A multi-level permission dynamic allocation method and system of an enterprise management platform

Abstract

The present application relates to the technical field of permission allocation, and in particular to a multi-level permission dynamic allocation method and system for an enterprise management platform. The present application analyzes the co-occurrence characteristics and bidirectional dependency characteristics of permission groups in historical configuration information, and obtains a correlation degree by dynamically weighting and fusing the asymmetry of the bidirectional dependency characteristics. The present application calculates a fitting index of each role and the additional permission by combining the dependency degree of the additional permission on the existing permission set of the role. The present application evaluates the authorization risk degree based on the maximum value of all role fitting indexes and makes a decision. The present application mines the co-occurrence and bidirectional dependency relationship between permissions in historical role permission configuration, combines the multi-role permission set currently possessed by the user, and comprehensively evaluates the authorization risk of the temporary additional permission. The present application ensures the permission access security of the enterprise management platform while improving the automation level and processing efficiency of multi-level permission dynamic allocation.

Description

Technical Field

[0001] This invention relates to the field of permission allocation technology, specifically to a method and system for dynamic allocation of multi-level permissions in an enterprise management platform. Background Technology

[0002] With the development of digitalization and networking in enterprise management, role-based access control (RBAC) has become the mainstream means for enterprise management platforms to restrict user access to resources and improve system security. By introducing the concept of roles between users and permissions, it enables centralized control over user access permissions.

[0003] However, in actual business processes, users often require temporary additional permissions beyond their assigned roles due to unexpected tasks or short-term collaborations. The allocation of these additional permissions typically relies solely on the user's job title and employment status for risk assessment, neglecting the objective relationships between permissions. For example, some permissions may be interdependent and work together to complete business operations, while simultaneously possessing other permissions could pose a higher security risk, making it difficult to quantify and assess the potential security risks after authorization. High risk assessment errors can lead to problems such as unauthorized access or increased workload for manual approvals, failing to meet the requirements for dynamic, secure, and efficient permission allocation. Summary of the Invention

[0004] To address the problem that existing technologies rely solely on static user attributes or single permission security levels for matching and judgment, ignoring the common correlations between different permissions and resulting in inaccurate authorization risk assessments, this invention aims to provide a multi-level dynamic permission allocation method and system for enterprise management platforms. The specific technical solution adopted is as follows: This invention provides a method for dynamic allocation of multi-level permissions in an enterprise management platform, the method comprising: Receive temporary requests for additional permissions submitted by users, obtain the additional permissions requested by the user and the set of existing permissions for each role currently held by the user; Based on the historical configuration information of roles and permissions stored on the platform, for the permission groups consisting of each permission and additional permissions in the existing permission set of the user's current role, the co-occurrence characteristics and bidirectional dependency characteristics of the permission groups in the historical configuration information are analyzed; based on the asymmetry of the bidirectional dependency characteristics, the co-occurrence characteristics and bidirectional dependency characteristics of the permission groups are dynamically weighted and fused to obtain the correlation degree of each permission group. For each role currently held by a user, based on the correlation between the existing permission set of that role and all permission groups corresponding to the additional permissions, and combined with the dependence of the additional permissions on each permission in the existing permission set of that role, a fit index between the role and the additional permissions is obtained. Assess the authorization risk level based on the compatibility indicators of all roles and additional permissions currently held by the user; make authorization decisions based on the authorization risk level.

[0005] Furthermore, the method for obtaining the co-occurrence feature includes: For any permission group consisting of additional permissions and another permission from the existing permission set, in the historical configuration information, count the number of times the permission group appears in the same role simultaneously as the synchronization count; calculate the number of times each of the two permissions in the permission group appears in all roles, and take the minimum number of appearances as the coverage count of the permission group. The co-occurrence characteristics of permission groups are obtained by comparing the ratio of the number of synchronizations to the number of coverages.

[0006] Furthermore, the method for obtaining the bidirectional dependency feature includes: In the historical configuration information, for any permission group, the first dependency of the additional permission on the non-additional permission in the permission group is obtained by comparing the total number of times the two permissions in the permission group appear together in the role with the total number of times the additional permission appears in all roles. The second dependency of non-extra permissions on extra permissions in this permission group is obtained by comparing the total number of times two permissions in this permission group appear together in a role with the total number of times non-extra permissions in this permission group appear in all roles. Based on the average of the first and second dependencies, the bidirectional dependency characteristics of this permission group are obtained.

[0007] Furthermore, the method for obtaining the correlation degree includes: Extract the minimum and maximum values ​​of the first and second dependencies; use the ratio of the minimum to the maximum value as the first dynamic weight coefficient; use the difference between the value 1 and the first dynamic weight coefficient as the second dynamic weight coefficient. The first dynamic weight coefficient is applied to the bidirectional dependency feature, and the second dynamic weight coefficient is applied to the co-occurrence feature. The weighted sum is then used to obtain the correlation degree of the permission group.

[0008] Furthermore, before obtaining the correlation, a pre-exclusion detection is also included: traversing each permission in the user's existing permission set, and when a permission and an additional permission exist in the high-risk mutual exclusion permission table, the application is directly intercepted and rejected.

[0009] Furthermore, the method for obtaining the matching index includes: For any role currently held by a user, the evaluation weight of each permission is obtained based on the first dependency of the additional permissions on each permission in the existing permission set of that role. The matching index between the role and the additional permissions is obtained by summing the weighted correlation between each permission and the additional permissions based on the evaluation weights.

[0010] Furthermore, the method for obtaining the evaluation weights includes: The sum of the first dependencies of the additional permissions on all permissions in the existing permission set of the role is used as the total one-way dependency of the role; the ratio of the first dependency of the additional permissions on each permission to the total one-way dependency is used as the evaluation weight of each permission.

[0011] Furthermore, the assessment of authorization risk based on the compatibility index of all roles and additional permissions currently held by the user includes: The maximum value of the fit index between all the user's current roles and additional permissions is taken as the target fit degree between the user and the additional permissions; the authorization risk degree is determined based on the target fit degree, and the target fit degree and the authorization risk degree are negatively correlated.

[0012] Furthermore, the authorization decision based on authorization risk includes: Multiple risk assessment threshold ranges are preset. When the authorization risk level falls within different risk assessment threshold ranges, the corresponding permission application processing method is matched according to the preset processing rules of the corresponding risk assessment threshold range.

[0013] This invention also provides a multi-level dynamic permission allocation system for an enterprise management platform, the system comprising: The data acquisition module is used to receive temporary requests for additional permissions submitted by users, obtain the additional permissions requested by the user, and the set of existing permissions for each role currently held by the user. The risk assessment module is used to analyze the co-occurrence characteristics and bidirectional dependency characteristics of permission groups, which are composed of each permission and additional permission in the existing permission set of the user's current role, based on the historical configuration information of the roles and permissions stored on the platform. Based on the asymmetry of the bidirectional dependency characteristics, the co-occurrence characteristics and bidirectional dependency characteristics of the permission groups are dynamically weighted and fused to obtain the correlation degree of each permission group. For each role currently held by a user, based on the correlation between the existing permission set of that role and all permission groups corresponding to the additional permissions, and combined with the dependence of the additional permissions on each permission in the existing permission set of that role, a fit index between the role and the additional permissions is obtained. Assess the authorization risk level based on the compatibility indicators of all roles and additional permissions currently held by the user; The authorization decision module is used to make authorization decisions based on the level of authorization risk.

[0014] The present invention has the following beneficial effects: This invention analyzes the co-occurrence and bidirectional dependency characteristics of permission groups in historical configuration information, and dynamically weights and fuses these characteristics based on the asymmetry of bidirectional dependency to obtain the correlation degree. This quantifies the deep logical connections between permissions, making the assessment of permission correlation more aligned with actual business logic. Secondly, by combining the dependence of additional permissions on the existing permission set of a role, it calculates the fit index between each role and the additional permissions, providing an objective quantitative basis for risk assessment from the perspective of identity matching. Finally, it assesses the authorization risk and makes decisions based on the maximum value of all role fit indices, effectively improving the security and automation level of dynamic multi-level permission allocation. This invention, by mining the co-occurrence and bidirectional dependency relationships between permissions in historical role permission configurations and combining them with the user's current multi-role permission set, comprehensively assesses the authorization risk of temporary additional permissions, ensuring the security of permission access on the enterprise management platform while improving the automation level and processing efficiency of dynamic multi-level permission allocation. Attached Figure Description

[0015] Figure 1 A flowchart illustrating a method for dynamic allocation of multi-level permissions in an enterprise management platform, as provided in one embodiment of the present invention; Figure 2 This is an example diagram of role-based access control provided in one embodiment of the present invention; Figure 3 This is a structural diagram of a multi-level dynamic permission allocation system for an enterprise management platform, provided as an embodiment of the present invention. Detailed Implementation

[0016] The following description, in conjunction with the accompanying drawings, details a specific scheme for a multi-level dynamic permission allocation method and system for an enterprise management platform provided by the present invention. Before describing the specific implementation methods, a unified explanation of the basic model and preset data upon which the present invention relies is first provided: Role-based access control (RBAC) is a classic permission management model. Its core idea is to introduce a "role" as an intermediary layer between users and permissions. Permissions are granted to roles, and roles are then granted to users, thereby achieving logical separation and centralized management of users and permissions. In this invention, the enterprise management platform constructs an initial permission allocation system based on the RBAC model. Please refer to... Figure 2 This diagram illustrates a role-based access control example provided by an embodiment of the present invention, demonstrating a many-to-many mapping relationship between users, roles, and permissions. Figure 2 As can be seen, a user can be assigned multiple roles, a role can contain multiple permissions, and a permission can also belong to multiple roles.

[0017] The system pre-stores a table mapping roles to permissions, recording the set of permissions for each role. For example, the "Sales Manager" role might include permissions such as "View Orders," "Edit Orders," and "Approve Returns." Roles are pre-assigned to users, and a user-role mapping table is stored to determine the user's current set of permissions. Each user can have one or more roles; for example, a user might simultaneously hold the roles of "After-Sales Customer Service" and "After-Sales Supervisor."

[0018] When a user needs to perform an operation outside their current role's permissions, they can submit a temporary request for additional permissions through the system. The request must include at least: the user's identifier and the identifier of the requested additional permissions. The system receives such requests in real time and triggers a subsequent risk assessment process.

[0019] If the additional permissions requested by the user are newly created in the system and have not yet been included in any role, the risk assessment calculation of this invention cannot be performed due to the lack of historical co-occurrence and dependency data. In this case, the system directly transfers the application to the manual approval queue for independent review by the administrator.

[0020] The acquisition, storage, use, and processing of data in the technical method of this invention all comply with the relevant provisions of national laws and regulations.

[0021] Please see Figure 1 The diagram illustrates a flowchart of a multi-level dynamic permission allocation method for an enterprise management platform according to an embodiment of the present invention. The method includes the following steps: S1: Receives temporary requests for additional permissions submitted by users, obtains the additional permissions requested by the user, and the set of existing permissions for each role currently held by the user.

[0022] In this embodiment of the invention, when the system monitors and receives a user's temporary request for additional permissions submitted through the front-end interface in real time, it retrieves all roles currently owned by the user from a pre-stored user-role mapping table based on the user's identifier, and for each role, obtains the set of existing permissions corresponding to that role from the role-permission mapping table. This yields the specific additional permissions requested by the user, each role currently owned by the user, and the set of existing permissions contained in each role.

[0023] As a concrete example, suppose a company management platform has configured the "After-Sales Customer Service" role (with permissions for "viewing customer information," "processing return / exchange requests," and "entering after-sales information") and the "After-Sales Supervisor" role (with permissions for "viewing customer information," "approving returns / exchanges," and "viewing after-sales statistical reports"). A user is currently assigned both the "After-Sales Customer Service" and "After-Sales Supervisor" roles. When a customer complains about abnormal logistics, the user needs to temporarily view the order's logistics details. Since the "view order logistics details" permission is not in the existing permission set of the two roles, the user submits a temporary additional permission request, requesting "view order logistics details." After receiving the request, the system parses the requested additional permission as "view order logistics details" and, based on the user's identifier, finds that the user possesses two roles: "After-Sales Customer Service" and "After-Sales Supervisor." Subsequently, the system obtains the existing permission set of "After-sales Customer Service" {view customer information, process return and exchange applications, and enter after-sales information}, and the existing permission set of "After-sales Supervisor" {view customer information, approve returns and exchanges, and view after-sales statistical reports}.

[0024] At this point, the system has completed the data preparation for step S1 and will proceed to the subsequent risk assessment process.

[0025] S2: Based on the historical configuration information of roles and permissions stored on the platform, for the permission groups consisting of each permission and additional permissions in the existing permission set of the user's current role, analyze the co-occurrence characteristics and bidirectional dependency characteristics of the permission groups in the historical configuration information; based on the asymmetry of the bidirectional dependency characteristics, dynamically weight and fuse the co-occurrence characteristics and bidirectional dependency characteristics of the permission groups to obtain the correlation degree of each permission group.

[0026] In enterprise management platforms, permissions are not isolated; they may be interdependent, such as "edit order" depending on "view order." These relationships can be reflected in the historical configuration of roles and permissions. Therefore, it is necessary to rely on historical configuration data to mine the inherent patterns of permission pairwise combinations and quantitatively evaluate the correlation between permission groups to more accurately represent the matching basis between requested permissions and users' existing permissions.

[0027] In this embodiment of the invention, before obtaining the correlation, a pre-emptive mutual exclusion check is also included. This involves traversing each permission in the user's existing permission set and checking whether any permission constitutes a mutual exclusion relationship with the requested additional permission. Specifically, the system pre-stores a high-risk mutual exclusion permission table, which records permission pairs that cannot coexist. When a permission and an additional permission exist in the high-risk mutual exclusion permission table, the application is directly intercepted and rejected without further calculation. For example, "creating a purchase order" and "approving a purchase order" cannot be performed by the same role, rendering the approval process invalid. If the system defines these two as a mutual exclusion pair, the system immediately rejects the application and notifies the administrator.

[0028] If the mutual exclusion detection is passed, the co-occurrence characteristics of the permission groups are analyzed further. Preferably, in some embodiments of the present invention, the method for obtaining co-occurrence characteristics includes: The additional permissions are combined with each permission in the existing permission set to form a permission group. For any permission group consisting of an additional permission and another permission in the existing permission set, the number of times the permission group appears in the same role in the historical configuration information is counted as the synchronization count, which represents the frequency of the two permissions being used together in the actual role configuration.

[0029] Understandably, if the number of synchronizations is zero, it means that these two permissions have never been configured with the same role in the historical configuration, the business compatibility between the two is extremely low, the security risk is high, and the analysis is ended early to proceed directly to manual approval.

[0030] The number of occurrences of each of the two permissions in the permission group in all roles is calculated. The minimum number of occurrences is taken as the coverage of the permission group, which represents the coverage breadth of the relatively scarce permissions in the historical role configuration. The complete configuration scenario of low-frequency permissions is used as the statistical benchmark to avoid the distortion caused by the dilution effect of high-frequency permissions on the co-occurrence rate.

[0031] The co-occurrence characteristic of a permission group is obtained by calculating the ratio of the number of synchronizations to the number of coverages. A higher co-occurrence characteristic value indicates a closer pairing of the two permissions in historical role configurations and stronger business synergy. As an example, the expression for the co-occurrence characteristic is: In the formula, This is represented as a co-occurrence feature. This is represented by the number of synchronizations. This indicates additional permissions. Number of appearances among all characters Represented as the first The number of times each permission appears across all roles This indicates additional permissions. With the The number of permissions that make up a permission group. This is represented as a minimum value extraction function.

[0032] When two permissions are interdependent, the dependency relationship also exhibits directionality. For example, the "delete log" permission usually accompanies the "view log" permission, but "view log" can also appear independently without "delete log". Therefore, the directionality of the dependency between permissions can be analyzed to obtain bidirectional dependency characteristics. Preferably, in some embodiments of the present invention, the method for obtaining bidirectional dependency characteristics includes: Permission dependency manifests as a certain permission always appearing alongside another permission. For any permission group, in the historical configuration information, the first dependency degree of the additional permission on the non-additional permission in the permission group is obtained by comparing the total number of times the two permissions in the permission group appear together in the role with the total number of times the additional permission appears in all roles. This represents the strength of the association between the additional permission and the non-additional permission. The higher the first dependency degree value, the more likely the additional permission is to appear together with the non-additional permission.

[0033] Similarly, by comparing the total number of times that two permissions in the permission group appear together in a role with the total number of times that non-extra permissions in the permission group appear in all roles, we can obtain the second dependency of non-extra permissions on extra permissions in the permission group, which represents the degree of dependency of non-extra permissions on extra permissions.

[0034] Then, based on the average of the first and second dependencies, the bidirectional dependency characteristic of this permission group is obtained, comprehensively reflecting the overall dependency level of the two permissions' accompanying configurations and demonstrating the tightness of the business binding between permissions. As an example, the expression for the bidirectional dependency characteristic of the current permission group is: In the formula, Represented as a bidirectional dependency feature, This is represented by the number of synchronizations. This indicates additional permissions. Number of appearances among all characters Represented as the first The number of times each permission appears across all roles, the first These permissions are non-additional permissions within the current permission group. This is represented as the first degree of dependence. This is represented as the second degree of dependence.

[0035] Preferably, in this embodiment of the invention, the method for obtaining the correlation degree includes: In business scenarios where permission combinations exhibit asymmetric dependencies, subordinate permissions often appear highly dependent on the configuration of basic permissions, while basic permissions can be independently and widely distributed. When represented solely by bidirectional dependency features, they are easily affected by the average smoothing effect of strong and weak dependencies, failing to objectively reflect the inherent strong binding relationship between master and subordinate permissions. This can easily lead to understated correlation measurement and distorted risk assessment results. Therefore, co-occurrence features are introduced to supplement and adjust from the perspective of coexistence in global role configurations, reducing the representational defects of a single bidirectional dependency feature in asymmetric dependency scenarios. At the same time, the weight mapping distribution relationship between bidirectional dependency features and co-occurrence features is dynamically adjusted according to the asymmetry of bidirectional dependency features. This ensures that permission combinations with symmetrical dependencies use bidirectional dependency features as the main evaluation criterion, while permission combinations with asymmetric dependencies are adapted and corrected through co-occurrence features. This adapts to the differentiated configuration rules of basic general permissions and subordinate business permissions in the enterprise platform, ensuring that the correlation measurement results of permission groups under different dependency forms are consistent with the actual business logic.

[0036] The minimum and maximum values ​​of the first and second dependencies are extracted. The ratio of the minimum to the maximum value is used as the first dynamic weight coefficient. The closer the ratio is to 1, the more balanced and symmetrical the bidirectional dependency between the two permissions; the closer the ratio is to 0, the stronger the directional dependency. The difference between 1 and the first dynamic weight coefficient is used as the second dynamic weight coefficient, which characterizes the unidirectional tendency or asymmetry of the dependency relationship and is used to emphasize the contribution of co-occurrence features in the association degree calculation.

[0037] The first dynamic weighting coefficient is used to weight the bidirectional dependency feature, and the second dynamic weighting coefficient is used to weight the co-occurrence feature. The weighted sum is then used to obtain the association degree of the permission group. Through dynamic weighted fusion, when the bidirectional dependency features are asymmetric (i.e., one side is highly dependent on the other), the co-occurrence feature has a larger weight; when the bidirectional dependency is symmetric, the bidirectional dependency feature has a larger weight, thus more accurately reflecting the true association strength between the two permissions. As an example, the expression for association degree is: In the formula, Represented as relevance, Represented as a bidirectional dependency feature, This is represented as a co-occurrence feature. This is represented as the first dynamic weighting coefficient. This is represented as the second dynamic weighting coefficient, i.e. .

[0038] S3: For each role currently held by a user, based on the correlation between the existing permission set of the role and all permission groups corresponding to the additional permissions, and combined with the dependence of the additional permissions on each permission in the existing permission set of the role, obtain the matching index between the role and the additional permissions.

[0039] Since a role is a collection of multiple permissions, and each role corresponds to a set of permissions in a fixed business scenario, the business functions and permission positioning of different roles are significantly different. The correlation of a single permission group cannot fully represent the compatibility between additional permissions and roles. Therefore, it is necessary to further integrate the correlation characteristics and dependencies of all permissions within each role, quantify the overall fit between the role and additional permissions, and objectively reflect the business fit between the requested permission and the user's existing job role. The higher the fit index, the more suitable the permission set of the role is to accept the additional permission, and the lower the risk of granting it to the user, which facilitates subsequent risk assessment of multiple roles.

[0040] Preferably, in this embodiment of the invention, the method for obtaining the fit index includes: For any role currently held by a user, the evaluation weight of each permission is obtained based on the first dependency degree of the additional permission on each permission in the existing permission set of that role. The higher the first dependency degree, the stronger the business support function of that permission for the additional permission, and the greater its weight in the fit evaluation. In some embodiments of this invention, the sum of the first dependencies of the additional permission on all permissions in the existing permission set of that role is taken as the total one-way dependency degree of that role, and the ratio of the first dependency degree of the additional permission on each permission to the total one-way dependency degree is taken as the evaluation weight of each permission, thus uniformly constraining the quantitative benchmark for weight allocation. The evaluation weight reflects the degree to which the permission is depended on within the role; if the additional permission is highly dependent on the permission, the greater the weight of that permission.

[0041] Finally, the compatibility index between the role and the additional permissions is obtained by weighting and summing the correlations between each permission and the additional permissions based on evaluation weights. This weighted aggregation of the correlation characteristics of all permissions within the role characterizes the suitability level between the requested additional permissions and the overall business scenario of the current role. As an example, the expression for the compatibility index of the current role is: In the formula, This is represented as a matching indicator. This represents the first of the existing permissions set for the current role. The correlation between individual permissions and additional permissions. Represented as the first The evaluation weight of each permission, This represents the total number of permissions in the current role's existing permission set.

[0042] S4: Assess the authorization risk level based on the matching indicators of all roles and additional permissions currently held by the user; make authorization decisions based on the authorization risk level.

[0043] After obtaining the compatibility index of each user's role and additional permissions through S3, the overall authorization risk is assessed by considering the overall role compatibility. In some embodiments of this invention, the maximum value of the compatibility index of all roles currently held by the user and the additional permissions is used as the target compatibility degree between the user and the additional permissions. The optimal role adaptation level is selected as the evaluation benchmark. As long as the compatibility degree of the most suitable role is high enough, the authorization risk can be considered low. Conversely, if the compatibility degree of all roles is low, the risk is high.

[0044] Then, the authorization risk level is determined based on the target fit. A higher target fit indicates a stronger match between the additional permissions and the user's job responsibilities, resulting in lower authorization risk. Target fit and authorization risk are negatively correlated. In one specific embodiment of this invention, the target fit is negatively correlated and normalized to obtain the authorization risk level. This can be calculated using a negative exponential function with a base of the natural constant, mapping the target fit to a risk value between 0 and 1. A smaller target fit indicates a larger risk. As an example, the expression for the authorization risk level is: ; This is expressed as the level of authorization risk. This is expressed as the target fit. It is represented as an exponential function with the natural constant as the base. This is represented as a sensitivity adjustment coefficient, which can be set to 1.5 to control the mapping intensity. The specific value can be adjusted by the implementer according to the mapping requirements of the specific implementation scenario.

[0045] Furthermore, different authorization decisions are made based on the different risk levels to balance security and efficiency. In this embodiment of the invention, multiple risk judgment threshold ranges are preset, that is, numerical ranges corresponding to low risk, medium risk, and high risk are defined in advance. When the authorization risk level is within different risk judgment threshold ranges, the corresponding permission application processing method is matched according to the preset processing rules of the corresponding risk judgment threshold range.

[0046] In one specific embodiment of the present invention, the preset risk judgment threshold range can be set as: low risk range [0, 0.5], medium risk range (0.5, 0.7], and high risk range (0.7, 1). When the authorization risk level is in the low risk range, it indicates that the additional permissions have high adaptability and low security risks, and the corresponding preset handling rule is to automatically grant temporary authorization, that is, the system directly allows it. When the authorization risk level is in the medium risk range, it indicates that there is some adaptability uncertainty, and the corresponding preset handling rule is to transfer it to the manual approval queue and supplement the application reasons, which requires administrator intervention. When the authorization risk level is in the high risk range, it indicates that the adaptability is extremely poor and there are obvious security risks, and the corresponding preset handling rule is to directly reject the application.

[0047] In summary, this invention analyzes the co-occurrence and bidirectional dependency characteristics of permission groups in historical configuration information, and obtains the correlation degree through dynamic weighted fusion based on the asymmetry of bidirectional dependency characteristics. This quantifies the deep logical connections between permissions, making the assessment of permission correlation more aligned with actual business logic. Secondly, by combining the dependence of additional permissions on the existing permission set of a role, it calculates the fit index between each role and the additional permissions, providing an objective quantitative basis for risk assessment from the perspective of identity matching. Finally, it assesses the authorization risk and makes decisions based on the maximum value of all role fit indices, effectively improving the security and automation level of dynamic multi-level permission allocation. This invention, by mining the co-occurrence and bidirectional dependency relationships between permissions in historical role permission configurations and combining them with the user's current multi-role permission set, comprehensively assesses the authorization risk of temporary additional permissions, ensuring the security of permission access on the enterprise management platform while improving the automation level and processing efficiency of dynamic multi-level permission allocation.

[0048] This invention also provides a multi-level dynamic permission allocation system for an enterprise management platform; please refer to [link / reference]. Figure 3 The diagram illustrates a structure of a multi-level dynamic permission allocation system for an enterprise management platform according to an embodiment of the present invention. The system includes: a data acquisition module 201, a risk assessment module 202, and an authorization decision module 203.

[0049] The data acquisition module 201 is used to receive temporary requests for additional permissions submitted by users, and to obtain the additional permissions requested by the user and the set of existing permissions for each role currently held by the user. The risk assessment module 202 is used to analyze the co-occurrence characteristics and bidirectional dependency characteristics of permission groups in the historical configuration information of roles and permissions stored on the platform, for each permission group consisting of the existing permission set of the user's current role and additional permissions. Based on the asymmetry of the bidirectional dependency characteristics, the co-occurrence characteristics and bidirectional dependency characteristics of permission groups are dynamically weighted and fused to obtain the correlation degree of each permission group. For each role currently held by a user, based on the correlation between the existing permission set of that role and all permission groups corresponding to the additional permissions, and combined with the dependence of the additional permissions on each permission in the existing permission set of that role, a fit index between the role and the additional permissions is obtained. Assess the authorization risk level based on the compatibility indicators of all roles and additional permissions currently held by the user; The authorization decision module 203 is used to make authorization decisions based on the authorization risk level.

[0050] It should be noted that the system provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above. In addition, the multi-level dynamic permission allocation system for an enterprise management platform and the multi-level dynamic permission allocation method embodiment for an enterprise management platform provided in the above embodiments belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

Claims

1. A method for dynamically allocating multi-level permissions in an enterprise management platform, characterized in that, The method includes: Receive temporary requests for additional permissions submitted by users, obtain the additional permissions requested by the user and the set of existing permissions for each role currently held by the user; Based on the historical configuration information of roles and permissions stored on the platform, for the permission groups consisting of each permission and additional permissions in the existing permission set of the user's current role, the co-occurrence characteristics and bidirectional dependency characteristics of the permission groups in the historical configuration information are analyzed; based on the asymmetry of the bidirectional dependency characteristics, the co-occurrence characteristics and bidirectional dependency characteristics of the permission groups are dynamically weighted and fused to obtain the correlation degree of each permission group. For each role currently held by a user, based on the correlation between the existing permission set of that role and all permission groups corresponding to the additional permissions, and combined with the dependence of the additional permissions on each permission in the existing permission set of that role, a fit index between the role and the additional permissions is obtained. Assess authorization risk based on the compatibility indicators of all the user's current roles and additional permissions; make authorization decisions based on the authorization risk assessment. The method for obtaining the bidirectional dependency feature includes: in historical configuration information, for any permission group, the first dependency degree of the additional permission on the non-additional permission in the permission group is obtained by comparing the total number of times the two permissions in the permission group appear together in a role with the total number of times the additional permission appears in all roles; the second dependency degree of the non-additional permission on the additional permission in the permission group is obtained by comparing the total number of times the two permissions in the permission group appear together in a role with the total number of times the non-additional permission in the permission group appears in all roles; and the bidirectional dependency feature of the permission group is obtained based on the average of the first dependency degree and the second dependency degree. The method for obtaining the correlation degree includes: extracting the minimum and maximum values ​​of the first and second dependencies; using the ratio of the minimum and maximum values ​​as the first dynamic weight coefficient; using the difference between the value 1 and the first dynamic weight coefficient as the second dynamic weight coefficient; weighting the first dynamic weight coefficient on the bidirectional dependency features and the second dynamic weight coefficient on the co-occurrence features, and then performing a weighted sum to obtain the correlation degree of the permission group.

2. The method for dynamic allocation of multi-level permissions in an enterprise management platform according to claim 1, characterized in that, The method for obtaining the co-occurrence feature includes: For any permission group consisting of additional permissions and another permission from the existing permission set, in the historical configuration information, count the number of times the permission group appears in the same role simultaneously as the synchronization count; calculate the number of times each of the two permissions in the permission group appears in all roles, and take the minimum number of appearances as the coverage count of the permission group. The co-occurrence characteristics of permission groups are obtained by comparing the ratio of the number of synchronizations to the number of coverages.

3. The method for dynamic allocation of multi-level permissions in an enterprise management platform according to claim 1, characterized in that, Before obtaining the correlation, it also includes a pre-exclusion check: iterate through each permission in the user's existing permission set, and when there is a permission and an additional permission in the high-risk mutual exclusion permission table, directly intercept and reject the application.

4. The method for dynamic allocation of multi-level permissions in an enterprise management platform according to claim 1, characterized in that, The methods for obtaining the matching index include: For any role currently held by a user, the evaluation weight of each permission is obtained based on the first dependency of the additional permissions on each permission in the existing permission set of that role. The matching index between the role and the additional permissions is obtained by summing the weighted correlation between each permission and the additional permissions based on the evaluation weights.

5. The method for dynamic allocation of multi-level permissions in an enterprise management platform according to claim 4, characterized in that, The method for obtaining the evaluation weights includes: The sum of the first dependencies of the additional permissions on all permissions in the existing permission set of the role is used as the total one-way dependency of the role; the ratio of the first dependency of the additional permissions on each permission to the total one-way dependency is used as the evaluation weight of each permission.

6. The method for dynamic allocation of multi-level permissions in an enterprise management platform according to claim 1, characterized in that, The assessment of authorization risk based on the compatibility indicators of all roles and additional permissions currently held by the user includes: The maximum value of the fit index between all the user's current roles and additional permissions is taken as the target fit degree between the user and the additional permissions; the authorization risk degree is determined based on the target fit degree, and the target fit degree and the authorization risk degree are negatively correlated.

7. The method for dynamic allocation of multi-level permissions in an enterprise management platform according to claim 1, characterized in that, The authorization decision based on authorization risk level includes: Multiple risk assessment threshold ranges are preset. When the authorization risk level falls within different risk assessment threshold ranges, the corresponding permission application processing method is matched according to the preset processing rules of the corresponding risk assessment threshold range.

8. A multi-level dynamic permission allocation system for an enterprise management platform, characterized in that, The system includes: The data acquisition module is used to receive temporary requests for additional permissions submitted by users, obtain the additional permissions requested by the user, and the set of existing permissions for each role currently held by the user. The risk assessment module is used to analyze the co-occurrence characteristics and bidirectional dependency characteristics of permission groups, which are composed of each permission and additional permission in the existing permission set of the user's current role, based on the historical configuration information of the roles and permissions stored on the platform. Based on the asymmetry of the bidirectional dependency characteristics, the co-occurrence characteristics and bidirectional dependency characteristics of the permission groups are dynamically weighted and fused to obtain the correlation degree of each permission group. The method for obtaining the bidirectional dependency feature includes: in historical configuration information, for any permission group, the first dependency degree of the additional permission on the non-additional permission in the permission group is obtained by comparing the total number of times the two permissions in the permission group appear together in a role with the total number of times the additional permission appears in all roles; the second dependency degree of the non-additional permission on the additional permission in the permission group is obtained by comparing the total number of times the two permissions in the permission group appear together in a role with the total number of times the non-additional permission in the permission group appears in all roles; and the bidirectional dependency feature of the permission group is obtained based on the average of the first dependency degree and the second dependency degree. The method for obtaining the correlation degree includes: extracting the minimum and maximum values ​​of the first and second dependencies; using the ratio of the minimum to the maximum value as the first dynamic weight coefficient; using the difference between the value 1 and the first dynamic weight coefficient as the second dynamic weight coefficient; weighting the first dynamic weight coefficient on the bidirectional dependency feature and the second dynamic weight coefficient on the co-occurrence feature, and then performing a weighted sum to obtain the correlation degree of the permission group. For each role currently held by a user, based on the correlation between the existing permission set of that role and all permission groups corresponding to the additional permissions, and combined with the dependence of the additional permissions on each permission in the existing permission set of that role, a fit index between the role and the additional permissions is obtained. Assess the authorization risk level based on the compatibility indicators of all roles and additional permissions currently held by the user; The authorization decision module is used to make authorization decisions based on the level of authorization risk.

Images