A bulk authorization freeze and status interdiction checking system
Patent Information
- Application Number
- CN202611211295.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-11
- Publication Date
- 2026-10-30
AI Technical Summary
[0005]本发明提供一种批量授权冻结与状态互斥校验系统，解决相关技术中批量授权冻结操作缺乏对跨层级级联传播路径的系统性分析，导致冻结目标状态与实际可用状态空间之间存在互斥冲突且无法在执行前预判并调度的技术问题
步骤4，将路径终点目标实体的实际可用状态空间数据与其冻结目标状态执行互斥匹配计算，将冻结目标状态落入已被移除状态区间的实体对标记为级联互斥冲突对，并记录传播层级序号及授权继承规则标识；
Smart Images
Figure CN123013071A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of access control technology, and more specifically, to a batch authorization freeze and status mutual exclusion verification system. Background Technology
[0002] In a multi-level organizational permission system (such as a tree-like authorization structure consisting of groups, subsidiaries, departments, and positions), a batch authorization freeze request may simultaneously cover authorization entities at different levels. Changes in the authorization status of higher-level authorization entities will propagate down the hierarchical structure to lower-level entities, causing a contraction in the available authorization status space of lower-level entities.
[0003] Existing batch freeze verification techniques typically only perform mutual exclusion checks on entity pairs with direct mutual exclusion declarations, relying on explicitly declared mutual exclusion relationship records to complete conflict determination.
[0004] However, such verification methods cannot detect implicit mutual exclusion conflicts passed through intermediate levels. When a batch freeze request includes both an intermediate level entity and its indirect lower-level entities, each entity performs its own direct dependency verification. However, the cascading propagation caused by the freezing of the upper-level entity causes the authorization basis of the lower-level entity to disappear, creating a logical contradiction with the freeze target state set by the lower-level entity itself. This results in a technical problem of inconsistent authorization states after the batch freeze is executed. Summary of the Invention
[0005] This invention provides a batch authorization freeze and state mutual exclusion verification system, which solves the technical problem in related technologies that the batch authorization freeze operation lacks systematic analysis of cross-level cascading propagation paths, resulting in mutual exclusion conflicts between the frozen target state and the actual available state space, and the inability to predict and schedule before execution.
[0006] This invention discloses a batch authorization freeze and status mutual exclusion verification system, comprising: The target entity subgraph construction module extracts the target entity identifier set from the batch authorization freeze request, obtains the hierarchical relationship record between target entities and the authorization inheritance rule parameters from the permission configuration storage, and constructs the target entity subgraph data structure with the target entity as the node and the authorization inheritance direction as the directed edge. The directed edge carries the corresponding authorization inheritance rule parameters. The reachability analysis module performs a breadth-first traversal along the authorization inheritance direction, starting from each target entity in the target entity subgraph data structure. It allows intermediate authorized nodes that do not belong to the target entity identifier set to pass through, and identifies indirectly connected target entity pairs and their complete propagation path sequences. The cascaded propagation simulation module takes the frozen target state of the target entity at the starting point of each complete propagation path as the initial input, calculates the effective authorized state set reduction result node by node based on the authorization inheritance rule parameters and the current authorized state snapshot of the intermediate nodes, and propagates to the end point of the path to obtain the actual usable state space data; The mutual exclusion matching module performs mutual exclusion matching calculations on the actual available state space data of the target entity at the end of the path and its frozen target state, and marks the entity pairs whose frozen target states fall into the state intervals that have been removed as cascaded mutual exclusion conflict pairs. The frozen scheduling plan generation module generates execution order constraints for cascading mutual exclusion conflicts and injects them into the time-series window segmented scheduling plan, outputting the final frozen scheduling plan.
[0007] Furthermore, the cascading propagation simulation module on the path... The reduction result of the set of valid authorized states at each node satisfy: ,in For the first A snapshot of the current authorization status of each node. For the first Authorization inheritance rule parameters between each node and its upstream node The set of valid authorization states passed in from the upstream node. Based on the parameters of the authorized inheritance rules right The inheritance mapping operation performed. For the intersection operation of sets, let the starting point of the path be... Freeze the set of authorized states corresponding to the target state of the target entity at the starting point of the path, and iterate node by node to the end point of the path to obtain the actual usable state space data. , This represents the total number of path nodes. The range of values is to .
[0008] Furthermore, the determination rule of the mutual exclusion matching module is as follows: Let the frozen target state of the target entity at the path endpoint be... Its actual usable state space data is ,like If a mutual exclusion conflict exists, the propagation level number of the conflict and the identifier of the authorization inheritance rule that triggered the mutual exclusion match are recorded.
[0009] Furthermore, while identifying indirectly connected target entity pairs, the reachability analysis module records a snapshot of the current authorization status of each intermediate authorization node on the path, which is used by the cascading propagation simulation module during node-by-node calculations.
[0010] Furthermore, the execution order constraint generated by the freeze scheduling plan generation module stipulates that the freeze operation of the upper-level entity in the cascaded mutual exclusion conflict pair is executed after its associated lower-level entity in terms of timing, or the conflicting entity pair is assigned to different batch task queues for sequential processing. The execution order constraint is injected as a hard constraint condition into the timing window fragmentation scheduling plan.
[0011] Furthermore, the freeze scheduling plan generation module outputs a propagation path detail report for each level of mutually exclusive conflict pair while outputting the final freeze scheduling plan. The propagation path detail report includes the complete propagation path sequence of each pair of conflicting entities, the propagation level number of the conflict, and the authorized inheritance rule identifier that was triggered.
[0012] Furthermore, the hierarchical relationship records extracted from the permission configuration storage by the target entity subgraph construction module cover the hierarchical relationships between each level in the tree-like authorization structure composed of the group, subsidiaries, departments and positions, with the directed edges pointing from the upper-level entity to the lower-level entity.
[0013] This invention discloses a method for batch authorization freeze and status mutual exclusion verification, used to execute the above-mentioned batch authorization freeze and status mutual exclusion verification system, comprising: Step 1: Extract the target entity identifier set from the batch authorization freeze request, obtain the hierarchical membership record and authorization inheritance rule parameters from the permission configuration storage, and construct the target entity subgraph data structure with the target entity as the node and the authorization inheritance direction as the directed edge; Step 2: Starting from each target entity in the target entity subgraph data structure, perform a breadth-first traversal along the authorization inheritance direction, allowing the passage of intermediate authorization nodes, identify indirectly connected target entity pairs and their complete propagation path sequences, and record a snapshot of the current authorization status of each intermediate authorization node on the path. Step 3: For each complete propagation path, the frozen target state of the target entity at the starting point of the path is used as the initial input. The effective authorized state set reduction result is calculated node by node according to the authorization inheritance rule parameters and the current authorized state snapshot of the intermediate node. The propagation is then carried out to the end point of the path to obtain the actual usable state space data. Step 4: Perform mutual exclusion matching calculation on the actual available state space data of the target entity at the end of the path and its frozen target state. Mark the entity pairs whose frozen target states fall into the removed state interval as cascaded mutual exclusion conflict pairs, and record the propagation level sequence number and authorization inheritance rule identifier. Step 5: Generate execution order constraints for cascading mutual exclusion conflicts, inject the execution order constraints as hard constraints into the time window segmentation scheduling plan, and output the final frozen scheduling plan.
[0014] The friendship effect of this invention is as follows: This invention explicitly identifies indirectly connected target entity pairs and their complete propagation path sequences by constructing a target entity subgraph data structure and performing reachability analysis based on breadth-first traversal. By simulating the cascading propagation process node-by-node, the reduction effect of the upper-level entity freezing operation on the actual available state space data of the path endpoint target entity is quantified before execution. By performing mutual exclusion matching calculations on the reduced actual available state space data, implicit cascading mutual exclusion conflicts are identified before batch freezing execution. By injecting execution order constraints as hard constraints into the time-series window fragmentation scheduling plan, the technical problem of inconsistent authorization states after batch freezing in multi-level organizational permission systems is solved, achieving the technical effect of identifying and eliminating implicit cascading mutual exclusion conflicts before batch freezing execution and ensuring that batch freezing operations are executed in a safe order. Attached Figure Description
[0015] Figure 1 This is a flowchart of the batch authorization freezing and status mutual exclusion verification method provided in the embodiments of the present invention. Detailed Implementation
[0016] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.
[0017] At least one embodiment of the present invention discloses a batch authorization freeze and state mutual exclusion verification system, configured to perform cascading propagation simulation and mutual exclusion conflict identification on multi-level target entities in a batch authorization freeze request, and generate a freeze scheduling plan carrying sequence constraints. The method for performing this system is described below. Figure 1 The system includes: The target entity subgraph construction module is configured to extract the target entity identifier set from the batch authorization freeze request and generate the target entity subgraph data structure.
[0018] Retrieve the set of target entity identifiers from the batch authorization freeze request, and extract the hierarchical relationship records and authorization inheritance rule parameters between all target entities from the permission configuration storage. Based on the hierarchical relationship records, construct a target entity subgraph data structure with target entities as nodes and directed edges (from parent entities to child entities) as authorized inheritance directions. The directed edges in the target entity subgraph data structure carry the corresponding authorized inheritance rule parameters for use in subsequent propagation simulation steps.
[0019] The reachability analysis module is configured to perform reachability analysis on the target entity subgraph data structure to identify indirectly connected target entity pairs and their complete propagation path sequences.
[0020] Starting with each target entity in the target entity subgraph data structure, a breadth-first traversal is performed along the authorization inheritance direction. During the traversal, intermediate authorization nodes that do not belong to the target entity identifier set are allowed to be traversed, identifying all target entity pairs indirectly connected via one or more intermediate nodes. For each indirectly connected target entity pair, its complete propagation path sequence and a snapshot of the current authorization state of each intermediate node on the path are extracted and recorded. The node order in the complete propagation path sequence reflects the propagation direction of authorization inheritance, i.e., the path starts at the parent target entity and ends at the child target entity.
[0021] The cascade propagation simulation module is configured to simulate the node-by-node propagation process of the freezing effect along each complete propagation path, and obtain the actual usable state space data of the target entity at the end of the path.
[0022] For each complete propagation path, the frozen target state of the target entity at the path's starting point is used as the initial input. The propagation simulation of the authorization state freezing effect is then performed node by node along the path. At each intermediate node, based on the authorization inheritance rule parameters between the intermediate node and its upstream nodes, and combined with the current authorization state snapshot of the intermediate node, the reduction result of the effective authorization state set after receiving the upper-level state change is calculated. The reduced effective authorization state set is then used as the input for the next node, and propagation continues downwards along the path until the target entity at the path's end is reached, obtaining the actual usable state space data of the target entity at the path's end after complete cascading propagation.
[0023] Furthermore, let the path be the first A snapshot of the current authorization status of each node is as follows The authorization inheritance rule parameters between it and the upstream node are: The set of valid authorization states passed in from the upstream node is Then the first The result of reducing the set of valid authorization states of each node for: ; in Indicates parameters based on the authorized inheritance rules. Set of valid authorization states for upstream The inherited mapping operation is executed, and its output is the set of permitted states of the current node under the constraints of the parent state. This represents the set intersection operation, used to compare the inheritance mapping result with the current node's own authorization state snapshot. The intersection yields a reduced set of valid authorization states that simultaneously satisfy both their own authorization state and the propagation constraints of their parent. The path start point is set as follows: The set of authorized states corresponding to the frozen target state of the target entity at the path starting point is used to iterate node by node until the path ending point, thus obtaining the actual usable state space data of the target entity at the path ending point. ,in This represents the total number of nodes on the path. For path node indexing, The range of values is to .
[0024] The mutual exclusion matching module is configured to perform mutual exclusion matching calculations on the actual available state space data of the target entity at the end of the path and its frozen target state, and to identify cascaded mutual exclusion conflict pairs.
[0025] The actual available state space data of the path endpoint target entity is compared with the frozen target state set in the batch authorization freeze request. A mutual exclusion matching calculation is performed to determine whether the frozen target state falls within a state range that has already been cascaded down and removed. The specific determination rule for the mutual exclusion matching calculation is as follows: Let the frozen target state of the path endpoint target entity be... The actual usable state space data of the target entity at the end of the path is ,like If a conflict occurs, it is determined that a mutual exclusion conflict exists. If the frozen target state falls into a state range that has already been removed, the corresponding path start target entity and path end target entity are marked as a cascaded mutual exclusion conflict pair, and the propagation level number of the conflict and the specific authorization inheritance rule identifier that triggered the mutual exclusion matching are recorded.
[0026] The frozen scheduling plan generation module is configured to generate execution order constraints for cascading mutual exclusion conflicts, inject the execution order constraints into the time-series window segmented scheduling plan, and output the final frozen scheduling plan.
[0027] For all entities marked as cascading mutually exclusive conflict pairs, generate freeze execution order constraints: stipulating that the freeze operation of a higher-level entity must be executed after its associated lower-level entity in time sequence, or that conflicting entity pairs are assigned to different batch task queues for sequential processing. Inject the generated execution order constraints as hard constraints into the time window segmentation scheduling plan, outputting the final freeze scheduling plan carrying the cascading mutually exclusive constraints, as well as propagation path detail reports for each level of cascading mutually exclusive conflict pair. The propagation path detail report includes the complete propagation path sequence for each pair of conflicting entities, the propagation level number where the conflict occurred, and the identifier of the triggered authorization inheritance rule.
[0028] Existing batch freeze verification methods only check entity pairs with direct mutual exclusion declarations, lacking the ability to detect implicit mutual exclusion conflicts passed through intermediate levels, leading to inconsistent authorization states after batch freeze execution. This implementation constructs a target entity subgraph data structure and performs reachability analysis based on breadth-first traversal, making previously invisible indirectly connected target entity pairs and their complete propagation path sequences explicit. Based on this, a node-by-node cascading propagation process is simulated, accurately quantifying the reduction effect of the upper-level entity freeze operation on the actual available state space data of the target entity at the path endpoint before execution. Mutual exclusion matching calculations are performed on the reduced actual available state space data, thereby identifying implicit cascading mutual exclusion conflicts before batch freeze execution. The generated execution order constraints are directly injected as hard constraints into the time-series window sharding scheduler, ensuring that batch freeze operations are executed in a safe order that eliminates conflicts, thus resolving the issue of inconsistent authorization states after batch freeze in multi-level organizational permission systems.
[0029] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.
Claims
1. A batch authorization freeze and status mutual exclusion verification system, characterized in that, include: The target entity subgraph construction module extracts the target entity identifier set from the batch authorization freeze request, obtains the hierarchical relationship record between target entities and the authorization inheritance rule parameters from the permission configuration storage, and constructs the target entity subgraph data structure with the target entity as the node and the authorization inheritance direction as the directed edge. The directed edge carries the corresponding authorization inheritance rule parameters. The reachability analysis module performs a breadth-first traversal along the authorization inheritance direction, starting from each target entity in the target entity subgraph data structure. It allows intermediate authorization nodes that do not belong to the target entity identifier set to pass through, and identifies indirectly connected target entity pairs and their complete propagation path sequences. The cascade propagation simulation module takes the frozen target state of the target entity at the starting point of each complete propagation path as the initial input, calculates the effective authorization state set reduction result node by node based on the authorization inheritance rule parameters and the current authorization state snapshot of the intermediate nodes, and propagates to the end point of the path to obtain the actual usable state space data. The mutual exclusion matching module performs mutual exclusion matching calculations between the actual available state space data of the target entity at the end of the path and its frozen target state, and marks the entity pairs whose frozen target states fall into the removed state intervals as cascaded mutual exclusion conflict pairs; the frozen scheduling plan generation module generates execution order constraints for cascaded mutual exclusion conflict pairs and injects them into the time-series window segmented scheduling plan, and outputs the final frozen scheduling plan.
2. The batch authorization freeze and status mutual exclusion verification system according to claim 1, characterized in that, The cascaded propagation simulation module is on the path... The reduction result of the set of valid authorized states at each node satisfy: ,in For the first A snapshot of the current authorization status of each node. For the first Authorization inheritance rule parameters between each node and its upstream node The set of valid authorization states passed in from the upstream node. Based on the parameters of the authorized inheritance rules right The inheritance mapping operation performed. For the intersection operation of sets, let the starting point of the path be... Freeze the set of authorized states corresponding to the target state of the target entity at the starting point of the path, and iterate node by node to the end point of the path to obtain the actual usable state space data. , This represents the total number of path nodes. The range of values is to .
3. The batch authorization freeze and status mutual exclusion verification system according to claim 1, characterized in that, The determination rule of the mutual exclusion matching module is as follows: Assume the frozen target state of the target entity at the path endpoint is... Its actual usable state space data is ,like If a mutual exclusion conflict exists, the propagation level number of the conflict and the identifier of the authorization inheritance rule that triggered the mutual exclusion match are recorded.
4. The batch authorization freeze and status mutual exclusion verification system according to claim 1, characterized in that, While identifying indirectly connected target entity pairs, the reachability analysis module records a snapshot of the current authorization status of each intermediate authorization node on the path, which is used by the cascading propagation simulation module during node-by-node calculations.
5. The batch authorization freeze and status mutual exclusion verification system according to claim 1, characterized in that, The execution order constraint generated by the freeze scheduling plan generation module stipulates that the freeze operation of the upper-level entity in the cascaded mutual exclusion conflict pair is executed after its associated lower-level entity in terms of timing, or the conflicting entity pair is assigned to different batch task queues for sequential processing. The execution order constraint is injected as a hard constraint condition into the timing window segmentation scheduling plan.
6. The batch authorization freeze and status mutual exclusion verification system according to claim 5, characterized in that, The freeze scheduling plan generation module outputs the final freeze scheduling plan and, at the same time, outputs a propagation path detail report for each level of mutually exclusive conflict pairs. The propagation path detail report includes the complete propagation path sequence of each pair of conflicting entities, the propagation level number of the conflict, and the authorized inheritance rule identifier that was triggered.
7. The batch authorization freeze and status mutual exclusion verification system according to claim 1, characterized in that, The target entity subgraph construction module extracts hierarchical relationship records from the permission configuration storage, which cover the hierarchical relationships between each level in the tree-like authorization structure composed of groups, subsidiaries, departments and positions, with the directed edges pointing from the upper-level entity to the lower-level entity.
8. A method for batch authorization freezing and status mutual exclusion verification, used to execute the batch authorization freezing and status mutual exclusion verification system according to any one of claims 1 to 7, characterized in that, include: Step 1: Extract the target entity identifier set from the batch authorization freeze request, obtain the hierarchical membership record and authorization inheritance rule parameters from the permission configuration storage, and construct the target entity subgraph data structure with the target entity as the node and the authorization inheritance direction as the directed edge; Step 2: Starting from each target entity in the target entity subgraph data structure, perform a breadth-first traversal along the authorization inheritance direction, allowing the passage of intermediate authorization nodes, identify indirectly connected target entity pairs and their complete propagation path sequences, and record a snapshot of the current authorization status of each intermediate authorization node on the path. Step 3: For each complete propagation path, the frozen target state of the target entity at the starting point of the path is used as the initial input. The effective authorized state set reduction result is calculated node by node according to the authorization inheritance rule parameters and the current authorized state snapshot of the intermediate node. The propagation is then carried out to the end point of the path to obtain the actual usable state space data. Step 4: Perform mutual exclusion matching calculation on the actual available state space data of the target entity at the end of the path and its frozen target state. Mark the entity pairs whose frozen target states fall into the removed state interval as cascaded mutual exclusion conflict pairs, and record the propagation level sequence number and authorization inheritance rule identifier. Step 5: Generate execution order constraints for cascading mutual exclusion conflicts, inject the execution order constraints as hard constraints into the time window segmentation scheduling plan, and output the final frozen scheduling plan.