Microservice-based collection business data management method and system
By using a microservices-based approach and mining strong correlation rules from historical access data and user environment data, permissions can be dynamically adjusted, solving the security problems of traditional permission management methods in complex business scenarios and improving the security and flexibility of the procurement business platform.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HUANENG ZHAOCAI DIGITAL TECHNOLOGY CO LTD
- Filing Date
- 2025-12-09
- Publication Date
- 2026-05-12
AI Technical Summary
In the existing procurement business data management, the traditional access control method lacks flexibility and dynamic adjustment capabilities, making it difficult to adapt to complex and ever-changing business scenarios, resulting in high security risks.
By acquiring historical access data from the procurement platform, using association rule algorithms to mine strong association rules, and combining this with user environment data to modify permissions, we can dynamically adjust users' data access permissions and establish a permission evaluation model to improve security.
It improves the flexibility and dynamic adjustment capability of data access permissions, reduces the security risks of the procurement business platform, and ensures the security of data access.
Smart Images
Figure CN122020679A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and more specifically, to a microservice-based method and system for managing procurement business data. Background Technology
[0002] In existing procurement business data management, traditional data access permission management methods often rely on static permission configurations, lacking flexibility and dynamic adjustment capabilities, making it difficult to adapt to complex and ever-changing business scenarios and security requirements. Traditional permission management methods typically control data access through predefined roles and permissions, but this approach proves inadequate in the face of complex and ever-changing business scenarios, resulting in high security risks for the procurement business platform. Summary of the Invention
[0003] This invention provides a microservice-based method and system for managing procurement business data, aimed at addressing the high security risks in existing procurement business platforms, including:
[0004] The system retrieves historical access data from the procurement platform and determines the initial permission set corresponding to the current user information based on this data. It then determines multiple standard roles for the user based on the initial permission set and, based on these roles, determines the user's standard permission set. Finally, it mines strong association rules between historical access data using an association rule algorithm and determines the associated permission set corresponding to the user's standard permission set. The system also retrieves user environment data, modifies the associated permission set based on this data, and assigns user data access permissions based on the modified associated permission set.
[0005] Further, determining the initial permission set corresponding to the current user information based on historical access data includes: determining the access permission set corresponding to the historical access user information set based on historical access data; preprocessing the access permission set corresponding to the historical access user information set; establishing a training dataset based on the access permission set corresponding to the preprocessed historical access user information set; establishing an initial permission evaluation model based on the training dataset; training the initial permission evaluation model based on the training dataset to obtain the final permission evaluation model; and inputting the current user information into the permission evaluation model to obtain the corresponding initial permission set.
[0006] Furthermore, the step of determining multiple standard roles of a user based on an initial permission set, and determining a user's standard permission set based on the user's standard roles, includes: establishing a standard role library; matching the permissions in the initial permission set with the permissions corresponding to each role in the standard role library; determining roles with a matching degree greater than a first preset threshold as the user's standard roles; obtaining the permissions of all standard roles of the user; and deduplicating the permissions of all standard roles to obtain the user's standard permission set.
[0007] Furthermore, the step of mining strong association rules between historical access data based on association rule algorithms includes: discretizing the historical access data to obtain discretized historical access data; mining frequent itemsets of the historical access data based on the apriori algorithm; and determining strong association rules based on the frequent itemsets of the historical access data.
[0008] Furthermore, the step of mining frequent itemsets from historical access data based on the apriori algorithm and determining strong association rules based on these frequent itemsets includes: determining the support of two itemsets in the historical access data based on the discretized historical access data; setting a minimum support threshold; pruning itemsets in the historical access data whose support is greater than or equal to the minimum support threshold to generate frequent itemsets; setting a minimum confidence threshold; mining frequent itemsets with confidence greater than or equal to the minimum confidence threshold based on the frequent itemsets from the historical access data; and determining strong association rules based on these frequent itemsets.
[0009] Furthermore, determining the associated permission set corresponding to the user's standard permission set based on strong association rules includes: obtaining associated permissions that have association rules with permissions in the standard permission set but do not belong to the standard permission set, and establishing an associated permission set based on the associated permissions.
[0010] Furthermore, the step of modifying the associated permission set based on user environment data includes: determining the user's IP address and access time period based on the user environment data; determining the user's access risk parameters based on the user's IP address and access time period; determining the user's access level based on the access risk parameters; determining whether the user's access level is less than or equal to the allowed access level of each permission in the associated permission set; if the user's access level is less than or equal to the allowed access level of the permission in the associated permission set, then removing the corresponding permission from the associated permission set; obtaining the associated rule set after permission removal, thus obtaining the associated rule set after permission modification.
[0011] Furthermore, determining the user's access risk parameters based on the user's IP address and access time period includes: determining the access risk parameters according to an access risk parameter calculation formula, wherein the access risk parameter calculation formula is as follows:
[0012]
[0013] in, To access risk parameters, Standard access risk parameters for current user information. , These are the first weight parameter and the second weight parameter, respectively. For IP address risk parameters, For access period risk parameters, It is a natural exponential function.
[0014] Further, determining the user access level based on the access risk parameters includes: obtaining preset allowed access risk parameters, calculating the difference between the access risk parameters and the preset allowed access risk parameters to obtain a risk difference value, and determining whether the risk difference value is greater than a second preset threshold; if the risk difference value is greater than the second preset threshold, then the first level is used as the user access level; if the risk difference value is less than or equal to the second preset threshold, then determining whether the risk difference value is greater than a third preset threshold; if the risk difference value is greater than the third preset threshold, then the second level is used as the user access level; if the risk difference value is less than or equal to the third preset threshold, then the third level is used as the user access level.
[0015] To achieve the above objectives, the present invention also provides a microservice-based procurement business data management system, comprising:
[0016] The first module is used to acquire historical access data from the procurement platform and determine the initial permission set corresponding to the current user information based on the historical access data. The second module is used to determine multiple standard roles of the user based on the initial permission set and determine the user's standard permission set based on the user's standard roles. The third module is used to mine strong association rules between historical access data based on association rule algorithms and determine the associated permission set corresponding to the user's standard permission set based on the strong association rules. The fourth module is used to acquire user environment data, modify the associated permission set based on the user environment data, and allocate user data access permissions based on the modified associated permission set.
[0017] The beneficial effects of this invention are as follows:
[0018] By applying the above technical solutions, this invention obtains historical access data from the procurement platform, determines the initial permission set corresponding to the current user information based on the historical access data, determines multiple standard roles for the user based on the initial permission set, and determines the user's standard permission set based on the user's standard roles; mines strong correlation rules between historical access data based on association rule algorithms, and determines the associated permission set corresponding to the user's standard permission set based on the strong correlation rules; obtains user environment data, corrects the associated permission set based on the user environment data, and allocates user data access permissions based on the corrected associated permission set. This invention can improve the flexibility and dynamic adjustment capability of data access permission allocation and ensure the security of procurement business data access. Attached Figure Description
[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0020] Figure 1 The diagram illustrates a flowchart of a microservice-based procurement business data management method proposed in an embodiment of the present invention.
[0021] Figure 2 The diagram shows the overall structure of a microservice-based procurement business data management system proposed in an embodiment of the present invention. Detailed Implementation
[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0023] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.
[0024] This application provides a microservice-based method for managing procurement business data, such as... Figure 1 As shown, it includes:
[0025] S101, Obtain historical access data from the procurement platform, and determine the initial permission set corresponding to the current user information based on the historical access data;
[0026] In some embodiments of this application, determining the initial permission set corresponding to the current user information based on historical access data includes: determining the access permission set corresponding to the historical access user information set based on historical access data; preprocessing the access permission set corresponding to the historical access user information set; establishing a training dataset based on the access permission set corresponding to the preprocessed historical access user information set; establishing an initial permission evaluation model based on the training dataset; training the initial permission evaluation model based on the training dataset to obtain the final permission evaluation model; and inputting the current user information into the permission evaluation model to obtain the corresponding initial permission set.
[0027] S102, determine multiple standard roles of the user based on the initial permission set, and determine the user's standard permission set based on the user's standard roles;
[0028] In some embodiments of this application, the step of determining multiple standard roles of a user based on an initial permission set and determining a user's standard permission set based on the user's standard roles includes: establishing a standard role library; matching the permissions in the initial permission set with the permissions corresponding to each role in the standard role library; determining roles with a matching degree greater than a first preset threshold as the user's standard roles; obtaining the permissions of all standard roles of the user; and deduplicating the permissions of all standard roles to obtain the user's standard permission set.
[0029] S103, Based on the association rule algorithm, mine strong association rules between historical access data, and determine the associated permission set corresponding to the user's standard permission set according to the strong association rules;
[0030] In some embodiments of this application, the step of mining strong association rules between historical access data based on association rule algorithms includes: discretizing the historical access data to obtain discretized historical access data; mining frequent itemsets of the historical access data based on the apriori algorithm; and determining strong association rules based on the frequent itemsets of the historical access data.
[0031] In some embodiments of this application, the step of mining frequent itemsets from historical access data based on the Apriori algorithm and determining strong association rules based on the frequent itemsets from historical access data includes: determining the support of two itemsets in the historical access data based on the discretized historical access data; setting a minimum support threshold; pruning itemsets in the historical access data whose support is greater than or equal to the minimum support threshold to generate frequent itemsets; setting a minimum confidence threshold; mining frequent itemsets with confidence greater than or equal to the minimum confidence threshold based on the frequent itemsets from historical access data; and determining strong association rules based on the frequent itemsets with confidence greater than or equal to the minimum confidence threshold.
[0032] In some embodiments of this application, determining the associated permission set corresponding to the user's standard permission set based on strong association rules includes: obtaining associated permissions that have association rules with permissions in the standard permission set but do not belong to the standard permission set, and establishing an associated permission set based on the associated permissions.
[0033] S104, obtain user environment data, modify the associated permission set according to the user environment data, and allocate user data access permissions according to the modified associated permission set.
[0034] In some embodiments of this application, the step of modifying the associated permission set based on user environment data includes: determining the user's IP address and access time period based on the user environment data; determining the user's access risk parameters based on the user's IP address and access time period; determining the user's access level based on the access risk parameters; determining whether the user's access level is less than or equal to the allowed access level of each permission in the associated permission set; if the user's access level is less than or equal to the allowed access level of the permission in the associated permission set, then removing the corresponding permission from the associated permission set; obtaining the associated rule set after permission removal, thus obtaining the associated rule set after permission modification.
[0035] In some embodiments of this application, determining the user's access risk parameters based on the user's IP address and access time period includes: determining the access risk parameters according to an access risk parameter calculation formula, wherein the access risk parameter calculation formula is as follows:
[0036]
[0037] in, To access risk parameters, Standard access risk parameters for current user information. , These are the first weight parameter and the second weight parameter, respectively. For IP address risk parameters, For access period risk parameters, It is a natural exponential function.
[0038] In some embodiments of this application, determining the user access level based on access risk parameters includes: obtaining preset allowed access risk parameters, calculating the difference between the access risk parameters and the preset allowed access risk parameters to obtain a risk difference value, and determining whether the risk difference value is greater than a second preset threshold; if the risk difference value is greater than the second preset threshold, then the first level is used as the user access level; if the risk difference value is less than or equal to the second preset threshold, then determining whether the risk difference value is greater than a third preset threshold; if the risk difference value is greater than the third preset threshold, then the second level is used as the user access level; if the risk difference value is less than or equal to the third preset threshold, then the third level is used as the user access level.
[0039] Based on the same technological concept, such as Figure 2 As shown, the present invention also provides a microservice-based procurement business data management system, including:
[0040] The first module is used to acquire historical access data from the procurement platform and determine the initial permission set corresponding to the current user information based on the historical access data. The second module is used to determine multiple standard roles of the user based on the initial permission set and determine the user's standard permission set based on the user's standard roles. The third module is used to mine strong association rules between historical access data based on association rule algorithms and determine the associated permission set corresponding to the user's standard permission set based on the strong association rules. The fourth module is used to acquire user environment data, modify the associated permission set based on the user environment data, and allocate user data access permissions based on the modified associated permission set.
[0041] By applying the above technical solutions, this invention obtains historical access data from the procurement platform, determines the initial permission set corresponding to the current user information based on the historical access data, determines multiple standard roles for the user based on the initial permission set, and determines the user's standard permission set based on the user's standard roles; mines strong correlation rules between historical access data based on association rule algorithms, and determines the associated permission set corresponding to the user's standard permission set based on the strong correlation rules; obtains user environment data, corrects the associated permission set based on the user environment data, and allocates user data access permissions based on the corrected associated permission set. This invention can improve the flexibility and dynamic adjustment capability of data access permission allocation and ensure the security of procurement business data access.
[0042] Through the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented in hardware or by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) and includes several instructions to cause a computer device (such as a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.
[0043] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.
Claims
1. A microservice-based method for managing procurement business data, characterized in that, The method includes: Obtain historical access data from the procurement platform and determine the initial permission set corresponding to the current user information based on the historical access data; Determine multiple standard roles for a user based on the initial permission set, and determine the user's standard permission set based on the user's standard roles; Based on the association rule algorithm, strong association rules are mined between historical access data, and the associated permission set corresponding to the user's standard permission set is determined according to the strong association rules. Obtain user environment data, modify the associated permission set based on the user environment data, and assign user data access permissions based on the modified associated permission set.
2. The microservice-based procurement business data management method according to claim 1, characterized in that, The step of determining the initial permission set corresponding to the current user information based on historical access data includes: Determine the access permission set corresponding to the historical access user information set based on historical access data, and preprocess the access permission set corresponding to the historical access user information set. A training dataset is built based on the access permission set corresponding to the preprocessed historical access user information set, and an initial permission evaluation model is built based on the training dataset. The initial permission assessment model is trained based on the training dataset to obtain the final permission assessment model. Input the current user information into the permission evaluation model to obtain the corresponding initial permission set.
3. The microservice-based procurement business data management method according to claim 2, characterized in that, The process of determining multiple standard roles for a user based on an initial permission set, and determining a user's standard permission set based on those standard roles, includes: Establish a standard role library, match the permissions in the initial permission set with the permissions corresponding to each role in the standard role library, and determine the role with a matching degree greater than the first preset threshold as the user's standard role; Obtain the permissions of all standard roles for the user, and then deduplicate the permissions of all standard roles to obtain the user's standard permission set.
4. The microservice-based procurement business data management method according to claim 1, characterized in that, The algorithm for mining strong association rules between historical access data includes: The historical access data is discretized to obtain the discretized historical access data; The frequent itemsets of historical access data are mined using the Apriori algorithm, and strong association rules are determined based on these frequent itemsets.
5. The microservice-based procurement business data management method according to claim 4, characterized in that, The method of mining frequent itemsets from historical access data based on the Apriori algorithm, and determining strong association rules based on the frequent itemsets from historical access data, includes: Based on the discretized historical access data, the support of two itemsets in the historical access data is determined. A minimum support threshold is set, and itemsets in the historical access data with support greater than or equal to the minimum support threshold are pruned to generate frequent itemsets. Set a minimum confidence threshold, mine frequent itemsets with confidence levels greater than or equal to the minimum confidence threshold based on frequent itemsets in historical access data, and determine strong association rules based on frequent itemsets with confidence levels greater than or equal to the minimum confidence threshold.
6. The microservice-based procurement business data management method according to claim 5, characterized in that, The step of determining the associated permission set corresponding to the user's standard permission set based on strong association rules includes: Acquire associated permissions that have association rules with permissions in the standard permission set but do not belong to the standard permission set, and establish an associated permission set based on the associated permissions.
7. The microservice-based procurement business data management method according to claim 1, characterized in that, The step of modifying the associated permission set based on user environment data includes: The user's IP address and access time period are determined based on the user's environment data, and the user's access risk parameters are determined based on the user's IP address and access time period. Determine the user's access level based on access risk parameters, and determine whether the user's access level is less than or equal to the allowed access level of each permission in the associated permission set; If a user's access level is less than or equal to the allowed access level of the permissions in the associated permission set, then the corresponding permissions will be removed from the associated permission set. Get the set of association rules after removing permissions, and then get the set of association rules after correcting permissions.
8. The microservice-based procurement business data management method according to claim 7, characterized in that, The process of determining a user's access risk parameters based on their IP address and access time period includes: The access risk parameters are determined according to the access risk parameter calculation formula, which is as follows: ； in, To access risk parameters, Standard access risk parameters for current user information. , These are the first weight parameter and the second weight parameter, respectively. For IP address risk parameters, For access period risk parameters, It is a natural exponential function.
9. The microservice-based procurement business data management method according to claim 7, characterized in that, The process of determining user access levels based on access risk parameters includes: Obtain the preset allowed access risk parameter, calculate the difference between the access risk parameter and the preset allowed access risk parameter, obtain the risk difference value, and determine whether the risk difference value is greater than the second preset threshold. If the risk difference is greater than the second preset threshold, then the first level will be used as the user access level. If the risk difference is less than or equal to the second preset threshold, then determine whether the risk difference is greater than the third preset threshold. If the risk difference is greater than the third preset threshold, then the second level will be used as the user access level. If the risk difference is less than or equal to the third preset threshold, then the third level will be used as the user access level.
10. A microservice-based procurement business data management system, characterized in that, include: The first module is used to obtain historical access data from the procurement platform and determine the initial permission set corresponding to the current user information based on the historical access data. The second module is used to determine multiple standard roles of a user based on the initial permission set, and to determine the user's standard permission set based on the user's standard roles. The third module is used to mine strong association rules between historical access data based on association rule algorithms, and to determine the associated permission set corresponding to the user's standard permission set based on the strong association rules. The fourth module is used to obtain user environment data, modify the associated permission set based on the user environment data, and assign user data access permissions based on the modified associated permission set.