Shared access method of enterprise-level file management system, electronic device and medium

Abstract

This invention relates to the field of access control technology, specifically to a shared access method, electronic device, and medium for an enterprise-level file management system. It solves the technical problems in existing technologies where the use of a single silent time-based judgment logic ignores file evolution status and access control recovery costs, leading to issues such as accidental deletion of archived file permissions and deadlocks in the access control recovery process for files without a master. The method includes: for the access permissions of the target user to be evaluated on a target file, obtaining a physical disconnect degree characterizing the degree of business disconnect between the target user and the target file; when the physical disconnect degree meets preset triggering conditions, determining the administrative cost required to restore access permissions based on the difficulty of restoring the effective approval chain of the target file; and determining the processing method for access permissions based on the physical disconnect degree and administrative cost.

Description

Technical Field

[0001] This invention relates to the field of access control technology, specifically to a shared access method, electronic device, and medium for an enterprise-level file management system. Background Technology

[0002] In the long-term operation and maintenance of enterprise-level file storage systems (such as distributed file systems or cloud storage gateways), with frequent adjustments to the organizational structure and continuous personnel turnover, the access permissions for file resources gradually show an accumulating trend of only increasing. In order to ensure the security and compliance of the system, administrators urgently need to regularly clean up redundant authorizations that have not been used for a long time.

[0003] To achieve redundant authorization cleanup, existing permission governance solutions generally adopt a single silent time judgment logic. That is, when a user has no file access records within a set time limit (such as 180 days), the system will directly revoke the corresponding access permissions. This single-dimensional judgment method is the mainstream permission governance approach in the current industry.

[0004] However, this approach has revealed significant shortcomings in practical engineering applications. On the one hand, it ignores the evolution of files. For files that are no longer being updated and are in the archive period, user silence is a compliant behavior, and forced cleanup will cause business interruption when users subsequently access historical data. On the other hand, it lacks consideration of the cost of permission restoration. When the original file owner leaves the company or the account is canceled, the file jurisdiction is in a vacuum. If the system accidentally deletes permissions based on the silence period, users will not be able to find a valid approver when they apply for restoration, which will lead to process deadlock. Summary of the Invention

[0005] To address the technical problems in existing technologies where the use of a single silent time-based judgment logic ignores file evolution status and permission recovery costs, leading to issues such as accidental deletion of archive file permissions and deadlocks in the permission recovery process for files without a master, the present invention aims to provide a shared access method, electronic device, and medium for an enterprise-level file management system. The specific technical solution adopted is as follows:

[0006] Firstly, a shared access method for an enterprise-level document management system is provided, including: for the access rights of the target user to the target file to be evaluated, obtaining the physical disconnect degree, which characterizes the degree of business disconnect between the target user and the target file; when the physical disconnect degree meets the preset triggering conditions, determining the administrative cost required to restore the access rights based on the difficulty of restoring the effective approval link of the target file; and determining the processing method for the access rights based on the physical disconnect degree and the administrative cost.

[0007] Based on the above technical solution, in the shared access method of an enterprise-level file management system provided by this invention, the physical disconnection degree, which characterizes the degree of disconnection between the target user and the target file business, is first obtained. Then, when the triggering conditions are met, the administrative cost of permission restoration is determined based on the difficulty of restoring the effective approval link. Finally, the permission processing method is determined by combining the two. This effectively avoids the defects of the traditional single silent time judgment logic that ignores the file evolution status and permission restoration cost. It can accurately identify the real redundant authorization and avoid the deadlock of the process of accidentally deleting the permissions of archived files and restoring the permissions of ownerless files. It realizes differentiated permission governance that takes into account system security, compliance and business continuity.

[0008] In conjunction with the first aspect above, in one possible implementation, the method for obtaining the physical disconnect degree, which characterizes the degree of business disconnect between the target user and the target file, specifically includes: obtaining the total number of file revisions for which the target file has undergone valid content changes; obtaining the last viewed revision number corresponding to the target user; the last viewed revision number is the total number of historical file revisions corresponding to the target file when the target user last interacted with the target file; and determining the physical disconnect degree based on the total number of file revisions and the last viewed revision number.

[0009] In conjunction with the first aspect above, in one possible implementation, the physical disconnection degree satisfies a preset triggering condition, including: the physical disconnection degree is greater than a first threshold; the method for determining the administrative cost required to restore access permissions based on the difficulty of restoring the effective approval link of the target document specifically includes: determining the approver of the effective approval link of the target document and determining the confidence level of the inferred approver; determining the administrative cost based on the relationship between the target user and the approver in the organizational chart and the confidence level.

[0010] In conjunction with the first aspect above, in one possible implementation, the method for determining the approver of the valid approval chain of the target document specifically includes: obtaining the registered owner account information of the target document and the organizational chart of the enterprise; verifying the validity of the registered owner account based on the organizational chart; if the registered owner account is valid, then determining the registered owner account as the approver; if the registered owner account is invalid or does not exist, then reconstructing the logical owner anchor point based on the organizational chart, and inferring the approver based on the logical owner anchor point.

[0011] In conjunction with the first aspect above, in one possible implementation, the method for reconstructing the logical owner anchor point based on the organizational structure graph specifically includes: if the registered owner account is in an invalid state, then the invalid node corresponding to the registered owner account is used as the logical owner anchor point; if the registered owner account does not exist, then the organizational unit to which the registered owner last belonged is determined based on the metadata of the target file, and the node corresponding to the organizational unit is used as the logical owner anchor point.

[0012] In conjunction with the first aspect above, in one possible implementation, the method for inferring the approver based on the logical owner anchor specifically includes: obtaining a list of recently active contributors to the target file; the list of recently active contributors includes user identifiers and contribution levels of users who have performed valid write operations on the target file within a preset time window; for each candidate user in the list of recently active contributors, determining the jurisdiction score of each candidate user based on the candidate user's contribution level, the distance between the candidate user and the logical owner anchor in the organizational chart, and the depth of the candidate user's management level in the organizational chart; presuming the candidate user with the highest jurisdiction score as the approver; the method for determining the confidence level of the inferred approver specifically includes: determining the confidence level based on the jurisdiction scores of the candidate users in the list of recently active contributors.

[0013] In conjunction with the first aspect above, in one possible implementation, the method for determining the handling method of access permissions based on physical disconnection and administrative cost specifically includes: if the physical disconnection is less than or equal to a first threshold, the handling method for access permissions is determined to be automatic renewal; if the physical disconnection is greater than the first threshold and the administrative cost is less than or equal to a second threshold, the handling method for access permissions is determined to be physical removal; if the physical disconnection is greater than the first threshold and the administrative cost is greater than the second threshold, the handling method for access permissions is determined to be administrative freeze; administrative freeze includes restricting access permissions to read-only.

[0014] In conjunction with the first aspect above, in one possible implementation, the method for obtaining the last viewed revision number corresponding to the target user specifically includes: if the target user has write operation records for the target file, the total number of historical file revisions corresponding to the last write operation is taken as the last viewed revision number; if the target user only has view operation records for the target file, the file version corresponding to the last view operation is taken as the last viewed revision number; if the target user's operation records for the target file are empty, the initial creation version of the target file is taken as the last viewed revision number.

[0015] In a second aspect, an electronic device is provided, including a processor and a memory, the memory storing a computer program that, when executed by the processor, is capable of performing the actions described in the first aspect and any possible implementation thereof.

[0016] Thirdly, a computer storage medium is provided, in which a computer program is stored, which, when executed by a processor, is capable of performing the actions described in the first aspect and any possible implementation thereof.

[0017] The present invention has the following beneficial effects:

[0018] By first obtaining the physical disconnection degree that characterizes the degree of disconnection between the target user and the target file business, and then determining the administrative cost of permission restoration based on the difficulty of restoring the effective approval link when the triggering conditions are met, and finally combining the two to determine the permission handling method, the shortcomings of the traditional single silent time judgment logic that ignores the file evolution status and permission restoration cost are effectively avoided. It can accurately identify the real redundant authorization, and avoid the deadlock of the process of accidentally deleting permissions of archived files and restoring permissions of ownerless files. It achieves differentiated permission governance that takes into account system security, compliance and business continuity. Attached Figure Description

[0019] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A system architecture diagram of a shared access system for an enterprise-level file management system provided in one embodiment of the present invention;

[0021] Figure 2 A flowchart illustrating a shared access method for an enterprise-level file management system, as provided in one embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0023] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a shared access method, electronic device, and medium for an enterprise-level file management system proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] The following description, in conjunction with the accompanying drawings, details the specific solutions for the shared access method, electronic device, and media of an enterprise-level file management system provided by this invention.

[0026] Please see Figure 1The diagram illustrates a system architecture of a shared access system for an enterprise-level document management system according to an embodiment of the present invention. The shared access system of the enterprise-level document management system includes: a data acquisition module 1, a physical disconnect calculation module 2, an administrative cost determination module 3, and a permission processing module 4.

[0027] Data acquisition module 1 is the core of the entire system's data support, responsible for collecting various basic data required for permission assessment. Its output provides raw data support for subsequent calculations of physical disconnect and determination of administrative costs. This module can be implemented through a dedicated data acquisition program deployed on an enterprise server or cloud node, and includes three sub-modules:

[0028] The log separation submodule 11 accesses the raw operation log stream of the file system in real time through the log collection agent or the file system application programming interface (API), and filters and separates the read log and write log based on the operation command code. The read log records user operation information such as viewing files and listing directories, while the write log records substantive change operation information such as writing, appending, and modifying key attributes of files. At the same time, it performs log redundancy cleaning to ensure data accuracy.

[0029] The organizational structure synchronization submodule 12 periodically synchronizes the enterprise's full organizational structure data, including personnel account information, departmental hierarchical relationships, affiliations, and account status (activated or inactive), via the API of the lightweight directory access protocol (LDAP) or the identity and access management (IAM) system. The synchronized data is then structured and constructed into a visual organizational structure graph, providing a data foundation for subsequent account validity verification and organizational distance calculation.

[0030] The operation record storage submodule 13 categorizes and stores the user operation records (including user identifier, file identifier, operation type, and operation timestamp) processed by the log separation submodule 11, as well as the organizational structure graph data generated by the organizational structure synchronization submodule 12, into a distributed database or in-memory database. A data sharding strategy is employed during storage to improve access speed, ensuring that subsequent modules can quickly query the interaction data between the target user and the target file, as well as the organizational structure association information.

[0031] The physical disconnect calculation module 2, based on the basic data provided by the data acquisition module 1, quantifies the degree of business disconnect between the target user and the target file. Its calculation results are directly used to determine whether to trigger the administrative cost assessment process and provide a core basis for final permission processing. This module can be implemented through an algorithm program deployed on a computing node and includes three sub-modules:

[0032] The file revision count submodule 21 performs deduplication and anti-jitter processing on the write logs output by the data acquisition module 1. It sets a minimum revision interval; if consecutive write operations by the same user on the same file are less than this interval, they are considered the same editing transaction and the revision count is not accumulated; if they are greater than or equal to this interval, they are considered new substantive revisions, and the accumulated count increments. This logic maintains the cumulative number of valid content changes for each file, i.e., the total number of file revisions.

[0033] The last viewed revision number retrieval submodule 22 queries the interaction data between the target user and the target file stored in the operation record storage submodule 13, and determines the last viewed revision number according to preset rules: if there are write operation records, take the total number of file revisions corresponding to the last write operation; if there are only view operation records, take the total number of file revisions corresponding to the last view operation; if there are no operation records, take the revision number corresponding to the initial creation version of the file (default value is 0).

[0034] The physical disconnect calculation submodule 23 calls the total number of file revisions generated by the file revision count statistics submodule 21 and the last viewed revision number determined by the last viewed revision number acquisition submodule 22. The difference between the two is calculated through preset logic. This difference is the physical disconnect, which is used to accurately characterize the number of substantial changes to the target file that the target user has not followed.

[0035] The administrative cost determination module 3 is activated when the physical disconnection meets the triggering conditions. Based on the organizational structure data and interaction data provided by the data acquisition module 1, combined with the output of the physical disconnection calculation module 2, it quantifies the administrative communication costs required to restore permissions, providing a key basis for decision-making on permission handling methods. This module can be implemented through intelligent algorithm programs on cloud computing nodes or dedicated servers, and includes four sub-modules:

[0036] The registration owner verification submodule 31 reads the metadata of the target file, extracts the registration owner account information, calls the organizational structure diagram generated by the organizational structure synchronization submodule 12, and verifies the validity of the account: if the account exists in the organizational structure diagram and is active, it is determined to be valid; if the account exists but is inactive, or the account does not exist in the diagram, it is determined to be invalid.

[0037] When the registration owner verification submodule 31 determines that the account is invalid, the logical owner anchor reconstruction submodule 32 starts the anchor reconstruction logic: when the account is in an invalid state, the node corresponding to the invalid account is used as the logical owner anchor; when the account does not exist, the last organizational unit to which the registration owner belonged is traced back through the metadata of the target file, and the node corresponding to the organizational unit or its current person in charge node is used as the logical owner anchor, so as to ensure that the subsequent approver inference has a clear reference benchmark.

[0038] The approver inference submodule 33 acquires the list of recently active contributors (user identifiers and contribution levels of users who performed valid write operations on the target file within a preset time window) stored in the data acquisition module 1. Combining this with the logical owner anchor and organizational structure graph, it calculates a jurisdiction score for each candidate user. The score comprehensively considers the candidate user's contribution, organizational distance from the logical owner anchor, and depth of management level within the organizational structure. The candidate user with the highest jurisdiction score is selected as the approver, and the inference confidence level is calculated based on the jurisdiction scores of all candidate users to quantify the reliability of the approver's inference results.

[0039] The administrative cost accounting submodule 34 combines the hierarchical distance between the target user and the approver in the organizational chart, the relationship between departments, and the inference confidence generated by the approver inference submodule 33. It then uses a preset evaluation model to comprehensively determine the administrative cost, which directly reflects the administrative communication difficulty required to restore the target user's access rights.

[0040] The permission processing module 4 is the core of the system's decision execution. It receives the physical disconnection degree output from the physical disconnection degree calculation module 2 and the administrative cost output from the administrative cost determination module 3, and executes differentiated permission governance actions to ensure that permission management balances system security and business continuity. This module can be implemented through the file system's permission control interface in conjunction with the server-side execution program, and includes three sub-modules:

[0041] The threshold determination submodule 41 presets a first threshold (disconnection tolerance threshold) and a second threshold (impedance circuit breaking threshold). It compares the physical disconnection degree with the first threshold and the administrative cost with the second threshold. Based on the comparison results, it determines the corresponding permission processing path: when the physical disconnection degree is less than or equal to the first threshold, it triggers permission renewal; when the physical disconnection degree is greater than the first threshold and the administrative cost is less than or equal to the second threshold, it triggers physical removal of permission; when the physical disconnection degree is greater than the first threshold and the administrative cost is greater than the second threshold, it triggers permission management freeze.

[0042] The permission action execution submodule 42 calls the file system access control interface to perform specific operations based on the processing path determined by the threshold determination submodule 41: when renewing permissions, it updates the validity period of the user access control entry; when physically removing permissions, it completely removes the user's access permissions from the file access control list; when freezing permissions, it retains the user's read-only permissions and removes operation permissions such as modification, deletion, and permission change.

[0043] The status recording submodule 43 records the operation results of the permission action execution submodule 42 throughout the entire process, including information such as processing time, target user, target file, physical disconnection degree value, administrative cost value, and executed permission action. The records are stored in the audit log database for easy follow-up query by the administrator, and at the same time provide data support for the optimization and adjustment of system thresholds.

[0044] Please see Figure 2 This document illustrates a flowchart of a shared access method for an enterprise-level file management system according to an embodiment of the present invention. The shared access method for the enterprise-level file management system includes:

[0045] S1. Based on the access permissions of the target user to the target file to be evaluated, obtain the physical disconnect degree, which characterizes the degree of business disconnect between the target user and the target file.

[0046] In one possible implementation, the method for obtaining the physical disjointness can be specifically implemented through the following steps S11 to S13, which are explained in detail below:

[0047] S11. Obtain the total number of document revisions for which the target document has undergone valid content changes.

[0048] Specifically, a dedicated log collection agent is deployed on the core server nodes of the enterprise-level storage environment. It establishes a long connection with the storage system through the native API interface of the file system and accesses the raw file system audit log stream in real time. These logs contain a large amount of redundant operation information. It is necessary to first parse the operation command code of each log record and split the log stream into a read stream and a write stream. The write stream includes records with operation command codes of writing data, appending data, or modifying key attributes. These records correspond to substantial changes in file content or core attributes and are the basis for statistically analyzing effective file changes.

[0049] For write streams, deduplication and debouncing are required: Editors typically have an auto-save function, which can trigger numerous consecutive write requests to the same file within a short period. Directly counting these requests could lead to an artificially high version number. Therefore, a minimum revision interval threshold is set (e.g., configured as 3600 seconds). The system maintains a record of valid write timestamps for each file by the corresponding user. When a new write operation by the same user to the same file is detected, the difference between the current operation timestamp and the previous valid write timestamp is calculated. If this difference is less than the minimum revision interval threshold, it is considered a continuation of the same editing transaction, and the version count is not incremented. If the difference is greater than or equal to the threshold, it is considered a new substantive revision. Simultaneously, a globally monotonically increasing integer counter (i.e., the total number of file revisions) is maintained for each file object, and this counter increments synchronously with each valid revision.

[0050] In addition, to address the issue of active contributors being misjudged as disconnected due to the lack of log reading, the system simultaneously queries the user behavior records of the initiator of the operation when determining a valid write operation and incrementing the total number of file revisions. The system updates the last time the user viewed the current file with the timestamp of the current operation, ensuring that write behavior is considered the highest priority interaction. This avoids the loophole of judging a user as disconnected simply because no read log was generated, thus ensuring that the statistics of the total number of file revisions accurately reflect file changes and are correlated with the actual interaction status of users.

[0051] S12. Obtain the last revision number of the target user.

[0052] The last revision number retrieved was the total number of historical revisions of the target file when the target user last interacted with the target file.

[0053] Specifically, when it is necessary to evaluate the access permissions of a target user to a target file, the query interface of the user behavior history database is first called to retrieve all operation records of the target user for the target file. The operations here include explicit read operations and write operations with implicit viewing intentions. This is because during the file revision count, write operations have synchronously updated the user's last viewing time, so both types of operations are considered as valid interactions between the user and the file.

[0054] The system extracts the timestamp corresponding to the last valid interaction of the target user from the search results, then calls the interface of the file version history database to query the total number of historical revisions of the target file under that timestamp, and uses it as the last viewed revision number. In actual implementation, differentiated processing is required for different scenarios: if the target user has write operation records for the target file, it means that the user directly participated in the business iteration of the file, and the total number of historical file revisions corresponding to the last write operation is used as the last viewed revision number; if the target user only has view operation records for the target file, the file version corresponding to the last view operation is used as the last viewed revision number; if the target user's operation records for the target file are empty, the initial creation version of the target file (corresponding to revision number 0) is used as the last viewed revision number, which means that the user has never interacted with the file.

[0055] S13. Determine the physical disconnect based on the total number of document revisions and the revision number last viewed.

[0056] Specifically, after obtaining the total number of current file revisions for the target file and the last revision number viewed by the target user, the physical disconnect is determined by calculating the difference between the total number of file revisions and the last revision number viewed. This calculation uses the overall change process of the file as a reference. Through the difference relationship, it directly quantifies the number of file business iterations that the target user has not followed since the last interaction. If the physical disconnect is 0, it means that the user's current business understanding is in sync with the latest file status. If the physical disconnect is greater than 0, the larger the value, the more file changes the user has missed, the more outdated the business understanding, and the higher the probability that the file access permissions held by the user have become redundant permissions.

[0057] By linking file changes with version nodes of user interactions, the traditional single time-based judgment logic is replaced. This can accurately distinguish between scenarios where files have not been changed for a long time (physical disconnection is 0) and scenarios where users have not interacted for a long time (physical disconnection is greater than 0), avoiding accidental deletion of permissions for archive-type static files, and providing a more accurate basis for permission management.

[0058] S2. When the physical disconnection meets the preset triggering conditions, determine the administrative cost required to restore access permissions based on the difficulty of restoring the effective approval link of the target file.

[0059] In one possible implementation, the physical disconnection degree meeting the preset trigger conditions includes: when the physical disconnection degree is greater than a first threshold (for example, the first threshold is configured as 5, representing that the user missed more than 5 valid substantive changes to the target file), the system initiates an administrative cost calculation process. This process quantifies the administrative communication and process costs required to restore the target user's access rights by determining the difficulty of restoring the effective approval chain of the target file. The method for determining administrative costs can be specifically implemented through the following S21 to S22, which are explained in detail below:

[0060] S21. Identify the approvers in the effective approval chain of the target document and determine the confidence level of the inferred approvers.

[0061] In some implementations, the method for determining the approver of the valid approval chain of the target document includes: firstly, obtaining the registered owner account information of the target document and the organizational structure diagram of the enterprise. This diagram is an account status directory tree built in memory after the system periodically synchronizes all organizational data. It includes personnel nodes, organizational unit nodes and the hierarchical relationship between nodes. Each personnel node also maintains a status bit to indicate whether the account is in an active state.

[0062] Next, the validity of the registered owner account is verified according to the organizational structure diagram. If the registered owner account is valid, that is, the node corresponding to the account is found in the diagram and its status bit is 1 (representing that the account is active, employed, and has approval capabilities), then the registered owner account is identified as the approver, and the confidence level of the inferred approver is set to 1.0, which means that the permission restoration path is clear and there is no additional search cost. If the registered owner account is invalid or does not exist, that is, the account cannot be found (the account has been physically deleted) or the account node is found but the status bit is 0 (representing that the account is disabled, locked, or the employee has left the company), then the logical owner anchor point is reconstructed according to the organizational structure diagram, and the approver is inferred from the logical owner anchor point.

[0063] The method for reconstructing logical owner anchors based on the organizational structure graph includes: if the registered owner account is in an invalid state, that is, the account node can be retrieved but the status bit is 0, then the invalid node corresponding to the registered owner account is used as the logical owner anchor; if the registered owner account does not exist, that is, the account cannot be retrieved, then the organizational unit to which the registered owner last belonged is determined based on the metadata of the target file, and the node corresponding to the organizational unit is used as the logical owner anchor, ensuring that even if the original account disappears, organizational coordinates can be established through its business unit, avoiding process deadlock.

[0064] The method for inferring approvers based on logical owner anchors includes: obtaining a list of recently active contributors to the target file; this list includes user identifiers and contribution levels (cumulative valid write frequency) of users who have performed valid write operations on the target file within a preset time window (e.g., configured as 90 days). For each candidate user in the recently active contributor list, their jurisdiction score is calculated based on three dimensions:

[0065]

[0066] In the formula, The cumulative effective write frequency (i.e., contribution) of the i-th candidate user to the target file within the preset time window. Let i be the node of the i-th candidate user in the organizational structure graph; The node in the organizational chart that serves as the logical owner anchor point;

[0067] First item The natural logarithm of the contribution of candidate users is taken to compress the numerical advantage of high-frequency writers and avoid masking the influence of other dimensions.

[0068] Second item Based on the distance between the candidate user and the logical owner anchor point in the organizational structure graph (i.e., the shortest path hop count). For example, if the anchor point is a department node and the candidate is an employee in the same department, with a distance of 1, take the reciprocal of the jump number plus 1 to reflect the proximity effect. The closer a user is to the original business department, the higher the likelihood of taking over the business.

[0069] Third item A hierarchy correction factor is introduced, which is calculated by the ratio of a baseline constant to the depth of the management hierarchy of candidate users in the organizational chart (which is not zero). For example, if the baseline constant is configured as 10, the candidate user is a department manager, and the level depth is 3, then the level correction factor is 10 / 3≈3.33, which is used to quantify the weight of the user's management level and correct the logical deviation that a high write frequency means the user has the right to approve. The higher the organizational level of the candidate user (the smaller the level depth), the larger this value is, which represents the stronger their management influence.

[0070] The jurisdictional score of the i-th candidate user is determined by multiplication fusion. The higher the value, the more the user meets the approver's core requirements.

[0071] Once the jurisdiction scores of all candidate users have been calculated, the candidate user with the highest jurisdiction score will be presumed to be the approver.

[0072] At this point, the methods for determining the confidence level of the inferred approver include: determining the confidence level based on the jurisdiction scores of candidate users in the recent active contributor list. :

[0073]

[0074] In the formula, The maximum score among all candidate users; M is the number of all candidate users; The sum of the jurisdictional scores for all candidate users; This is a preset very small positive number (e.g., 0.001) to avoid the denominator being zero;

[0075] The highest jurisdiction score is divided by the sum of the jurisdiction scores of all candidate users and the sum of the preset minimum positive number. The final confidence score is between 0 and 1. The closer the value is to 1, the more reliable the approver's inference is.

[0076] Specifically, if the registered owner account does not exist in the organizational chart, and the target file's metadata cannot be traced back to any historical organizational unit (e.g., corrupted metadata fields, partial storage media failure leading to record loss, or the file being imported from a deregistered external system without organizational affiliation), then it is determined that the logical owner anchor cannot be determined through conventional reconstruction methods. In this extreme case, to maintain the integrity of the permission governance process and avoid indefinite suspension, the system will automatically trigger a circuit breaker rollback mechanism: directly designating the current administrator group of the storage space to which the target file belongs (such as a shared directory or project bucket), or the global system super administrator account, as the approver. Simultaneously, the confidence level of the inferred approver will be... Set as preset minimum value This explicitly marks the approval process as a forced rollback path, thereby reflecting its high impedance characteristics in subsequent administrative cost calculations and prompting administrators to manually intervene to repair metadata or adjust permission ownership.

[0077] S22. Determine administrative costs based on the relationship between the target user and the approver in the organizational chart and the confidence level.

[0078] Specifically, the system first obtains the target user. With the approver Shortest path hops in an organizational chart (i.e., physical administrative distance; for example, if the target user and the approver belong to the same department, the jump count is 2), and a cross-departmental penalty constant is set. (For example, if configured to 5, and the target user and approver belong to different business departments, this constant is added on top of the physical administrative distance), used to quantify the process resistance of cross-business unit approvals; subsequently combined with inferences about the approver's confidence level. The calculation involves summing the physical administrative distance and the cross-departmental penalty constant, dividing by the confidence level, and then comparing the result with a preset cutoff threshold. The smaller of the values ​​(e.g., configured as 100) yields the final administrative cost. , represented as:

[0079]

[0080] Administrative costs The administrative resistance index represents the administrative resistance required to restore access permissions to a target user. The higher the value, the more complex the administrative process for restoring permissions and the higher the communication costs.

[0081] Furthermore, before actually calculating administrative costs, it is necessary to assess the confidence level of the approving authority. Perform a validity determination. If... If the confidence level is below the preset effective threshold (e.g., 0.1), it indicates that the approver's inference is highly unreliable, and it is almost impossible to locate the valid approver when actually restoring permissions; the permission restoration path has been substantially broken. At this point, the system no longer applies the conventional calculation formula but directly sets the administrative cost... Equal to the preset cutoff threshold Furthermore, an "Approver unknown" marker is added to the audit log for administrators to monitor closely. This approach avoids numerical instability caused by division operations under extremely low confidence levels and directly reflects the physical reality of the permission recovery process, ensuring that permission governance strategies still have clear decision-making basis even in extreme situations.

[0082] S3. Determine the handling method for access permissions based on the degree of physical disconnect and administrative costs.

[0083] Specifically, the system first completes the engineering setting of governance decision thresholds to clarify the judgment criteria for permission processing. Among them, the first threshold (disconnect tolerance threshold) used to define whether a user has substantially stopped following up on business is calculated by statistically analyzing the average revision frequency of all files in the storage system (e.g., an average of 1 revision per month) and combining it with the enterprise's compliance audit cycle (e.g., configured as 5 months). Multiplying the two results in 5, meaning that if a user is more than 5 file versions behind, it is considered a business disconnect. The second threshold (resistance circuit breaker threshold) used to define the upper limit of administrative costs for permission restoration is determined by calculating the administrative costs of all existing permissions and generating a distribution histogram. The P75 quantile of this distribution is selected (e.g., a statistically derived quantile of 8.0). This value represents the maximum resistance that the enterprise's regular approval process can tolerate. Exceeding this value is considered a non-standard process, and permission restoration is very likely to fail.

[0084] After setting the threshold, the system iterates through the permission entries to be evaluated, substitutes the real-time calculated physical disconnect and administrative costs into the dual threshold verification logic, and executes the corresponding permission processing method:

[0085] If the physical disconnect is less than or equal to the first threshold, the access permission will be automatically renewed. At this point, the number of unread file versions is within the acceptable range, indicating that the user's business status is largely synchronized with the file status, or that the file itself is archived and unchanged. Regardless of administrative costs, this permission is considered a valid asset. The system will call the file system's access control interface to update the validity period field of the user's access control entry, extending its validity to the next governance cycle (e.g., 180 days later). Simultaneously, it will be marked as "Renewal_Activation (RENEW_ACTIVE)" in the audit log, thus preserving the user's valid access permissions while ensuring that the permissions remain within the scope of periodic governance tracking.

[0086] If the physical disconnect exceeds the first threshold and the administrative cost is less than or equal to the second threshold, then the access permission will be physically removed. At this point, the user is severely disconnected, but the administrative resistance to restoring permissions is low. Even if accidental deletion occurs, the user can quickly regain permissions through their direct supervisor or the clearly identified file owner. These permissions are considered low-risk redundancy. The system will completely remove the user's access control entry from the file's access control list, releasing the corresponding storage quota and metadata space. Simultaneously, it will mark the entry as "PURGE_SAFE" in the audit log. This cleans up redundant permissions without affecting business continuity due to the low recovery cost.

[0087] If the physical disconnect exceeds the first threshold and the administrative cost exceeds the second threshold, the access permission will be frozen. This freezing includes restricting access to read-only. While the user is now disconnected, the excessive administrative cost means a very high risk of permission restoration, potentially leading to jurisdictional confusion or excessively long approval paths. Direct deletion could result in a deadlock where users cannot find the approver when reviewing data later. The system triggers an impedance circuit breaker mechanism: first, it downgrades the access control entry, not removing it directly, but modifying its permission mask, removing write, delete, and change permissions, retaining only read and execute permissions; then, it adds a custom "frozen (ATTR_FROZEN)" flag using the access control entry's extended flag or file's extended attributes; finally, it marks it as "freeze_protect (FREEZE_PROTECT)" in the audit log. This operation curbs the potential damage risk of zombie accounts, preserves the user's access channel, ensures the traceability of historical business, and solves the operational challenge of not deleting files without owner permissions.

[0088] Based on the above technical solution, by first obtaining the physical disconnect degree that characterizes the degree of disconnect between the target user and the target file business, and then determining the administrative cost of permission restoration based on the difficulty of restoring the effective approval link when the triggering conditions are met, and finally combining the two to determine the permission processing method, the shortcomings of the traditional single silent time judgment logic that ignores the file evolution status and permission restoration cost are effectively avoided. It can accurately identify the real redundant authorization, and avoid the deadlock of the process of accidentally deleting the permissions of archived files and restoring the permissions of ownerless files. It achieves differentiated permission governance that takes into account system security, compliance and business continuity.

[0089] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0090] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0091] In this embodiment of the invention, the shared access device of an enterprise-level file management system can be divided into functional units according to the above method example. For example, each function can be divided into its own functional unit, or two or more functions can be integrated into one processing unit. The integrated unit can be implemented in hardware or as a software functional unit. It should be noted that the unit division in this embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0092] This invention also provides a hardware structure diagram of an electronic device, see below. Figure 3 The electronic device 300 includes a processor 301, and optionally, a memory 302 connected to the processor 301.

[0093] In the first possible implementation, see Figure 3 The electronic device 300 also includes a transceiver 303. The processor 301, memory 302, and transceiver 303 are connected via a bus. The transceiver 303 is used to communicate with other devices or communication networks. Optionally, the transceiver 303 may include a transmitter and a receiver. The device in the transceiver 303 that implements the receiving function can be considered as a receiver, which is used to perform the receiving steps in the embodiments of the present invention. The device in the transceiver 303 that implements the transmitting function can be considered as a transmitter, which is used to perform the transmitting steps in the embodiments of the present invention.

[0094] Based on the first possible implementation method Figure 3 The structural diagram shown can be used to illustrate the structure of the electronic device involved in the above embodiments.

[0095] in, Figure 3 This can also be illustrated by a system chip in an electronic device. In this case, the actions performed by the aforementioned electronic device can be implemented by this system chip; the specific actions performed can be found above and will not be repeated here.

[0096] This invention also provides a computer storage medium storing a computer program, which, when executed by a processor, causes the computer to perform any of the methods described above.

[0097] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings and the disclosure, will understand and implement other variations of the disclosed embodiments in carrying out the claimed invention. In this invention, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit can implement several of the functions listed in this invention.

[0098] Although the invention has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made therein without departing from the spirit and scope of the invention. Accordingly, this specification and drawings are merely illustrative of the invention and are to be considered as covering any and all modifications, variations, combinations, or equivalents within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if such modifications and modifications of the invention fall within the scope of the invention and its equivalents, the invention is also intended to include such modifications and modifications.

Claims

1. A method for shared access of an enterprise file management system, characterized in that, include: For the access permissions of the target user to the target file to be evaluated, obtain the physical disconnect degree, which characterizes the degree of business disconnect between the target user and the target file; When the physical disconnection meets the preset triggering conditions, the administrative cost required to restore access permissions is determined based on the difficulty of restoring the effective approval chain of the target file. The method for handling the access permissions is determined based on the physical disconnect and the administrative costs.

2. The method of claim 1, wherein, Obtaining the physical disconnect degree, which characterizes the degree of business disconnect between the target user and the target file, includes: Obtain the total number of document revisions that have resulted in valid content changes to the target file; Obtain the last viewed revision number corresponding to the target user; the last viewed revision number is the total number of historical file revisions corresponding to the target file when the target user last interacted with the target file; The physical disconnect is determined based on the total number of document revisions and the last revision number viewed.

3. The method of claim 2, wherein, The physical disconnection degree meets the preset triggering conditions, including: the physical disconnection degree is greater than a first threshold; The administrative costs required to restore access permissions are determined based on the difficulty of restoring the effective approval chain of the target document, including: Identify the approvers in the valid approval chain of the target document and determine the confidence level of the inferred approvers; The administrative cost is determined based on the relationship between the target user and the approver in the organizational chart and the confidence level.

4. The method of claim 3, wherein, The approvers in the valid approval chain of the target document include: Obtain the registered owner account information and the enterprise's organizational chart of the target file; Verify the validity of the registered owner's account based on the organizational chart; If the registered owner account is valid, then the registered owner account will be identified as the approver; If the registered owner account is invalid or does not exist, the logical owner anchor is reconstructed based on the organizational chart, and the approver is inferred based on the logical owner anchor.

5. The method of claim 4, wherein, Based on the organizational structure diagram, the logical owner anchor points are reconstructed, including: If the registered owner account is in an invalid state, then the invalid node corresponding to the registered owner account is used as the logical owner anchor point; If the registered owner account does not exist, the organizational unit to which the registered owner last belonged is determined based on the metadata of the target file, and the node corresponding to the organizational unit is used as the logical owner anchor point.

6. The method of claim 4, wherein, Inferring the approver based on the logical owner anchor includes: Obtain a list of recently active contributors to the target file; the list of recently active contributors includes user identifiers and contribution levels of users who have performed valid write operations on the target file within a preset time window; For each candidate user in the list of recently active contributors, a management score is determined based on the candidate user's contribution, the distance between the candidate user and the logical owner anchor point in the organizational structure graph, and the depth of the candidate user's management level in the organizational structure graph. The candidate user with the highest jurisdictional score is presumed to be the approver; Determining the confidence level of the presumed approver includes: The confidence level is determined based on the jurisdictional ratings of candidate users in the list of recently active contributors.

7. The method of claim 3, wherein, Based on the physical disconnect and the administrative costs, determine the processing method for the access permissions, including: If the physical disconnect is less than or equal to the first threshold, then the access permission is determined to be automatically renewed. If the physical disconnect is greater than the first threshold and the administrative cost is less than or equal to the second threshold, then the processing method for the access permission is determined to be physical removal. If the physical disconnect is greater than a first threshold and the administrative cost is greater than a second threshold, then the access permission is determined to be subject to management freeze; the management freeze includes restricting the access permission to read-only.

8. The method of claim 2, wherein, Obtaining the last viewed revision number corresponding to the target user includes: If the target user has write operation records for the target file, the total number of historical file revisions corresponding to the last write operation will be the last viewed revision number; If the target user only has a record of viewing the target file, the file version corresponding to the last viewing operation will be used as the last viewing revision number; If the target user's operation record for the target file is empty, the initial creation version of the target file will be used as the last viewed revision number.

9. An electronic device, comprising: It includes a processor and a memory, the memory storing a computer program that, when executed by the processor, implements the method as described in any one of claims 1 to 8.

10. A computer storage medium, characterized in that, The computer storage medium stores a computer program, which, when executed by a processor, implements the method as described in any one of claims 1 to 8.

Images