permission fragment result set, which consists of a binary encoded sequence, taking the data in the above embodiment as an example, the result set is "10", where the first "1" indicates that the time dimension verification passed, and the second "0" indicates that the IP dimension verification failed. First, according to the preset chain-like state mapping protocol, the binary identifier is converted into a bipolar state value, and the mapping rule is set as follows: the identifier "1" maps to the positive state value +10.0, and the identifier "0" maps to the negative state value -10.0. Under this mapping, the original result set is transformed into a multi-fragment state value group {+10.0, -10.0}. Subsequently, a sequence retrieval is performed on this state value group to locate adjacent state nodes according to the index order. The processor selects the state value +10.0 at index i=1 and the state value -10.0 at index i=2 to perform numerical comparison analysis. The analysis logic is set to calculate the gradient change of adjacent nodes, that is, subtract the previous node value from the subsequent node value: -10.0 - 10.0 = -20.0. The gradient value -20.0 quantifies the degree of security state drop from the time dimension to the IP dimension. The mapped state values ​​are sequentially stored in registers to construct a multi-segment state value group. This step, through numerical mapping and gradient analysis, transforms discrete Boolean results into a continuous numerical state stream, providing a quantifiable data foundation for subsequent weighted cumulative calculations.

[0044] S402: Call the multi-segment state value group, and perform cumulative calculation on the multi-state values ​​and corresponding weight parameters in the state value group according to the weight parameters of the multi-state values ​​in the chained state structure. During the calculation, record the cumulative value sequence of the cumulative result according to the state value index to obtain the chained cumulative weight value sequence. Based on the generated multi-segment state value group {+10.0, −10.0}, and according to the predetermined position of each segment in the security policy chain, the corresponding weight parameters are retrieved from the configuration database. In this embodiment, the time dimension (index 1) is assigned a weight coefficient ω1, and the IP dimension (index 2) is assigned a weight coefficient ω2. The weight coefficients are set according to the "Multi-dimensional Weight Performance Evaluation Table" shown in Table 5. During the experiment, the impact of multiple weight allocation schemes on the detection rate (TPR) of attack samples and the false positive rate (FPR) of normal services was tested. According to the data in Table 5, when the weight allocation is ω1=0.6 and ω2=0.4, the overall performance is optimal while ensuring the effectiveness of the core dimension (time) and taking into account the constraints of the environment dimension (IP). Therefore, ω1=0.6 and ω2=0.4 are set. Then, the cumulative calculation operation is performed: For the first item in the sequence, the weighted state value is calculated as +10.0 × 0.6 = +6.0, and the value of the cumulative register is +6.0; for the second item in the sequence, the weighted state value is calculated as -10.0 × 0.4 = -4.0, and this value is added to the cumulative register, performing the addition operation: +6.0 + (-4.0) = +2.0. The cumulative snapshots of each node are recorded sequentially according to the index order, generating a chained cumulative weight value sequence {+6.0, +2.0}.

[0045] S403: For the chained cumulative weight value sequence, based on the difference of failed segments recorded in the permission segment result set, perform difference compensation on the corresponding index position in the cumulative weight value sequence. During the compensation period, aggregate and encode the compensation results in a chained order to obtain a dynamic chained decision set. Based on the generated chained cumulative weight value sequence {+6.0, +2.0}, the interval difference sequence of the records is back-called. In the S302 embodiment, the difference result corresponding to the IP dimension is −0.05 (representing exceeding the boundary by 0.05 units). Index 2 in the permission fragment result set is identified as a failure item (status value −10.0), and the difference compensation logic is activated. The processor first extracts the absolute value of the difference corresponding to the failure item |−0.05|=0.05, and introduces the compensation sensitivity coefficient λ to perform compensation value calculation. This coefficient λ is used to convert the difference in physical dimensions into a score dimension, and λ=100.0 (i.e., deduct 1 point for every 0.01 unit exceeding the limit). The compensation deduction amount is calculated: 0.05×100.0=5.0. Subsequently, the difference compensation operation is performed on the final cumulative value +2.0 corresponding to the cumulative weight value sequence. Here, a subtraction operation is performed to reflect the risk penalty: +2.0−5.0=−3.0. The compensated final score of -3.0 is compared with the preset admission threshold of 0.0. The judgment logic is as follows: if the score is greater than 0.0, the overall risk is considered controllable, and passage is granted; if the score is less than or equal to 0.0, passage is denied. In this example, -3.0 < 0.0, so the final result is "deny". Based on this judgment result, the entire link is aggregated and encoded to generate a dynamic chain decision set "000" representing the final rejection. This result shows that although the user performed well in the time dimension and the degree of exceeding the limit in the IP dimension was small, after weighted accumulation and strict quantitative penalties, their overall credit score still fell below the safety threshold, and a precise blocking operation was executed accordingly.

[0046] Table 5 Multidimensional Weighted Performance Evaluation Table

[0047] As shown in Table 5, the Weight-Set-C group (0.6 / 0.4 configuration) maintained an extremely high attack detection rate of 98.8% while keeping the false positive rate at a low level of 0.18%. Weight-Set-C outperformed other configuration groups that favored a single dimension. This result indicates that the weight ratio of 0.6 to 0.4 most accurately reflects the importance level of each element under the current security strategy, providing experimentally validated data support for the weighted cumulative calculation in step S402.

[0048] Please see Figure 6 The specific steps of S5 are as follows: S501: Based on a dynamic chain decision set, the system performs weight accumulation retrieval for multiple segments within the decision set, and performs operation type judgment on the weight accumulation value of each segment according to the parameters of the configuration request parameter set. During the judgment, the operation type and parameter value are matched to generate a weight accumulation result group. Based on the generated dynamic chained decision set, which contains the final cumulative score after difference compensation (−3.0, continuing the previous data as an example) and the corresponding chained code "000", the processor initiates segmented retrieval logic, backtracking the weight accumulation process of each node recorded in the decision set, extracting the intermediate cumulative value +2.0 (before the final compensation step) and the final cumulative value −3.0, and constructing a cumulative value vector. Subsequently, the configuration request parameter set is parsed to extract the operation instruction field of the current user request, for example, the instruction content is "EXECUTE-FUNDS-TRANSFER" (execute fund transfer). Then, an operation type judgment is performed on this instruction, mapping the text instruction to the operation type code "OP-LEVEL-3" according to the preset instruction dictionary. During the judgment, a matching operation is performed, associating "OP-LEVEL-3" with the values ​​in the cumulative value vector. The analysis process is as follows: the basic admission score requirement corresponding to this operation type is read, and the basic score requirement for this operation is set to 5.0. The final cumulative value -3.0 is paired with the operation type code, and the fit index between them is calculated simultaneously. The direct distance between the operation requirement value and the actual score value is calculated: 5.0 - (-3.0) = 8.0. If the distance is positive, it indicates that the current permission score fails to meet the operation requirement; if the distance is negative or zero, it indicates that the requirement is met. The calculated distance value 8.0, the operation type code "OP-LEVEL-3", and the original cumulative value -3.0 are encapsulated into a structure object to generate a weighted cumulative result group. This process aligns the abstract permission state with the specific business operation requirements numerically, establishing a quantitative benchmark for subsequent screening and verification.

[0049] S502: Call the weight accumulation result group, and filter each operation type according to the task type requirements. Compare the filtering results with the parameter information in the configuration request parameter set. Record the matching situation during the comparison to obtain the operation type matching sequence. The system generates a weighted cumulative result group, which includes the core data item {OP-LEVEL-3, Score: −3.0, Gap: 8.0}. Operation types are then filtered according to task type requirements. In this step, it's necessary to determine whether the current operation falls into the category of degradeable execution or requires strict blocking. The core basis for this determination lies in the setting of the "operation tolerance threshold" and "risk coefficient value." The setting of these two key parameters refers to the "Operation Type Risk Control Parameter Table" shown in Table 6. During the creation of this table, the R&D team simulated millions of access requests of different risk levels in an isolated sandbox environment, recording the penetration rate and defense success rate under different threshold settings. According to the data in Table 6, for "fund-related operations" (corresponding to Level 3), when the threshold is set to 5.0 and the risk coefficient is set to 1.5, 99.9% of abnormal requests can be effectively blocked, while maintaining zero false blocking of compliant requests. Therefore, in this embodiment, the standard threshold for operation type "OP-LEVEL-3" is set to 5.0, and the risk coefficient is set to 1.5. The filtering results are compared with the environmental parameters (such as "current network environment = public WiFi") in the configuration request parameter set. During the comparison, a weighted risk calculation of 8.0 × 1.5 = 12.0 is performed. This matching situation is recorded: the current request not only fails to meet the admission score, but also, after being weighted by the environmental coefficient, its risk equivalent reaches 12.0, far exceeding the normal risk tolerance limit (usually set to 10.0). This detailed comparison data, including operation type, basic gap, and environmentally weighted risk equivalent, is stored in the log buffer in chronological order to obtain the operation type matching sequence. This sequence not only records the "failure" status, but also more precisely quantifies the degree and risk level of failure.

[0050] S503: Match the sequence according to the operation type, perform task type verification on the matching result, confirm the matched operation type and task type during the verification, and generate system parameter configuration results; The generated operation type matching sequence is read, and a high-risk equivalent value of 12.0 is identified in the current sequence. Task type verification is performed based on this sequence. The verification logic first confirms that the task type to which the operation belongs is a "core asset change task". During this process, the calculated risk equivalent of 12.0 is compared with the "circuit breaker trigger value" corresponding to the task type. The circuit breaker trigger value for the "core asset change task" is set to 10.0. Since 12.0 > 10.0, the request is determined to trigger the highest level of defense mechanism. Parameter configuration results are then generated, containing specific execution action parameters and feedback control parameters. The processor calculates the specific lock-time parameters based on the difference: Lock-Time = Base-Time + (Risk − Trigger) × Step. Let the base lock-time Base-Time = 300 seconds, and the step size Step = 60 seconds / point. Substituting the values, the calculation is: 300 + (12.0 − 10.0) × 60 = 300 + 2 × 60 = 420 seconds. The generated configuration result is encoded as a control instruction set "ACTION: BLOCK; TIME: 420s; ALERT: CRITICAL". This result indicates that, given the user's severely insufficient permission score in the fund operation and the breach of the security circuit breaker after environmental risk weighting, the system will directly block the operation and lock the account for 420 seconds.

[0051] Table 6 Risk Control Parameters for Operation Types

[0052] As shown in Table 6, the data from the Op-Test-3 group demonstrates that for Level 3 fund-related operations, setting the standard threshold to 5.0 and using a risk coefficient of 1.5 times can increase the anomaly interception rate to 99.9% while ensuring compliance, significantly outperforming other parameter configuration groups. This experimental data fully validates the rationality and scientific validity of the parameter selection in the aforementioned steps.

[0053] Please see Figure 7 A multi-dimensional system parameter configuration system based on access control, including: The data parsing module obtains and parses the configuration requests submitted by users, extracts user permission identifiers, resource sensitivity levels, task types, and environment trustworthiness, and combines them into a configuration request parameter set. At the same time, it normalizes and performs conditional probability inference to generate a multi-dimensional permission feature set and passes it to the rule clustering module. The rule clustering module obtains the content of the permission rule library, splits the conditions, performs similarity clustering on the split conditions, and performs condition matching in combination with the multi-dimensional permission feature set to generate a permission fragment matching set and pass it to the interval comparison module. The interval comparison module obtains the condition interval endpoints of each segment based on the permission segment matching set, performs interval comparison item by item in combination with the configuration request parameter set and performs error calculation, divides the segments into successful or failed segments according to the positive or negative difference, generates the permission segment result set and passes it to the chain decision module. The chain decision module analyzes the chain state structure sequentially based on the permission fragment result set, obtains the state values ​​of multiple fragments and performs weight accumulation, compensates for the difference of failed fragments, generates a dynamic chain decision set and passes it to the parameter configuration module. The parameter configuration module, based on a dynamic chain decision set, obtains the cumulative weight result of each segment in the chain, performs parameter operation type judgment on the configuration request parameter set, matches the determined operation type with the task type, and generates system parameter configuration results.

[0054] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A multi-dimensional system parameter configuration method based on permission management, characterized in that, Includes the following steps: S1: Obtain and parse the configuration request submitted by the user, extract the user permission identifier, resource sensitivity level, task type, and environment trustworthiness, and combine them into a configuration request parameter set. At the same time, normalize and perform conditional probability inference to generate a multi-dimensional permission feature set. S2: Obtain the content of the permission rule base, split the conditions, perform similarity clustering on the split conditions, and combine the multi-dimensional permission feature set to perform condition matching to generate a permission fragment matching set; S3: Based on the permission fragment matching set, obtain the condition interval endpoints of each fragment, perform interval comparison item by item in combination with the configuration request parameter set and perform error calculation, divide the successful or failed fragments according to the positive or negative difference, and generate a permission fragment result set; S4: Based on the permission fragment result set and sequentially analyze the chain state structure, obtain the state values ​​of multiple fragments and perform weight accumulation, compensate for the difference of failed fragments, and generate a dynamic chain decision set. S5: Based on the dynamic chain decision set, obtain the cumulative weight result of each segment in the chain, and perform parameter operation type judgment on the configuration request parameter set. Match the determined operation type with the task type to generate system parameter configuration result.

2. The multi-dimensional system parameter configuration method based on permission management according to claim 1, characterized in that, The multidimensional permission feature set includes user permission identifier, resource sensitivity level, task type, and environment credibility. The permission fragment matching set includes the split conditions and similarity clustering results. The permission fragment result set includes successful fragments, failed fragments, and positive / negative difference judgment results. The dynamic chain decision set includes multi-fragment state values, weight accumulation results, and failed fragment compensation results. The system parameter configuration results include operation type matching items, task type corresponding items, and parameter configuration items.

3. The multi-dimensional system parameter configuration method based on permission management according to claim 1, characterized in that, The specific steps of S1 are as follows: S101: Based on the configuration request submitted by the user, the system parses the user permission identifier, resource sensitivity level, task type, and environment trustworthiness, and performs normalization transformation on the four parameters according to their value range to generate a permission feature set. S102: Call the permission feature set, perform conditional probability inference on the normalized components of the four parameters in the feature set, perform joint operation on the multiple components based on their positions in the feature set, perform numerical product analysis on the probability values ​​of adjacent components to form a continuous probability chain, and obtain a probability association sequence. S103: Based on the probability association sequence, perform aggregation processing on all probability values ​​in the sequence according to their arrangement order in the sequence, and compare multiple probability values ​​with the aggregation threshold during the aggregation to filter out components with lower weights. Then, vectorize and encode the remaining components according to the sequence to obtain a multi-dimensional permission feature set.

4. The multi-dimensional system parameter configuration method based on permission management according to claim 3, characterized in that, The aggregation threshold is set by statistically analyzing all probability values ​​in the sequence, and summing the mean of all probability values ​​with three times the standard deviation.

5. The multi-dimensional system parameter configuration method based on permission management according to claim 1, characterized in that, The specific steps of S2 are as follows: S201: Based on the multi-dimensional permission feature set, obtain the content of the permission rule base and split it, perform a comparison according to the length of the character sequence in the condition, calculate the difference between the length of the character sequence and the condition splitting benchmark value during the comparison, adjust the division boundary of the condition fragment according to the difference result, and generate a condition fragment set; S202: Based on the multi-condition fragments in the conditional fragment set, perform similarity calculation according to the character sequence position in the fragment, and filter out abnormal fragments during the similarity calculation. Then, cluster the remaining fragments according to the character content to obtain fragment clusters. S203: Based on the fragment clusters, perform matching judgment on the character sequences of multiple fragments within the clusters and the feature values ​​in the multi-dimensional permission feature set, calculate the numerical difference between the character sequences and feature values ​​and filter the fragments, and then integrate and encode the filtered fragments according to the clusters to obtain the permission fragment matching set.

6. The multi-dimensional system parameter configuration method based on permission management according to claim 5, characterized in that, The condition splitting benchmark value is set by analyzing the character sequence length of all permission conditions in the permission rule base, and by analyzing the sum of the average character sequence length of all permission conditions and the standard deviation of a multiple of 3.

7. The multi-dimensional system parameter configuration method based on permission management according to claim 1, characterized in that, The specific steps for S3 are as follows: S301: Based on the permission fragment matching set, retrieve the interval symbol position for the multi-character sequence, and compare the values ​​on the left and right sides of the symbol according to the character order. During the comparison, adjust the interval boundary according to the positive and negative values ​​of the difference between the left and right values, and record the adjusted endpoint value pairs to generate an interval endpoint group. S302: Call the interval endpoint group and the configuration request parameter set, perform interval comparison between the values ​​of multiple endpoints in the endpoint group and the corresponding parameters in the request parameter set, and calculate the difference between the endpoint values ​​and the request parameter values ​​during the comparison to obtain the interval difference sequence. S303: For the interval difference sequence, perform classification judgment based on the positive or negative of multiple differences within the sequence, and perform aggregation encoding on the classification results according to the segment index during the judgment period to obtain the permission segment result set.

8. The multi-dimensional system parameter configuration method based on permission management according to claim 1, characterized in that, The specific steps of S4 are as follows: S401: Based on the permission fragment result set, perform a chain-like state structure sequence retrieval for the multi-fragment state identifiers in the result set, and perform analysis on adjacent state identifiers in the sequence according to the index order. During the analysis, compare the values ​​of adjacent state identifiers to generate a multi-fragment state value group. S402: Call the multi-segment state value group, and according to the weight parameters of the multi-state values ​​in the chained state structure, perform cumulative calculation on the multi-state values ​​and corresponding weight parameters in the state value group. During the calculation, record the cumulative value sequence according to the state value index to obtain the chained cumulative weight value sequence. S403: For the chained cumulative weight value sequence, according to the difference of failed segments recorded in the permission segment result set, perform difference compensation on the corresponding index position in the cumulative weight value sequence, and during the compensation period, aggregate and encode the compensation results in a chained order to obtain a dynamic chained decision set.

9. The multi-dimensional system parameter configuration method based on permission management according to claim 1, characterized in that, The specific steps of S5 are as follows: S501: Based on the dynamic chain decision set, perform weight accumulation retrieval for multiple segments within the decision set, and determine the operation type for each segment's weight accumulation value according to the parameters of the configuration request parameter set. During the determination, match the operation type with the parameter value to generate a weight accumulation result group. S502: Call the weight accumulation result group, and filter each operation type according to the task type requirements. Compare the filtering results with the parameter information in the configuration request parameter set. Record the matching situation during the comparison to obtain the operation type matching sequence. S503: Based on the operation type matching sequence, perform task type verification on the matching result, confirm the matched operation type and task type during the verification, and generate system parameter configuration results.

10. A multi-dimensional system parameter configuration system based on access control, characterized in that, The system is used to implement the multi-dimensional system parameter configuration method based on permission management as described in any one of claims 1-9, and the system includes: The data parsing module obtains and parses the configuration requests submitted by users, extracts user permission identifiers, resource sensitivity levels, task types, and environment trustworthiness, and combines them into a configuration request parameter set. At the same time, it normalizes and performs conditional probability inference to generate a multi-dimensional permission feature set and passes it to the rule clustering module. The rule clustering module obtains the content of the permission rule library, performs condition splitting, performs similarity clustering on the split conditions, and performs condition matching in combination with the multi-dimensional permission feature set to generate a permission fragment matching set and pass it to the interval comparison module. The interval comparison module obtains the condition interval endpoints of each segment based on the permission segment matching set, performs interval comparison item by item in combination with the configuration request parameter set and performs error calculation, divides the segments into successful or failed segments according to the positive or negative difference, generates a permission segment result set and passes it to the chain decision module. The chain decision module analyzes the chain state structure sequentially based on the permission fragment result set, obtains multiple fragment state values ​​and performs weight accumulation, compensates for the difference of failed fragments, generates a dynamic chain decision set and passes it to the parameter configuration module. The parameter configuration module, based on the dynamic chain decision set, obtains the cumulative weight result of each segment in the chain, performs parameter operation type judgment on the configuration request parameter set, matches the determined operation type with the task type, and generates system parameter configuration result.

Images