A document management method and system with dynamic permissions and a storage medium

Abstract

This application provides a document management method, system, and storage medium with dynamic permissions, relating to the field of data security. It solves the technical problem of achieving seamless, continuous, and high-precision identity authentication without relying on physical hardware intervention. The method includes: acquiring micro-data of the user during a silent period before performing document operations; determining the user's current operational behavior factors based on the micro-data, determining the baseline behavior factors of the current account based on historical operational behavior factors, and then determining a similarity factor one between the user and the account; simultaneously setting a similarity factor two based on the current time and location; and finally setting the current user's permissions based on similarity factor one and similarity factor two. This application can effectively improve the security and user experience of document management.

Description

Technical Field

[0001] This application relates to the field of data security, and in particular to a document management method, system, and storage medium with dynamic permissions. Background Technology

[0002] Currently, in the field of document security management, traditional access control solutions typically rely on static account password authentication or two-factor authentication based on physical hardware, such as fingerprint scanners and cameras. However, static passwords are prone to account theft due to overly simple user settings or theft, leading to data leakage risks. While introducing physical hardware authentication can improve security, it not only increases hardware deployment costs and limits the flexibility of application scenarios, but also easily affects user experience due to device failures or user concerns about privacy leaks. In addition, existing behavioral recognition technologies are often based on macro-level operational habits, such as login duration and operation frequency, making it difficult to accurately identify the operator's micro-biometric characteristics without the user's awareness. This makes it ineffective in dealing with scenarios such as account sharing, short-term borrowing, or automated script attacks, resulting in security blind spots in document management.

[0003] Therefore, this invention discloses a document management method, system, and storage medium with dynamic permissions to solve the above-mentioned technical problems. Summary of the Invention

[0004] This application provides a document management method, system, and storage medium with dynamic permissions, which solves the technical problem that existing technologies cannot perform seamless, continuous, and high-precision identity authentication without relying on physical hardware intervention.

[0005] To achieve the above objectives, this application adopts the following technical solution: Firstly, a document management method with dynamic permissions is provided, including: Acquire microscopic data during the silent period before the user performs a document operation; wherein, the document operation includes opening a document, editing content, copying content, or printing a document; the silent period is the last m milliseconds window before the user moves the mouse to the target button and performs the document operation; the microscopic data includes micro-movement acceleration, the rate of change of click pressure and contact area, the rhythm interval of mouse double-clicks, and micro-dwell time; m is determined based on the "terminal execution" stage of human brain signal transmission to muscles, and can be a value of 1000 milliseconds; Based on the micro data, determine the user's current operational behavior factor; based on the historical operational behavior factors within the previous n days, determine the baseline behavior factor of the current account; based on the operational behavior factor and the baseline behavior factor, determine the user and account similarity factor one; and based on the current time and current location, set similarity factor two. The permissions for the current user are set based on similarity factor one and similarity factor two.

[0006] In conjunction with the first aspect mentioned above, one possible implementation involves obtaining micro-data during the silent period before the user performs document operations, including: When a user performs actions such as opening a document, editing content, copying content, or printing a document, the acceleration of the mouse as it approaches the target is identified in the last m milliseconds before the user moves the mouse to the target button and performs the document operation, and the acceleration is marked as micro-movement acceleration. The mouse's pressure sensor identifies the rate of change in mouse click pressure and contact area within the last m milliseconds before the user moves the mouse to the target button and clicks it. The interval duration of mouse double-clicks is obtained. Interval durations shorter than a double-click duration threshold are removed and grouped into duration groups. The maximum, minimum, and average values ​​in the duration groups are obtained, and the maximum, minimum, and average values ​​are weighted to calculate the rhythm interval of mouse double-clicks. The rhythm interval is then normalized. The weights used in the weight calculation are manually set; for example, the maximum value has a weight of 0.2, the minimum value has a weight of 0.3, and the average value has a weight of 0.5. The micro-dwell time between when the mouse cursor enters the button's hotspot and when the document operation occurs is obtained; wherein, the button's hotspot is the area covering the target button and the surrounding preset buffer, the size of which is manually set.

[0007] In conjunction with the first aspect above, in one possible implementation, determining the user's current operational behavior factors based on the micro-data includes: Extracting micro-motion acceleration For micro-motion acceleration The jerk is obtained by performing first-order difference processing. Extract the jerk The peak accelerometer, average accelerometer, and number of zero crossings are calculated; the peak accelerometer within the last m millisecond window is extracted. , average jerk And accelerate the number of times to pass the zero point ; for peak jerk , average jerk And accelerate the number of times to pass the zero point After performing Min-Max normalization, they are combined into a three-dimensional column vector. ; wherein, the jerk Satisfy the calculation formula , The sampling interval; Within the last m millisecond window, a pressure change rate sequence is constructed using the sampling time point as an index. and contact area change rate sequence ;in, To ensure that the pressure change rate sequence and the contact area change rate sequence have the same length and are strictly aligned on the time axis, the number of sampling points is specified. Calculate the pressure change rate sequence respectively and contact area change rate sequence The mean of the pressure change rate sequence and contact area change rate sequence Subtracting the mean of the corresponding sequence from each data point yields a decentralized sequence of pressure change rates. and contact area change rate sequence And based on the calculation formula (1), the pressure change rate sequence is determined. and contact area change rate sequence Synchronization indicators between Among them, when the synchronicity index When the value is close to 1, it indicates a high positive correlation between the increase in click pressure and the expansion of the finger contact area, consistent with the muscle physical characteristics of normal finger pressing; when the synchronicity index... When the value is close to 0 or negative, it indicates poor synchronization between the two, which may indicate abnormal operation or machine simulation operation. Extracting 3D column vectors Synchronization indicators Rhythm interval and duration of micro-dwelling And the user's current operational behavior factors are determined by calculation formula (2). ; The calculation formula (1) is: ; In the formula, This is the number of the sampling time point, with a value range of [value range missing]. ; The calculation formula (2) is:

[0008] In equation (2), This is the average synchronization metric for the current account over the last r days; This represents the average rhythm interval of the current account over the last r days. This represents the average micro-stay time of the current account over the last r days, where r is set based on the account's usage frequency. , , and To be based on a three-dimensional column vector Synchronization indicators Rhythm interval and duration of micro-dwelling The importance setting of the proportion adjustment factor, and .

[0009] In conjunction with the first aspect mentioned above, one possible implementation involves determining the baseline behavior factors for the current account based on historical operational behavior factors within the previous n days, including: Obtain the variance of historical operational behavior factors within the previous n days, and determine whether the variance is less than a variance threshold. If yes, calculate the average of the historical operational behavior factors to obtain the baseline behavioral factor for the current account. If no, remove the historical operational behavior factors that differ the most from the average of the historical operational behavior factors, recalculate the variance of the remaining historical operational behavior factors, and re-determine the variance until the variance of the remaining historical operational behavior factors is less than the corresponding set value. Then, calculate the average of the remaining historical operational behavior factors to obtain the baseline behavioral factor for the current account. Here, n is obtained manually, and the variance threshold is obtained empirically.

[0010] In conjunction with the first aspect mentioned above, in one possible implementation, the similarity factor between users and accounts is determined based on operational behavior factors and baseline behavior factors, including: A1: Place the time within the current operational behavior factor Pre-operational behavior factors The behavioral factors to be labeled are sorted in chronological order from latest to earliest to obtain the total number of behavioral factors to be labeled. Based on number Extract the behavioral factors to be labeled sequentially Obtain the behavior factor to be labeled With current operational behavior factors The average of the differences between them is used to determine whether the average value is greater than the average value threshold. If so, the number of the behavior factor to be labeled is assigned to a number less than the threshold value. Unlabeled behavioral factors Marked as reference behavioral factor If not, proceed to A2; where, Behavioral factors to be labeled The number, Reference behavioral factors The number; the average threshold is set based on the importance of the current account and is inversely proportional to the importance of the current account; A2: Based on number Extract the behavioral factors to be labeled sequentially Obtain the behavior factor to be labeled With current operational behavior factors Between each adjacent unlabeled behavioral factor Unlabeled behavioral factors With current operational behavior factors The difference is calculated, and the average of the differences is obtained. It is then determined whether the average value is greater than a threshold value. If so, the number less than the value of the behavior factor to be labeled is assigned. Unlabeled behavioral factors Marked as reference behavioral factor If not, proceed to step A2 to examine the reference behavioral factors. Acquisition; A3: Extracting operational behavior factors Benchmark behavioral factors Number of abnormal operations that occurred within the hour prior to the current time The similarity factor between users and accounts is determined by formula (3). ; The calculation formula (3) is: ; In equation (3), The standard abnormal operation count is obtained based on the average number of abnormal operations per hour for the current account. When the average number of abnormal operations per hour is 0, the standard abnormal operation count is set to the minimum threshold value set manually. Reference behavioral factors With current operational behavior factors The maximum duration between, The standard duration is set based on the importance of the current account; It is an amplitude adjustment coefficient determined based on the effect of document operation time on human fatigue in the experiment, and The value range is [0, 0.5].

[0011] In conjunction with the first aspect mentioned above, one possible implementation involves setting a similarity score based on the current time and location, including: Based on historical time and historical location, determine the frequently used time range and frequently used location range, and extract the current time and current location of the user when performing the current document operation; If the current time is within a commonly used time range and the current location is within a commonly used location range, the similarity score 2 will be set to the maximum value of the similarity standard range. The similarity standard range is obtained based on the historical average similarity score 1 of the current account, and is generally set to 50% to 70% of the historical average similarity score 1. If historical data is lacking, the system's default value of 50% to 70% is generally used. If only the current time is within the commonly used time range, or only the current location is within the commonly used location range, the similarity score will be the median value of the similarity standard range. If the current time is not within the commonly used time range and the current location is not within the commonly used location range, the similarity score will be set to the minimum value of the similarity standard range.

[0012] In conjunction with the first aspect mentioned above, one possible implementation involves determining the commonly used time range and the commonly used location range based on historical time and historical location, including: Extract the historical time and location of document operations performed by the current account. Divide the day into several time periods and obtain the number of times document operations occurred in each time period. Mark the time periods with a time count greater than a time count threshold as common time ranges. Mark the number of times document operations occurred in each historical location as the location count for that historical location. Mark historical locations with a location count greater than a location count threshold as common locations. Mark the area within a preset buffer range of the common locations as a common location range. The time count threshold is determined based on the average time count corresponding to the time periods of several accounts, the location count threshold is determined based on the average location count corresponding to the historical locations of several accounts, and the preset buffer range is manually set.

[0013] In conjunction with the first aspect mentioned above, one possible implementation involves setting the current user's permissions based on similarity factor one and similarity factor two, including: Extracting similarity factor 1 And similarity factor two, for the similarity factor one The total similarity factor is obtained by weighting the similarity factor and the similarity factor 2. When the total similarity factor is greater than the similarity factor threshold 1, the document operation performed by the user is marked as a normal operation. When the total similarity factor is not greater than similarity factor threshold one, but greater than similarity factor threshold two, the document operation performed by the user is marked as suspected non-user operation, triggering enhanced audit mode; wherein, enhanced audit mode includes allowing users to view document content and perform manually set non-sensitive editing, prohibiting copying content, printing documents and exporting files, and full-screen recording; wherein, similarity factor threshold one and similarity factor threshold two are obtained through manual setting, and similarity factor threshold one is greater than similarity factor threshold two; When the total similarity factor is not greater than the similarity factor threshold of two, the document operation performed by the user is marked as an abnormal operation, the number of abnormal operations is recorded, and the circuit breaker protection is triggered; wherein, the circuit breaker protection includes automatically locking the document and forcibly logging out.

[0014] Secondly, a document management system with dynamic permissions is provided, including: a communication unit and a processing unit; The communication unit is used to acquire microscopic data during the silent period before the user performs a document operation; wherein, the document operation includes opening a document, editing content, copying content, or printing a document; the microscopic data includes micro-movement acceleration, the rate of change of click pressure and contact area, the rhythm interval of mouse double-click, and micro-dwell time; The processing unit is used to determine the user's current operation behavior factor based on the micro data, determine the baseline behavior factor of the current account based on the historical operation behavior factors within n days prior to the current time, determine the similarity factor one between the user and the account based on the operation behavior factor and the baseline behavior factor, set the similarity factor two based on the current time and current location, and set the permissions of the current user based on the similarity factor one and the similarity factor two.

[0015] Thirdly, this application provides a storage medium storing instructions that, when executed on a document management system with dynamic permissions, cause the document management system with dynamic permissions to perform the methods described in the first aspect and any possible implementation thereof.

[0016] This application provides a document management method, system, and storage medium with dynamic permissions, which has the following advantages: 1. This invention obtains micro-data from a user during a silent period before performing document operations; determines the user's current operational behavior factors based on the micro-data; determines the baseline behavior factors of the current account based on historical operational behavior factors within n days prior to the current time; determines a similarity factor one between the user and the account based on the operational behavior factors and the baseline behavior factors; sets a similarity factor two based on the current time and location; and sets the current user's permissions based on similarity factor one and similarity factor two. This invention solves the technical problem of existing technologies' difficulty in performing seamless, continuous, and high-precision identity authentication without relying on physical hardware intervention. This invention can effectively improve the security of document management and user experience.

[0017] 2. This invention, through the step of determining similarity factor one based on operational behavior factors and benchmark behavior factors, profoundly solves the limitations of traditional identity determination based on system online time. Its core lies in realizing the leap from simple time measurement to feature recognition based on behavioral essence, thereby effectively avoiding the blind spot caused by frequent user switching of accounts in a short period of time.

[0018] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0019] Figure 1 A schematic diagram illustrating the steps of a document management method with dynamic permissions provided in an embodiment of this application; Figure 2 This is a schematic diagram of a document management system with dynamic permissions provided in an embodiment of this application. Detailed Implementation

[0020] In the description of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. The "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0021] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0022] like Figure 1 As shown in the embodiment of this application, a document management method with dynamic permissions is provided, including: S1: Acquire microscopic data during the silent period before the user performs document operations; where document operations include key actions involving data flow or viewing, such as opening a document, editing content, copying content, or printing a document. The silent period is defined as the last m milliseconds before the user moves the mouse to the target button and performs a document operation. In this embodiment, m is determined based on the "terminal execution" stage of human brain signal transmission to muscles, and is preferably set to 1000 milliseconds. Specifically, this time window setting has profound neurophysiological basis: after the brain issues the operation command, the nerve signal is transmitted to the hand muscles, causing contraction, which in turn drives the mouse to move. In the short time before approaching the target, such as 1000 milliseconds, the user's conscious control gradually weakens, while the inherent characteristics of muscle memory and neuromuscular control dominate. The micro-tremors, acceleration and deceleration characteristics exhibited at this time best reflect the user's true biological behavioral habits. If the window is too short, such as 100 milliseconds, the data sampling is insufficient, making it difficult to capture complete features; if the window is too long, it may be mixed with interference data from the user's conscious adjustment of strategies, reducing recognition accuracy. The microscopic data specifically includes micro-movement acceleration, click pressure and the rate of change of contact area, the rhythm interval of mouse double-clicks, and micro-dwell time. This data can be collected using only a regular mouse or touchpad without relying on additional hardware such as cameras or fingerprint scanners, achieving low-cost, non-invasive, and contactless authentication.

[0023] S2: Determine the user's current operational behavior factor based on the micro data, determine the baseline behavior factor of the current account based on the historical operational behavior factors within the previous n days, determine the similarity factor one between the user and the account based on the operational behavior factor and the baseline behavior factor, and set the similarity factor two based on the current time and current location. This step constructs the core logical chain from micro-features to identity determination. Specifically, the operational behavior factor is a comprehensive value obtained by quantifying the currently collected micro-data, which can represent the user's operational habits "fingerprint" at the current moment. The baseline behavior factor is a reference baseline dynamically generated based on historical data. By analyzing the historical operational behavior factors within the previous n days, the system can adaptively learn the account owner's common operation patterns, rather than using a rigid fixed threshold. Similarity factor one is used to measure the degree of matching between the current operational behavior and the historical baseline. If the two are highly consistent, it is highly likely that the account owner is operating the system; if the deviation is large, there is a risk that the operation is not performed by the account owner. At the same time, similarity factor two is introduced as an auxiliary verification in the spatiotemporal dimension, which, combined with the current time and current location, further verifies the rationality of the operating environment, thus forming a comprehensive judgment mechanism with dual factors, effectively avoiding the misjudgment that may occur with single behavioral feature identification.

[0024] S3: Set permissions for the current user based on similarity factor one and similarity factor two.

[0025] This step implements dynamic hierarchical control of permissions. Specifically, the system dynamically adjusts user operation permissions based on the weighted calculation results or logical judgment results of similarity factor one and similarity factor two. For example, when the judgment result indicates that the current operator and the account owner are highly matched, the system grants full operation permissions to ensure smooth business operations; when the judgment result indicates a low matching degree or the existence of abnormal spatiotemporal characteristics, the system automatically reduces permissions, such as prohibiting sensitive operations like copying and printing, or triggering enhanced audit mode; when the judgment result indicates an extremely high risk, the system can immediately trigger a circuit breaker and forcibly log out of the account. This mechanism integrates identity authentication into the micro-process of every document operation, building a hidden and precise dynamic security defense without disrupting the user's normal work workflow, effectively preventing data leakage risks caused by account theft, misuse, or automated script attacks.

[0026] Through the above scheme, this embodiment utilizes the "quiet period" scientifically defined by the neuromuscular control principle to accurately capture the micro-behavioral characteristics of users that are difficult to fake. This not only eliminates the dependence on physical hardware and reduces deployment costs, but also achieves continuous and seamless identity verification through dynamic baselines and dual-factor judgment logic, significantly improving the security and user experience of the document management system.

[0027] It is worth noting that this invention, by constructing a document management method based on dynamic permissions, can improve the security of identity authentication and the ability to prevent data leakage in environments without physical hardware intervention. Its core advantage lies in extending identity verification from static account and password comparison to continuous, microscopic behavioral biometric recognition. Traditional technical solutions often rely on external physical devices such as cameras and fingerprint scanners for secondary verification. This not only increases hardware costs and limits the flexibility of application scenarios, but also easily affects user experience due to device failure or privacy concerns. This invention avoids these limitations by capturing microscopic data during the silent period before the user performs document operations, achieving seamless, continuous, and highly accurate real-time identification of the operator's identity. Specifically, this invention defines the silent period as the last m milliseconds before the user moves the mouse to the target button and performs the operation. This time window is set based on the scientific principle of the "terminal execution" stage of human brain signal transmission to muscles, ensuring that the collected data can truly reflect the operator's subconscious neuromuscular control characteristics. By deeply extracting microscopic data such as micro-movement acceleration, click pressure and contact area change rates, mouse double-click rhythm intervals, and micro-dwell duration, this invention can accurately characterize a user's unique operational "fingerprint." This microscopic data is extremely difficult for others to imitate or forge through automated script attacks, thus greatly improving the level of security defense. Furthermore, this invention introduces a dynamic baseline and multi-dimensional similarity fusion judgment mechanism, giving access control strong environmental adaptability and intelligence. The system not only determines the baseline behavior factor of the current account based on historical operational behavior factors within the previous n days, and compares the consistency of biometric behavior by calculating the similarity factor between the operational behavior factor and the baseline behavior factor, but also sets a second similarity factor based on the current time and location for auxiliary verification from a spatiotemporal dimension. This comprehensive judgment using dual factors effectively overcomes the errors that may exist in single-feature recognition, ensuring the accuracy of identity recognition. In practical applications, when the system determines that the current user's behavioral characteristics highly match those of the account owner, it grants normal usage permissions, ensuring a smooth office experience for legitimate users. However, if significant deviations in operating habits are detected, the system immediately identifies the possibility of unauthorized operation and automatically lowers the current user's permissions, thus preventing data leakage risks caused by account sharing, theft, or unauthorized borrowing at the source. This silent verification method, which does not rely on cameras and does not disrupt the user's normal operating process, not only eliminates users' concerns about privacy leaks but also fills the real-time monitoring gap in the field of document security regarding the crucial question of "who is operating?" It builds a dynamic security defense line for enterprise core data assets that combines concealment, accuracy, and flexibility, possessing extremely high application value and promising prospects for widespread adoption.

[0028] In one possible implementation of this application embodiment, the above-mentioned S1 can be implemented by the following S101, which will be described in detail below: S101: When a user opens a document, edits content, copies content, or prints a document, the system identifies the mouse's acceleration as it approaches the target within the last m milliseconds before the user moves the mouse to the target button and performs the document operation. This acceleration is then marked as micro-movement acceleration. Specifically, in this embodiment, m is set to 1000 milliseconds. This time window is determined based on the physiological characteristics of human neuromuscular processes. During the final execution phase after the brain issues a command, muscle movement exhibits specific inertial characteristics. The system records the displacement change of the mouse cursor within these 1000 milliseconds at 100-millisecond sampling intervals, and calculates the micro-movement acceleration using the second derivative of displacement with respect to time. This micro-movement acceleration can sensitively capture subtle jitters, sudden stops, or smooth decelerations when the user approaches the target button. These characteristics are often determined by the user's subconscious muscle control habits and are difficult to simulate with simple scripts or perfectly replicated by others. The system uses a pressure sensor on the mouse to identify the rate of change in click pressure and contact area within the last m milliseconds before the user moves the mouse to the target button and clicks. It should be understood that with the widespread adoption of touch technology and pressure-sensitive mice, acquiring the physical parameters of the finger-device contact surface has become possible. This embodiment not only collects the absolute value of pressure but also focuses on its rate of change. For example, when a user presses a mouse button, the process of pressure rising from 0 to its peak and the synchronous expansion of the contact area constitute unique biomechanical characteristics. In normal human click operations, the increase in pressure and the expansion of the contact area are usually highly coordinated, while machine-simulated clicks often lack this microscopic physical coordination. By frequently sampling these two parameters within the last 1000 milliseconds window, the system can construct a dynamic curve reflecting the user's finger muscle elasticity and pressing habits. The system obtains the interval duration of mouse double-clicks, removes intervals shorter than a double-click duration threshold, and consolidates them into duration groups. It then obtains the maximum, minimum, and average values ​​within these duration groups and calculates the rhythm interval of the mouse double-clicks based on their weights. The rhythm interval is then normalized. The weights used in the weight calculation are manually set; for example, the maximum value has a weight of 0.2, the minimum value has a weight of 0.3, and the average value has a weight of 0.5. Specifically, the double-click rhythm is an important reflection of user operating habits. Different users exhibit significant differences in the time interval between two clicks when opening files, and the rhythm of the same user also fluctuates under different fatigue states. This embodiment sets the double-click duration threshold to 100 milliseconds to filter out extremely short intervals caused by accidental clicks. For valid double-click interval data, the system does not simply calculate the average but uses a weighted calculation to comprehensively consider the data. A higher weight is assigned to the minimum value to capture the fastest reaction speed of a user with proficient operation, while the highest weight is assigned to the average value to reflect their general operating level. The normalization operation eliminates the dimensional effects caused by the difference in sampling rates between different devices, making the calculated rhythm intervals comparable across devices. This method acquires the micro-dwell time between the mouse cursor entering the button's hotspot and the document operation occurring. The button's hotspot is the area covering the target button and a surrounding preset buffer zone, the size of which is manually set. Specifically, the micro-dwell time reflects the user's decision-making hesitation or confirmation process before performing a critical operation. To improve the robustness of the data acquisition and avoid accidental recording due to the mouse cursor quickly moving across the button's edge, this embodiment defines a button hotspot. For example, for a 40x40 pixel "Print" button, the system can set a buffer zone with a radius of 10 pixels, forming a 60x60 rectangular hotspot. Only when the cursor enters this hotspot and lingers until a click event occurs is the time recorded as the micro-dwell time. If the user is skilled, the cursor may quickly move across the hotspot and click, resulting in a very short micro-dwell time, even approaching zero. If the user is unfamiliar with the operation or has doubts, the micro-dwell time will significantly increase. This parameter provides an important basis for identifying unauthorized users' exploratory operations.

[0029] In one possible implementation of this application embodiment, the above-mentioned S2 can be implemented by the following S201, S202, S203, S204 and S205, which are described in detail below: S201: Determine the user's current operational behavior factors based on the micro-data, including: Extracting micro-motion acceleration For micro-motion acceleration The jerk is obtained by performing first-order difference processing. Extract the jerk The peak accelerometer, average accelerometer, and number of zero crossings are calculated; the peak accelerometer within the last m millisecond window is extracted. , average jerk And accelerate the number of times to pass the zero point ; for peak jerk , average jerk And accelerate the number of times to pass the zero point After performing Min-Max normalization, they are combined into a three-dimensional column vector. ; wherein, the jerk Satisfy the calculation formula , The sampling interval is defined here. This embodiment introduces jerk because when human muscles perform fine motor skills, controlled by neural signals, the application and release of force exhibit non-linear, abrupt changes, which are particularly pronounced at the jerk level. For example, when a real person suddenly stops using a mouse, the jerk shows a significant spike, while automated scripts typically use uniform or linearly variable speed models, and their jerk tends to approach zero or exhibit regular fluctuations. This step extracts the peak jerk within the last m millisecond window. , average jerk And accelerate the number of times to pass the zero point Among them, the peak jerk reflects the magnitude of the explosive force during user operation, the mean jerk reflects the overall smoothness of the motion, and the number of zero-crossings reflects the frequency of fine-tuning by the user during the approach to the target. To eliminate the influence of different user operation amplitude dimensions, the above three parameters are subjected to Min-Max normalization, forming a three-dimensional column vector. It should be understood that normalization maps features of different magnitudes to the same numerical range, so that subsequent calculations are not affected by the "weight" of user operations, and focus on capturing the "morphological" features of the operations, thereby significantly improving the robustness of the algorithm; Within the last m millisecond window, a pressure change rate sequence is constructed using the sampling time point as an index. and contact area change rate sequence ;in, To ensure that the pressure change rate sequence and the contact area change rate sequence have the same length and are strictly aligned on the time axis, the number of sampling points is specified. Calculate the pressure change rate sequence respectively and contact area change rate sequence The mean of the pressure change rate sequence and contact area change rate sequence Subtracting the mean of the corresponding sequence from each data point yields a decentralized sequence of pressure change rates. and contact area change rate sequence And based on the calculation formula (1), the pressure change rate sequence is determined. and contact area change rate sequence Synchronization indicators between Among them, when the synchronicity index When the value is close to 1, it indicates a high positive correlation between the increase in click pressure and the expansion of the finger contact area, consistent with the muscle physical characteristics of normal finger pressing; when the synchronicity index... When the value is close to 0 or negative, it indicates poor synchronization between the two, which may indicate abnormal operation or machine simulation operation. Extracting 3D column vectors Synchronization indicators Rhythm interval and duration of micro-dwelling And the user's current operational behavior factors are determined by calculation formula (2). ; The calculation formula (1) is: ; In the formula, This is the number of the sampling time point, with a value range of [value range missing]. ; The calculation formula (2) is:

[0030] In equation (2), This is the average synchronization metric for the current account over the last r days; This represents the average rhythm interval of the current account over the last r days. This represents the average micro-stay time of the current account over the last r days, where r is set based on the account's usage frequency. , , and To be based on a three-dimensional column vector Synchronization indicators Rhythm interval and duration of micro-dwelling The importance setting of the proportion adjustment factor, and For example, for core document systems with extremely high security requirements, the synchronization index can be appropriately increased. weight This strengthens defense against machine-simulated attacks; for scenarios sensitive to operational smoothness, the rhythm interval can be appropriately increased. weight Through this flexible weight adjustment mechanism, this embodiment can dynamically adjust the focus of identity recognition according to actual business needs, achieving the best balance between security and ease of use; It is worth noting that this invention, through feature extraction and calculation steps, can improve the accuracy and robustness of user operation behavior factor calculation, thereby constructing a high-dimensional feature space that can deeply reflect the physiological and physical characteristics of the operator. First, this invention performs first-order difference processing on micro-movement acceleration to obtain jerk. By extracting micro-dynamic indicators such as peak value, mean value, and number of zero crossings of jerk, it can not only capture the speed changes when the user moves the mouse, but also keenly perceive the details of sudden force changes and direction switching during the movement. This in-depth mining at the "derivative" level of motion enables the system to effectively distinguish the natural micro-tremors and smooth transitions of real people during operation from the stiff, mechanical movement characteristics exhibited by machine scripts or unskilled operators, significantly enhancing the sensitivity of recognition. Secondly, this invention strictly aligns the pressure change rate sequence and the contact area change rate sequence within the last m millisecond window, and calculates the synchronization index between the two based on decentralized processing. This design profoundly conforms to the physical laws of human finger muscle movement, that is, when a normal person clicks or presses, the application of fingertip pressure and the expansion of contact area should be highly coordinated and positively correlated. When this index is close to 0 or negative, it can effectively reveal abnormal operation, equipment failure or non-biological simulated attack behavior, providing a solid basis for identity authenticity determination based on biomechanics and difficult to forge. Furthermore, the operation behavior factor is constructed through calculation formula (2). In this invention, a weighted fusion strategy is employed to organically combine acceleration characteristics reflecting explosive power, synchronicity indicators reflecting muscle coordination, rhythm intervals reflecting neural response rhythm, and micro-dwelling durations reflecting decision-making hesitation. Furthermore, by introducing the historical average over the most recent r days as a normalization benchmark, this factor is not only an absolute value but also a relative indicator that dynamically changes relative to the user's own habits. This adaptive normalization effectively eliminates differences in device performance, noise interference from different usage environments, and biases caused by the natural evolution of user habits over time, ensuring the model's generalization ability across different time periods and hardware conditions. This step enables accurate, efficient, and seamless continuous verification of whether the current operator is the account owner without relying on additional hardware, significantly improving the security level and user experience of the document management system.

[0031] It should be noted that the peak acceleration reflects whether the user is using a unique control mode of "rapid sprint followed by sudden stop" or "smooth deceleration", and the number of times the acceleration passes zero reflects the number of times the user makes fine adjustments during the precise positioning process.

[0032] It should be noted that the peak jerk is a number of jerks. The maximum value reflects the maximum instantaneous force exerted by the user when suddenly stopping or turning near the target button; the average jerk is a number of jerk values. The average value reflects the user's overall stability during the approximation process; the number of zero crossings represents the acceleration of the micro-movement within the last m millisecond window. The number of times the acceleration crosses zero, i.e. the number of times the direction of acceleration changes, reflects the frequency of the user's control when fine-tuning the mouse position.

[0033] S202: Determine the baseline behavioral factors for the current account based on historical operational behavior factors within the previous n days, including: Obtain the variance of historical operational behavior factors over the previous n days, and determine whether the variance is less than a variance threshold. If yes, average the historical operational behavior factors to obtain the baseline behavioral factor for the current account. If no, remove the historical operational behavior factors that differ the most from the average historical operational behavior factors, recalculate the variance of the remaining historical operational behavior factors, and re-evaluate the variance until the variance of the remaining historical operational behavior factors is less than the corresponding set value. Then, average the remaining historical operational behavior factors to obtain the baseline behavioral factor for the current account. Here, n is manually set, for example, it can be 30 days or 60 days to cover the user's long-term operational habits. The variance threshold is set empirically to measure the allowable range of user behavior fluctuations.

[0034] It's important to note that this step is the core of data cleaning. Specifically, when excessive fluctuations in historical data are detected, the system automatically identifies and removes outliers. Outliers often correspond to abnormal data generated when users are under extreme emotional states, experiencing device malfunctions, or when the user is not actively performing the operation. This embodiment employs an iterative cleaning strategy, removing only the data point with the largest deviation at a time, then re-evaluating the overall variance until the dataset meets stability requirements. This gradual cleaning approach maximizes the retention of valid data and avoids sample distortion caused by removing too much data at once.

[0035] It should be noted that, among the historical operational behavior factors that differ the most from the average historical operational behavior factors, if there are both maximum and minimum historical operational behavior factors that differ the most from the average historical operational behavior factors, the historical operational behavior factor with the minimum value will be removed first.

[0036] It should be noted that if, after removing 90% of the historical operational behavior factors, the variance of the remaining historical operational behavior factors is still not less than the variance threshold, then the average value of the original historical operational behavior factors will be used as the benchmark behavior factor for the current account.

[0037] S203: Determine similarity factors between users and accounts based on operational behavior factors and baseline behavior factors, including: A1: Place the time within the current operational behavior factor Pre-operational behavior factors The behavioral factors to be labeled are sorted in chronological order from latest to earliest to obtain the total number of behavioral factors to be labeled. Based on number Extract the behavioral factors to be labeled sequentially Obtain the behavior factor to be labeled With current operational behavior factors The average of the differences between them is used to determine whether the average value is greater than the average value threshold. If so, the number of the behavior factor to be labeled is assigned to a number less than the threshold value. Unlabeled behavioral factors Marked as reference behavioral factor If not, proceed to A2; where, Behavioral factors to be labeled The number, Reference behavioral factors The average threshold is set based on the importance of the current account and is inversely proportional to it. Specifically, this step employs a unique "reverse filtering" algorithm. Traditional benchmark calculations often simply use the average value within a fixed time window, which can lag when user habits change gradually, such as from familiar to unfamiliar operations, or when the operating device is changed. This embodiment searches backward from the historical data closest to the current moment, calculating its deviation from the current behavioral factor. The average threshold is set based on the importance of the current account and is inversely proportional to it, meaning that for high-privilege accounts, the system has a lower tolerance for behavioral deviations and stricter filtering criteria. If the deviation between the data at a certain historical moment and the current moment suddenly increases, it indicates that the user's habits may have changed at that point in time, and the system marks the data before that point in time as the reference behavioral factor. This means that the data represents the user's habits "before the change" or "not in the current state", thereby realizing the dynamic segmentation and cleaning of historical datasets; A2: Based on number Extract the behavioral factors to be labeled sequentially Obtain the behavior factor to be labeled With current operational behavior factors Between each adjacent unlabeled behavioral factor Unlabeled behavioral factors With current operational behavior factors The difference is calculated, and the average of the differences is obtained. It is then determined whether the average value is greater than a threshold value. If so, the number less than the value of the behavior factor to be labeled is assigned. Unlabeled behavioral factors Marked as reference behavioral factor If not, proceed to step A2 to examine the reference behavioral factors. The acquisition process involves several steps. It's important to understand that when a single historical data point cannot determine a shift in habits, the system further calculates the joint deviation between adjacent historical data points and the current data. This dual-verification mechanism effectively avoids misjudgments caused by a single accidental operation, such as hand tremors, ensuring the accuracy of the selected reference behavior factors. The sequence is continuous and representative in the time dimension. It should be understood that this reverse filtering logic is essentially looking for "mutation points" in user behavior patterns, thereby eliminating outdated data that no longer represents current user habits, making the historical benchmarks on which subsequent calculations rely more accurate.

[0038] A3: Extracting operational behavior factors Benchmark behavioral factors Number of abnormal operations that occurred within the hour prior to the current time The similarity factor between users and accounts is determined by formula (3). ; The calculation formula (3) is: ; In equation (3), The standard abnormal operation count is obtained based on the average number of abnormal operations per hour for the current account. When the average number of abnormal operations per hour is 0, the standard abnormal operation count is set to the minimum threshold value set manually. Reference behavioral factors With current operational behavior factors The maximum duration between, The standard duration is set based on the importance of the current account; It is an amplitude adjustment coefficient determined based on the effect of document operation time on human fatigue in the experiment, and The value range is [0, 0.5].

[0039] It is worth noting that this invention, by constructing a dynamic similarity evaluation mechanism based on sliding window filtering and multidimensional exponential correction, greatly enhances the ability to accurately identify sudden changes in user identity in complex time series data, and realizes dynamic adaptive optimization of benchmark behavioral factors and real-time quantification of abnormal risks. Specifically, through steps A1 and A2, this invention abandons the traditional approach of simply using fixed-period historical data as a benchmark, and instead designs an intelligent "reverse filtering" algorithm. Starting from the most recent unmarked behavioral factor, it calculates the average difference between each factor and the current operational behavioral factor, and strictly compares it with an average threshold that is inversely proportional to the importance of the account. This mechanism can keenly capture short-term drifts in user behavior or changes in long-term habits, automatically eliminating non-representative historical data generated by emotional fluctuations, environmental changes, or temporary task switching, thereby locking in reference behavioral factors that truly reflect the stable physiological characteristics of the user, ensuring the high purity and timeliness of the benchmark behavioral factors, and effectively avoiding misjudgments caused by historical noise interference. Furthermore, in step A3, this invention calculates the similarity factor based on a composite correction model of logarithmic and exponential functions. ,in, The ratio directly reflects the degree of deviation between the current behavior and the benchmark level, while the index term... This cleverly utilizes the time distance between the reference behavior factor and the current behavior. Dynamic weighting was applied, enabling the algorithm to automatically identify the "aging" level of behavioral characteristics, that is, the degree of aging over time. The reference weights of historical data decrease non-linearly as they increase, a design that ensures both high relevance of recent habits and stability of long-term memory. Simultaneously, this invention also considers the number of abnormal operations. Taken into consideration, through index items The punitive correction of similarity factors means that once the system detects frequent abnormal operations recently, even if the current behavioral characteristics seem to match, the system's trust level will drop exponentially, effectively preventing covert threats such as "low-frequency penetration" or "probing attacks." Furthermore, by setting parameters such as β, BYS, and BKY, and linking the threshold PY to account importance, this invention can flexibly adjust sensitivity according to the security level of different accounts, achieving an optimal balance between security and ease of use. Overall, this step, through meticulous data cleaning and complex mathematical modeling, constructs a dynamic evaluation system that can adapt to the natural evolution of user habits while accurately identifying unauthorized operations, providing an extremely solid and reliable decision-making basis for document management.

[0040] It is worth noting that this invention, by determining similarity factor one based on operational behavior factors and benchmark behavior factors, profoundly solves the limitations of traditional identity determination relying on system online time. Its core lies in achieving a leap from simple time measurement to feature recognition based on behavioral essence, thereby effectively avoiding blind spots caused by frequent user switching within a short period. Traditional security controls often infer user status based on account login or activity time. However, in real-world scenarios, if different people use the account consecutively within a very short time interval, the system finds it difficult to detect user changes simply based on timestamps. This invention, however, dynamically filters reference behavior factors. Essentially, it involves constructing a continuous chain based on behavioral characteristics, once the current operational behavioral factor... A sudden change in the matching degree with historical benchmark factors can be regarded as a signal of identity doubt. This mechanism is no longer limited by the passage of physical time, but focuses on the stability of the operator's intrinsic biological characteristics, thereby accurately capturing even extremely short intervals of personnel switching operations. Furthermore, this invention creatively combines behavioral characteristics with the physiological effects of usage duration, and introduces the maximum duration between the reference behavioral factor and the current operation through calculation formula (3). As a key moderating variable, this is not merely a record of time, but a profound insight into the changes in human physiological functions with the duration of operation. With the accumulation of usage time, users inevitably experience decreased energy and increased fatigue; this physiological state is directly reflected in operational behavior factors. Regarding fluctuations, such as decreased smoothness of mouse movement and increased irregularity of click rhythm, this invention utilizes the composite function relationship of exponential and logarithmic time... For similarity factor one Adaptive correction acknowledges and quantifies normal behavioral deviations in users under fatigue, preventing the misjudgment of natural physiological fluctuations caused by prolonged work as abnormal operations. This design ensures high-precision recognition when users are energetic, while appropriately relaxing the judgment threshold when users are fatigued, avoiding frequent interruptions to user workflows due to misjudgments. Thus, while ensuring data security, it maximizes the system's intelligence, fault tolerance, and user experience, truly achieving dynamic and precise access control based on the user's real-time physiological state.

[0041] S204: Set similarity score 2 based on current time and current location, including: Based on historical time and historical location, determine the frequently used time range and frequently used location range, and extract the current time and current location of the user when performing the current document operation; If the current time is within a commonly used time range and the current location is within a commonly used location range, the similarity score 2 will be set to the maximum value of the similarity standard range. The similarity standard range is obtained based on the historical average similarity score 1 of the current account, and is generally set to 50% to 70% of the historical average similarity score 1. If historical data is lacking, the system's preset default value will be used, and is generally set to 50% to 70% of the default value. If only the current time falls within the range of commonly used times, or only the current location falls within the range of commonly used locations, the similarity score will be set to the median value of the similarity standard range. For example, if a user logs in during their usual working hours but in an unfamiliar internet cafe, or logs in during non-working hours but in their office, both of these situations pose certain security risks. The system will assign a medium environmental trust score and suggest that a key verification should be conducted based on behavioral characteristics. If the current time is not within the commonly used time range and the current location is not within the commonly used location range, the similarity score will be set to the minimum value of the similarity standard range. This usually corresponds to high-risk scenarios such as logging in from a different location late at night. The system will give the lowest environmental trust score. At this time, even if the behavioral feature similarity is acceptable, the total similarity score will be significantly reduced, thereby triggering a stricter audit or circuit breaker mechanism.

[0042] S205: Determine commonly used time ranges and commonly used location ranges based on historical time and historical location, including: Extract the historical time and location of document operations performed by the current account. Divide the day into several time periods and obtain the number of times document operations occurred in each time period. Mark the time periods with a time count greater than a time count threshold as common time ranges. Mark the number of times document operations occurred in each historical location as the location count for that historical location. Mark historical locations with a location count greater than a location count threshold as common locations. Mark the area within a preset buffer range of the common locations as a common location range. The time count threshold is determined based on the average time count corresponding to the time periods of several accounts, the location count threshold is determined based on the average location count corresponding to the historical locations of several accounts, and the preset buffer range is manually set.

[0043] It should be noted that the time of day can be divided into several time periods by means of manual division, such as dividing it into 10-minute intervals, or by means of natural time, such as dividing it into intervals of each natural time.

[0044] In one possible implementation of this application embodiment, the above-mentioned S3 can be implemented by the following S301, which will be described in detail below: S301: Set permissions for the current user based on similarity factor one and similarity factor two, including: Extracting similarity factor 1 And similarity factor two, for the similarity factor one The total similarity factor is calculated by weighting the similarity factor and similarity factor two. When the total similarity factor is greater than the similarity factor threshold one, the document operation performed by the user is marked as a normal operation. The similarity factor threshold one represents the system's trust baseline for determining "legitimate users." When the total similarity factor crosses this baseline, the system determines that the current operator's behavior highly matches historical benchmarks, and the operating environment is within a commonly used security range, making it highly probable that the user is the account owner. In this case, the system maintains the default permission settings, allowing the user to perform all authorized operations such as opening documents, editing content, copying content, or printing documents, ensuring that the legitimate user's work efficiency is not disturbed.

[0045] When the total similarity factor is no greater than similarity factor threshold one but greater than similarity factor threshold two, the user's document operation is marked as suspected non-user operation, triggering an enhanced audit mode. This enhanced audit mode includes allowing the user to view document content and perform manually set non-sensitive edits, prohibiting copying content, printing documents, and exporting files, and recording the screen in full screen. Similarity factor threshold one and similarity factor threshold two are manually set, with similarity factor threshold one being greater than similarity factor threshold two. This range of no greater than similarity factor threshold one but greater than similarity factor threshold two reflects the defensive design concept of this invention: a "suspicious observation" buffer zone is set between "complete trust" and "complete rejection." When the total similarity factor falls into this range, the system detects abnormal signals in behavior or environment, such as a faster operation pace or unfamiliar location, but not yet reaching the level of confirming an attack. At this time, directly blocking the operation may inadvertently harm normal users due to emotional fluctuations or temporary device changes, while ignoring it poses a security risk. Therefore, this embodiment triggers an enhanced audit mode, which includes allowing users to view document content and perform non-sensitive edits by manually setting parameters, prohibiting copying content, printing documents, and exporting files, and recording the screen in full screen.

[0046] When the total similarity factor is not greater than the similarity factor threshold of 2, the user's document operation is marked as an abnormal operation, the number of abnormal operations is recorded, and circuit breaker protection is triggered. Circuit breaker protection includes automatically locking the document and forcibly logging out. This situation indicates that the current operator's behavior characteristics deviate significantly from the account owner's, or that they are in an extremely high-risk time and space environment, such as logging in from a different location late at night with inconsistent behavior habits. In this case, the system determines it as a high-risk attack or account theft. Specifically, the system will immediately terminate the current document process, clear temporary files in memory, and send a logout command to the server, forcibly disconnecting the session connection. Simultaneously, the system records this operation as the number of abnormal operations YS, which will be used as a penalty factor when calculating the similarity factor SZ1, further reducing the trust score of the account's subsequent attempts. This "circuit breaker" mechanism can block threats within milliseconds, preventing sensitive data from being further stolen or damaged.

[0047] It should be noted that the similarity factor is a combination of similarity factors one and two. The similarity factor 1 and similarity factor 2 are obtained by multiplying each by its corresponding weighting coefficient and then adding them together. The weighting coefficients are chosen based on the experts' assessment of similarity factor 1. The importance of similarity factor two is determined by, for example, similarity factor one. The corresponding weight coefficient is 0.7, and the weight coefficient for similarity factor 2 is 0.3.

[0048] This application embodiment can divide a document management system with dynamic permissions into functional units based on the above method example. For example, each function can be divided into its own functional unit, or two or more functions can be integrated into one processing unit. The integrated unit can be implemented in hardware or as a software functional unit. It should be noted that the unit division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0049] When using integrated units, Figure 2 A possible structural diagram of a document management system with dynamic permissions (referred to as communication system 20) involved in the above embodiments is shown. The communication system 20 includes a processing unit 201 and a communication unit 202, and may also include a storage medium (referred to as storage unit 203). Figure 2 The structural diagram shown can be used to illustrate the structure of a document management system with dynamic permissions involved in the above embodiments.

[0050] when Figure 2The schematic diagram shown illustrates the structure of a document management system with dynamic permissions involved in the above embodiments. The processing unit 201 is used to control and manage the actions of the document management system with dynamic permissions, the communication unit 202 is used for the document management system with dynamic permissions to communicate with other devices, and the storage unit 203 is used to store the program code and data of the document management system with dynamic permissions.

[0051] For example, communication unit 202 is used to acquire microscopic data during the silent period before the user performs a document operation; wherein the document operation includes opening a document, editing content, copying content, or printing a document; the microscopic data includes micro-movement acceleration, click pressure and the rate of change of contact area, the rhythm interval of mouse double-click, and micro-dwell time; Processing unit 201: is used to determine the user's current operation behavior factor based on the micro data, determine the baseline behavior factor of the current account based on the historical operation behavior factors within n days prior to the current time, determine the similarity factor one between the user and the account based on the operation behavior factor and the baseline behavior factor, set the similarity factor two based on the current time and current location, and set the permissions of the current user based on the similarity factor one and the similarity factor two.

[0052] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0053] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely illustrative descriptions of the application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

[0054] Some of the data in the above calculation formula are obtained by removing dimensions and taking their numerical values. The calculation formula is a calculation formula that is closest to the real situation, obtained by software simulation of a large amount of collected data. The preset parameters and preset thresholds in the calculation formula are set by those skilled in the art according to the actual situation or obtained through simulation of a large amount of data.

Claims

1. A document management method with dynamic permissions, characterized in that, include: Acquire microscopic data during the silent period before a user performs a document operation; wherein the document operation includes opening a document, editing content, copying content, or printing a document; the microscopic data includes micro-movement acceleration, click pressure and the rate of change of contact area, the rhythm interval of mouse double-clicks, and micro-dwell time; Based on the micro data, determine the user's current operational behavior factors; based on the historical operational behavior factors within the previous n days, determine the baseline behavior factors for the current account; based on the operational behavior factors and the baseline behavior factors, determine the first similarity factor between the user and the account; based on the current time and current location, set the second similarity factor; and based on the first similarity factor and the second similarity factor, set the permissions for the current user.

2. The document management method with dynamic permissions according to claim 1, characterized in that, The acquisition of micro-data during the silent period before the user performs document operations includes: When a user performs actions such as opening a document, editing content, copying content, or printing a document, the acceleration of the mouse as it approaches the target is identified in the last m milliseconds before the user moves the mouse to the target button and performs the document operation, and the acceleration is marked as micro-movement acceleration. The mouse's pressure sensor identifies the rate of change in mouse click pressure and contact area within the last m milliseconds before the user moves the mouse to the target button and clicks it. Obtain the interval duration of mouse double-clicks, remove interval durations less than the double-click duration threshold and integrate them into duration groups, obtain the maximum, minimum and average values ​​in the duration groups, calculate the rhythm interval of mouse double-clicks by weighting the maximum, minimum and average values, and normalize the rhythm interval. Get the micro-dwell time between when the mouse cursor enters the button's hotspot and when the document operation occurs; where the button's hotspot is the area covering the target button and its surrounding preset buffer.

3. The document management method with dynamic permissions according to claim 1, characterized in that, The process of determining the user's current operational behavior factors based on the micro-data includes: Extracting micro-motion acceleration For micro-motion acceleration The jerk is obtained by performing first-order difference processing. Extract the jerk The peak accelerometer, average accelerometer, and number of zero crossings are calculated; the peak accelerometer within the last m millisecond window is extracted. , average jerk And accelerate the number of times to pass the zero point ; for peak jerk , average jerk And accelerate the number of times to pass the zero point After performing Min-Max normalization, they are combined into a three-dimensional column vector. ; wherein, the jerk Satisfy the calculation formula , The sampling interval; Within the last m millisecond window, a pressure change rate sequence is constructed using the sampling time point as an index. and contact area change rate sequence ;in, This represents the number of sampling points; Calculate the pressure change rate sequence respectively and contact area change rate sequence The mean of the pressure change rate sequence and contact area change rate sequence Subtracting the mean of the corresponding sequence from each data point yields a decentralized sequence of pressure change rates. and contact area change rate sequence And based on the calculation formula (1), the pressure change rate sequence is determined. and contact area change rate sequence Synchronization indicators between ; Extracting 3D column vectors Synchronization indicators Rhythm interval and duration of micro-dwelling And the user's current operational behavior factors are determined by calculation formula (2). ; The calculation formula (1) is: ； In the formula, This is the number of the sampling time point, with a value range of [value range missing]. ; The calculation formula (2) is: In equation (2), This is the average synchronization metric for the current account over the last r days; This represents the average rhythm interval of the current account over the last r days. This represents the average micro-stay time of the current account over the last r days, where r is set based on the account's usage frequency. , , and To be based on a three-dimensional column vector Synchronization indicators Rhythm interval and duration of micro-dwelling The importance setting of the proportional adjustment factor, and .

4. The document management method with dynamic permissions according to claim 1, characterized in that, The determination of the baseline behavior factors for the current account based on historical operational behavior factors within the previous n days includes: Obtain the variance of historical operational behavior factors within the previous n days, and determine whether the variance is less than a variance threshold. If yes, calculate the average of the historical operational behavior factors to obtain the baseline behavioral factor for the current account. If no, remove the historical operational behavior factors that differ the most from the average of the historical operational behavior factors, recalculate the variance of the remaining historical operational behavior factors, and re-determine the variance until the variance of the remaining historical operational behavior factors is less than the corresponding set value. Then, calculate the average of the remaining historical operational behavior factors to obtain the baseline behavioral factor for the current account.

5. A document management method with dynamic permissions according to claim 1, characterized in that, The first similarity factor for determining users and accounts based on operational behavior factors and baseline behavior factors includes: A1: Place the time within the current operational behavior factor Pre-operational behavior factors The behavioral factors to be labeled are sorted in chronological order from latest to earliest to obtain the total number of behavioral factors to be labeled. Based on number Extract the behavioral factors to be labeled sequentially Obtain the behavior factor to be labeled With current operational behavior factors The average of the differences between them is used to determine whether the average value is greater than the average value threshold. If so, the number of the behavior factor to be labeled is assigned to a number less than the threshold value. Unlabeled behavioral factors Marked as reference behavioral factor If not, proceed to A2; where, Behavioral factors to be labeled The number, Reference behavioral factors The number; the average threshold is set based on the importance of the current account; A2: Based on number Extract the behavioral factors to be labeled sequentially Obtain the behavior factor to be labeled With current operational behavior factors Between each adjacent unlabeled behavioral factor Unlabeled behavioral factors With current operational behavior factors The difference is calculated, and the average of the differences is obtained. It is then determined whether the average value is greater than a threshold value. If so, the number less than the value of the behavior factor to be labeled is assigned. Unlabeled behavioral factors Marked as reference behavioral factor If not, proceed to step A2 to examine the reference behavioral factors. Acquisition; A3: Extracting operational behavior factors Benchmark behavioral factors Number of abnormal operations that occurred within the hour prior to the current time The similarity factor between users and accounts is determined by formula (3). ; The calculation formula (3) is: ； In equation (3), This represents the standard number of abnormal operations. Reference behavioral factors With current operational behavior factors The maximum duration between, The standard duration is set based on the importance of the current account; It is the amplitude adjustment coefficient, and The value range is [0, 0.5].

6. The document management method with dynamic permissions according to claim 1, characterized in that, The step of setting a similarity score based on the current time and current location includes: Based on historical time and historical location, determine the frequently used time range and frequently used location range, and extract the current time and current location of the user when performing the current document operation; If the current time is within a commonly used time range and the current location is within a commonly used location range, then the similarity score 2 will be the maximum value of the similarity standard range; wherein, the similarity standard range is obtained based on the average similarity score 1 in the history of the current account; If only the current time is within the commonly used time range, or only the current location is within the commonly used location range, the similarity score will be the median value of the similarity standard range. If the current time is not within the commonly used time range and the current location is not within the commonly used location range, the similarity score will be set to the minimum value of the similarity standard range.

7. A document management method with dynamic permissions according to claim 6, characterized in that, The determination of commonly used time ranges and commonly used location ranges based on historical time and historical location includes: Extract the historical time and location of document operations performed by the current account. Divide the day into several time periods and obtain the number of times document operations occurred in each time period. Mark the time periods with a time count greater than a time count threshold as frequently used time ranges. Mark the number of times document operations occurred in each historical location as the location count for that historical location. Mark historical locations with a location count greater than a location count threshold as frequently used locations. Mark the area within a preset buffer range of the frequently used locations as a frequently used location range. The time count threshold is determined based on the average time count corresponding to the time periods of several accounts, and the location count threshold is determined based on the average location count corresponding to the historical locations of several accounts.

8. A document management method with dynamic permissions according to claim 1, characterized in that, The setting of permissions for the current user based on similarity factor one and similarity factor two includes: Extracting similarity factor 1 And similarity factor two, for the similarity factor one The total similarity factor is obtained by weighting the similarity factor and the similarity factor 2. When the total similarity factor is greater than the similarity factor threshold 1, the document operation performed by the user is marked as a normal operation. When the total similarity factor is not greater than similarity factor threshold one, but greater than similarity factor threshold two, the document operation performed by the user is marked as suspected non-user operation, triggering enhanced audit mode; wherein, enhanced audit mode includes allowing users to view document content and perform non-sensitive editing manually set, prohibiting copying content, printing documents and exporting files, and recording the screen in full screen; When the total similarity factor is not greater than the similarity factor threshold of two, the document operation performed by the user is marked as an abnormal operation, the number of abnormal operations is recorded, and the circuit breaker protection is triggered; wherein, the circuit breaker protection includes automatically locking the document and forcibly logging out.

9. A document management system with dynamic permissions, used to run the document management method with dynamic permissions as described in any one of claims 1 to 8, characterized in that, include: Communication unit and processing unit; The communication unit is used to acquire microscopic data during the silent period before the user performs a document operation; wherein the document operation includes opening a document, editing content, copying content, or printing a document; the microscopic data includes micro-movement acceleration, click pressure and the rate of change of contact area, the rhythm interval of mouse double-clicks, and micro-dwell time. The processing unit is used to: determine the user's current operational behavior factor based on the micro data; determine the baseline behavior factor of the current account based on the historical operational behavior factors within the previous n days; determine the similarity factor one between the user and the account based on the operational behavior factor and the baseline behavior factor; set the similarity factor two based on the current time and current location; and set the permissions of the current user based on the similarity factor one and the similarity factor two.

10. A storage medium storing instructions that, when executed on a document management system with dynamic permissions, cause the document management system with dynamic permissions to execute a document management method with dynamic permissions.

Images