KR20220046870A - System for classifying and recommending authority based on artificial intelligence for access authority analysis - Google Patents

Abstract

Disclosed is a system for classifying and recommending authorities based on artificial intelligence for access authority analysis. According to an embodiment, a system for classifying and recommending authorities based on artificial intelligence for access authority analysis comprises: a data collection unit for collecting resource data of a user by using an application that analyzes details of use of resources; a role classification unit for classifying role information based on a similarity between the user and the resource use relationship of the user through an artificial intelligence engine for processing authority analysis on the collected resource data of the user; a storage unit for storing, in an analysis storage, final role information in which the authority of the user to the classified role information is adjusted, according to the review of a manager as the classified role information is provided to the manager; and a migration unit for migrating the final role information, stored in the analysis storage, to the authority storage of a system for providing services according to authorities. Therefore, the system can provide assistance in constructing an authority system by presenting and recommending an initial authority system.

Description

AI-based permission classification and recommendation system for access right analysis

The description below relates to techniques for performing access rights analysis.

The classification of privileges in the existing access authority system has the inconvenience of repeating the process of inspecting and collecting privileges directly by administrators and users in the process of collecting privileges. Because the process of investigating access rights is complicated and the requests of practitioners are diverse, it is difficult for managers to verify the information and to confirm that it is accurate information.

As an example, Korean Patent Registration No. 10-0832093 (May 27, 2008) discloses a technology for provisioning resource accounts and resource rights according to rights by managing resources with rights in integrated account management technology.

As such, analyzing and classifying user access rights in a solution or service that uses access rights requires a lot of time and effort, so an automation technology for analyzing resource rights is required.

It is possible to provide an artificial intelligence-based permission classification/recommendation system and method for access permission analysis.

It is possible to provide a system and method that analyzes the access right in advance to generate the final access right as reliable data, rather than being implemented in the service to which the access right is finally applied.

The authority analysis system includes: a data collection unit for collecting resource data of a user by using an application for analyzing resource usage details; a role classification unit for classifying role information based on a similarity between the user and the resource use relationship between the user and the user through an artificial intelligence engine for authorization analysis and processing of the collected user's resource data; a storage unit configured to store, in an analysis storage, final role information in which the user's authority to the classified role information is adjusted by the review of the administrator as the classified role information is provided to the administrator; and a migration unit that migrates the final role information stored in the analysis storage to the permission storage of a system providing a service according to permission.

The role classification unit extracts mapping data according to the resource use relationship between the user and the user, classifies the role information according to the degree of similarity using a machine learning-based clustering algorithm through the extracted mapping data, and the classified Role information may be calculated as a recommended role.

The role classifier may classify users having a similarity of authority values for each user in each cluster classified according to the cluster similarity to a gray list, the users having a similarity of less than or equal to a set standard.

The role classification unit includes providing a right assignment type including a direct authority assignment method, a compulsory authority assignment method, or a role authority assignment method as the role information is analyzed through an artificial intelligence engine, wherein the direct authority assignment method includes: It is a method in which role information related to authority assignment is not classified based on the user's attributes, but is randomly assigned privileges. In the case of complexity, the authority is assigned, and the role authority assignment method may be a method in which authority is assigned when role information related to authority assignment has a complexity greater than or equal to the preset standard based on user attributes. .

The migration unit provides the manager with a user interface for identifying the authority for the classified role information, and provides the classified role information to the manager through the user interface for identifying the authority as the classified role information is provided to the manager Receiving that the user's authority to the information is determined response information including approval or rejection, and granting or denying the user's authority to the classified role information based on the received response information, to the classified role information Information on the final role of which the user's permissions are adjusted can be stored in the analysis repository.

The migration unit may synchronize the final role information stored in the analysis storage based on the architecture of the permission storage through the migration engine.

The data collection unit provides the user with a user interface for the collection of authority data, inserts an intelligent script into an application running on the user's device, and adds authority or authority configured through selection as a user through the provided user interface It may collect resource data related to deletion requests.

It can help the administrator to build the authority system by resolving the difficulty of repetitive work in setting access rights and by suggesting and recommending the initial authority system.

Based on the resources actually used, the usage rate and frequency of use are analyzed and the similarity of the usage groups is analyzed through the AI-based analysis processing engine to easily build the authority system.

By using the pre-established authority information to create the access authority system, the authority system can be easily managed after the access authority is completed.

1 is a diagram for explaining the general operation of the dictionary authority analysis system according to an embodiment.
2 is an example for explaining an operation of collecting resource data in the dictionary authority analysis system according to an embodiment.
3 is an example for explaining an operation of calculating a recommended role in the dictionary authority analysis system according to an embodiment.
4 is a graph showing a result of performing clustering in the dictionary authority analysis system according to an embodiment.
5 is an example showing a result of measuring cluster adequacy in the dictionary authority analysis system according to an embodiment.
6 is a diagram for explaining an operation of setting an access right in the dictionary authority analysis system according to an embodiment.
7 is an example for explaining an operation of migrating in the dictionary permission analysis system according to an embodiment.
8 is a block diagram illustrating the configuration of a dictionary authority analysis system according to an embodiment.
9 is a flowchart for explaining a method of performing an AI-based permission classification and recommendation for access permission analysis in the dictionary permission analysis system according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

In the embodiment, the classification of the authority based on artificial intelligence for the analysis of the access authority and the recommended technology will be described. Analyzing and classifying user access rights in a solution or service that uses access rights is a task that requires a lot of time and effort. The dictionary permission analysis system simplifies the process of repeating the verification of users and artificial intelligence for grouping or role or classification by specific rules used in access rights, and can derive reliable results. Analyze the overall access right in an environment in which the user who is granted access rights and the middle manager who approves the user's access right and the manager who approves or approves can also become a user, and finally builds a classification system in relation to the analyzed access right can provide

1 is a diagram for explaining the general operation of the dictionary authority analysis system according to an embodiment.

It is possible to provide an authority classification and recommendation service through data transmission/reception between the user 110 , the manager 120 , and the dictionary authority analysis system 100 . The dictionary permission analysis system 100 may be implemented by a server that provides a permission classification and recommendation service.

The prior authority analysis system 100 is a system that is applied in advance to generate the final access authority as reliable data, rather than being implemented in the finally applied service. The dictionary permission analysis system 100 can be easily built by analyzing access rights (eg, roles, groups, or specific classification systems) through artificial intelligence. The prior authority analysis system 100 is a system built in advance to easily create the final access authority system, and can manage the authority system after the access authority is completed.

The dictionary permission analysis system 100 may provide a user interface for permission analysis through the permission analysis application 101 . In this case, the permission analysis application 101 may be operated in the device of the user 110 and the manager 120 . The authorization analysis application 101 may collect resource data (authorization data for resources) through an intelligent script. As the intelligent script is inserted into the permission analysis application 101, data for permission analysis may be collected. Through the permission analysis application 101, the menu configuration to be actually implemented is provided to the user 110 to explicitly collect the permission, and the resource data configured according to the selection of the user 110 is transferred to an artificial intelligence-based permission processing engine (hereinafter referred to as the permission processing engine). , which will be referred to as an artificial intelligence engine).

The AI engine can analyze permissions and recommend roles. The AI engine can classify and recommend direct or indirect right assignment or role information based on the collected right information. The artificial intelligence engine may classify privileges for each user by using data collected from users, and may apply or recommend appropriate privileges and roles to the user based on the classified data.

The analysis storage 102 configured in the prior authorization analysis system 100 may store collected resource usage information, classification and recommended authorization information. In this case, a database may be used for the analysis repository 102 . The analysis storage 102 may provide a storage for storing and analyzing data collected for each analysis order, and may store a final authority analysis result and a list of roles. The analytics repository 102 may provide migration for applying the final rights data to the rights store 103 . At this time, it may be migrated from the analysis storage 102 to the permission storage 103 using the access right through the migration engine. In this way, it is possible to apply to any system that requires authority analysis (eg, ERP, personnel system, etc.).

The prior authority analysis system according to an embodiment may automate the authority analysis and application, which has been manually performed by an administrator (person in charge). By applying the implicit permission data using log data and the explicit permission data using the user interface to the artificial intelligence engine, it is possible to recommend actually applicable user rights to the administrator.

The dictionary authority analysis system according to an embodiment can reduce the time required for authority analysis in the actual construction stage by automating authority analysis. In addition, the prior authorization analysis system can identify and block inconsistencies and uncertainties in authorization information in advance when actual operation is switched by explicitly collecting authorization information through the user interface for authorization collection. In addition, the prior authority analysis system can execute the authority system building process by standardizing the authority analysis system.

2 is an example for explaining an operation of collecting resource data in the dictionary authority analysis system according to an embodiment.

The proactive permission analysis system can collect resource data for permission analysis through intelligent scripts. By inserting an intelligent script into the operating permission analysis application, resource data for permission analysis can be systematically collected. The dictionary permission analysis system may extract user and resource mapping data when collecting information for a user to use a resource (menu). The mapping relationship between users and resources can be displayed according to distribution. Here, the resource may mean a menu or a specific function. The right to access a resource including a menu or a specific function (eg, print, file download, etc.) may be different according to each user's authority.

3 is an example for explaining an operation of calculating a recommended role in the dictionary authority analysis system according to an embodiment.

The dictionary authority analysis system can classify role information based on the similarity (similar authority) of the resource use relationship between the user and the user through the artificial intelligence engine for authority analysis processing of the collected user's resource data. As the dictionary permission analysis system displays the distribution of mapping relationships between users and resources, it can recommend the first role data that can organize roles according to cluster similarity using a machine learning clustering algorithm through the data. The prior authority analysis system may divide the recommended roles into a plurality of roles according to the degree of similarity and deliver them to the manager. Separation and integration of data delivered to the manager may be performed. The dictionary permission analysis system can be classified into one group according to the user's resource use mapping relationship. Groups with similar privileges may be clustered according to mapping similarity and calculated as a primary recommended role.

4 is a graph showing a result of performing clustering in the dictionary authority analysis system according to an embodiment.

The prior authorization analysis system can classify recommended roles according to similarity by performing a machine learning clustering algorithm. For example, as a machine learning development environment, python can be used in the anaconda3 + jupyter notebook environment. In addition, it can be applied to various development environments. Clustering according to the authority value may be tested while sequentially increasing the resource list sample for each user. In this case, clustering can be performed using the KMeans algorithm, an agglomerative clustering algorithm, or the like. In using the clustering algorithm, the dictionary authority analysis system may perform additional processes such as data sampling to be used for analysis and data transformation for data mining (deduplication, normalization, dimension reduction, etc.).

Referring to the graph of FIG. 4 , the elbow chart shows the appropriate number of clusters for the target sample (eg, 3000 users, 1000 permission values), and the number of clusters is '68 When ', you can see that it is the elbow part. This indicates that optimal results can be obtained when the target sample is classified into 69 clusters.

Referring to FIG. 5 , it is an example showing the results of measuring cluster adequacy. The silhouette (sihouette) technique is a method for quantitatively calculating the quality of a cluster. If the number of clusters is appropriate, it will be close to 1, and if it is closer to 0, it means that the number of clusters is not appropriate. As shown in FIG. 4 , for example, when a target sample is classified into 69 clusters, a graph close to 1 appears, indicating that an appropriate number of clusters has been found.

6 is a diagram for explaining an operation of setting an access right in the dictionary authority analysis system according to an embodiment.

The dictionary permission analysis system 100 can help to easily apply the permissions of systems that set access permissions in advance. The dictionary authority analysis system 100 may include WEB/WAS, a rights analysis application 101 , an analysis repository 102 , and a rights repository 103 . A permission request/approval engine, a permission analysis processing engine, a permission request reading/adjusting engine, and a migration engine may be configured in the permission analysis application 101 of the dictionary permission analysis system 100 .

The prior authority analysis system 100 is a user interface through which the user can select authority through the authority analysis application, a user interface through which the middle manager can approve and modify authority, a user interface through which the middle manager can manage authority information, the final It is possible to provide a user interface for the administrator to analyze the authorization information and adjust the analysis contents. In addition, the prior permission analysis system 100 provides a user interface for the administrator to manage permission approval/denial, an engine for managing data when permission approval/denial, an interface for the administrator to manage resources, and permission relationships. It is possible to provide an interface that can manage, an artificial intelligence-based management interface for administrators to use, and an interface that can manage mapping with data in the actual data storage as a permission analysis repository.

The dictionary permission analysis system 100 may provide a user interface through the devices of the user 110 and the manager 120 . The usage status may be collected on the device of the user 110 through an automatic information collector. In addition, the collected usage status information may be provided through the user information collection user interface provided to the device of the user 110 . The data analyzed in the pre-authority analysis system 100 is refined and composed of a personalized menu, and the final configured information is provided so that the authority value can be input so that it can be refined again into new authority data through the user information collection user interface. can

Specifically, the prior authorization analysis system may collect resource data through an automatic information collector capable of analyzing resource usage history. Through the collected resource data, the administrator can identify the resources used by each user, and can classify users with high similarity according to the user's attribute information. The classified user group can be classified by role information, and it can provide help in deciding whether to apply the permission assignment method according to the approach. Alternatively, the dictionary permission analysis system may classify resources for each user as it collects resource data input from users, and define roles according to the similarity of permission values. The prior authority analysis system may provide information on the authority allocation method as a result of the analysis. The administrator can check the roles defined by the selected role authority assignment method as summarized information and check whether it can be used as the actual role information.

The dictionary permission analysis system 100 may store data collected from the user by refining it as reference data in the analysis storage. In the stored data, user ID, resource information, etc. may be stored, and the artificial intelligence engine analyzes this information based on artificial intelligence, so that it can be changed and stored as meaningful authorization information. The main tables in the analytics repository can be represented as follows.

User table: A table that stores user ID, name, organization, etc.

Organization table: This is the user's organization table. A table necessary to analyze the user's organization information and the relationship between organization and resource usage.

Resource table: A table in which system resources using access rights are stored.

Role table: A table in which roles classified through similarity analysis are stored

Role-resource table: A table that stores roles classified through similarity analysis and resources mapped to roles. The role and resource mapping relationship is divided by order, and role-resource information that is integrated or subdivided by degree of similarity is stored.

User-resource table: A table to which resources used by users (such as menu buttons) are mapped. Resources are mapped for each user, so similar mapping information provides information on how to apply permissions after classification through similarity analysis in the artificial intelligence engine

User-resource-result table: A table that stores the results of classification by the AI engine based on the information entered in the user-resource table. Based on this table, resource rights are finally provided to users

Organization-resource table: stores the information needed to map the user's resource usage history to the user's organization and read the correlation between the organization and the resource

Environment setting table: An environment setting table that allows adjustment of the score to adjust the probability of similarity and the input value to be input to the AI engine. Based on the user's similarity setting value, clusters are classified through similarity analysis of each user's resource use. recommended as separate role information

Greylist Table: A table where users with no similarity are grouped separately so that the administrator can directly analyze the content and check whether to separate/merge the roles of the user.

Request/Approval Table: A table containing information that allows you to request and grant permissions. Authorized users apply for and receive authorizations for resources, and the authorized contents are stored through signatures.

The prior authority analysis system 100 may provide a request for correction by checking the analysis result as the authority collection is completed. Access rights may be requested by the user. The administrator can verify the access right requested by the user through the review screen, and can derive the final access right by repeating the process of approval/rejection/modification. The administrator can approve the requested access right through secondary authentication (eg, digital signature) and store the approved information. Alternatively, a resource required by the user may be requested from the user. The administrator can derive the access right by repeating the process of approval/rejection/modification by checking the authority of the resource requested from the user.

When the resources available for each user are defined, the dictionary permission analysis system 100 may perform a cluster classification task according to the similarity between the user and the resource use relationship through the cluster algorithm. The prior authority analysis system 100 can classify simply or in detail according to the similarity setting value according to the data review of the administrator, and as a result of the classification operation, the authority management type (direct authority assignment, compulsory authority assignment, role authority assignment) Analytical data can be provided so that decisions can be made.

Direct permission assignment refers to a management type applicable when permission assignments are not classified based on user characteristics/attributes and permissions should be randomly assigned.

Forced permission assignment refers to a management type applicable to less than a preset number (eg, around 10) when the classification of permission assignments is not complicated and simple according to user characteristics/properties.

Role authority assignment refers to a management type that can be applied when the contents of authority assignment are relatively complex to be classified according to the characteristics/properties of the user. Most of the cases in which the degree of relative complexity follows the characteristics of the organization are applicable, and it is a suitable model when the number of roles is greater than or equal to a preset number (eg, at least 10 or more).

The administrator can determine the type of authority management through analysis data and, in the case of role authority assignment, set and store roles based on the classification results presented in the recommended classification task.

The dictionary permission analysis system 100 may store the permission classifications of unclassified missing users as permission graylists and organize them into separate classifications by the administrator's reading or include them as existing classified permissions to organize the graylist. For example, the dictionary authority analysis system may secondarily classify authority values for each user in each cluster classified as a similarity classification, and classify users whose similarity falls more than a specific value into a gray list. Users classified in the gray list are displayed in the similarity item within the group through the manager's device, and the manager can determine whether to include the user in the group.

Finally, the organized authorization data can be migrated to the authority repository of the actual system. The prior authority analysis system can determine the authority type based on the result recommended by the artificial intelligence engine and reflect the final authority result value.

The dictionary authority analysis system according to an embodiment may analyze the usage rate and frequency of use based on the resources actually used, and analyze the similarity of the usage groups through an artificial intelligence engine to construct an optimal authority system.

7 is an example for explaining the migration operation in the dictionary permission analysis system according to an embodiment.

The final permission values stored in the analytic store can be synchronized based on the architecture of the permission store through the migration engine. In this case, the administrator may be provided with a user interface capable of comparing values and adding and deleting necessary information.

The permission repository can be various systems that require access rights, and it can have a separate permission system to suit the characteristics of each system. The information stored in the analysis store is stored in the most subdivided authorization information, and it can be synchronized to fit the architecture of the authorization storage information (table and field structure of DB, etc.).

8 is a block diagram for explaining the configuration of a dictionary permission analysis system according to an embodiment, and FIG. 9 is an artificial intelligence-based permission classification and recommendation for access permission analysis in the dictionary permission analysis system according to an embodiment. This is a flow chart to explain how to do it.

The processor of the dictionary permission analysis system 100 may include a data collection unit 810 , a role classification unit 820 , a storage unit 830 , and a migration unit 840 . The components of such a processor may be representations of different functions performed by the processor according to a control instruction provided by a program code stored in the dictionary authority analysis system. The processor and the components of the processor may control the prior authority analysis system to perform steps 910 to 940 included in the method for performing an AI-based authority classification and recommendation for access authority analysis of FIG. 9 . In this case, the processor and the components of the processor may be implemented to execute instructions according to the code of the operating system included in the memory and the code of at least one program.

The processor may load the program code stored in the file of the program for the method of performing authorization classification and recommendation based on artificial intelligence for access right analysis into the memory. For example, when the program is executed in the dictionary permission analysis system, the processor may control the dictionary permission analysis system to load the program code from the program file into the memory according to the control of the operating system. At this time, each of the processor and the collection unit 810 , the role classification unit 820 , the storage unit 830 , and the migration unit 840 included in the processor executes the instruction of the corresponding part of the program code loaded in the memory, and then may be different functional representations of a processor for performing steps 910 - 940 .

In step 910 , the data collection unit 810 may collect resource data of the user by using an application that analyzes the resource usage history. The data collection unit 810 provides the user with a user interface for the collection of authority data, and inserts an intelligent script into an application running on the user's device, and through the user interface provided, adding or adding authority configured through selection as a user It may collect resource data related to deletion requests.

In step 920, the role classification unit 820 may classify the role information based on the similarity between the user and the resource use relationship between the user and the user through the artificial intelligence engine for authority analysis processing of the collected user's resource data. The role classifier 820 extracts mapping data according to the resource use relationship between the user and the user, classifies the role information according to the similarity using a machine learning-based clustering algorithm through the extracted mapping data, and the classified role information can be calculated as a recommended role. The role classifier 820 may classify users having a similarity level of authority values for each user in each cluster classified according to the cluster similarity to a gray list, which is less than or equal to a set standard. The role classification unit 820 may provide a right assignment type including a direct authority assignment method, a compulsory authority assignment method, or a role authority assignment method as role information is analyzed through the artificial intelligence engine.

In operation 930, the storage unit 830 may store, in the analysis storage, the final role information in which the user's authority to the classified role information is adjusted by the administrator's review as the classified role information is provided to the administrator.

In step 940 , the migration unit 840 may migrate the final role information stored in the analysis storage to the permission storage of the system providing a service according to the permission. The migration unit 840 provides the administrator with a user interface for identifying the authority for the classified role information, and provides the classified role information to the administrator for the classified role information through the user interface for identifying the authority. Receiving that the user's authority is determined by response information including approval or rejection, the user's authority to the classified role information is adjusted by accepting or denying the user's authority to the classified role information based on the received response information The final role information can be stored in the analysis repository. The migration unit 840 may synchronize the final role information stored in the analysis repository based on the architecture of the authority repository through the migration engine.

The authority analysis system according to an embodiment may automate the authority analysis and application, which was performed manually by a person in charge. By applying the implicit permission data using log data and the explicit permission data using the user interface to the artificial intelligence engine, it is possible to recommend actually applicable user rights to the administrator.

As the authority analysis system according to an embodiment stores the final authority analysis result and the role list in the analysis repository for storing and analyzing the data collected for each analysis order, it is possible to provide migration for applying the final authority data to the actual operational storage. can

The authority analysis system according to an embodiment can significantly reduce the time and cost required for authority analysis in the actual construction stage by automating authority analysis.

The authority analysis system according to an embodiment may identify and block inconsistencies and uncertainties of authority information in advance during actual operation conversion by explicitly collecting authority information through a user interface for authority collection.

The authority analysis system according to an embodiment can efficiently execute the authority system building process by standardizing the authority analysis system as a system.

The device described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that can include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

Software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or apparatus, to be interpreted by or to provide instructions or data to the processing device. may be embodied in The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible from the above description by those skilled in the art. For example, the described techniques are performed in an order different from the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (7)

In the authority analysis system,
a data collection unit that collects user resource data using an application that analyzes resource usage history;
a role classification unit for classifying role information based on a similarity between the user and the resource use relationship between the user and the user through an artificial intelligence engine for authorization analysis and processing of the collected user's resource data;
a storage unit configured to store, in an analysis storage, final role information in which the user's authority to the classified role information is adjusted by the review of the administrator as the classified role information is provided to the administrator; and
A migration unit that migrates the final role information stored in the analysis repository to the authority repository of a system that provides services according to authority
Rights analysis system that includes. According to claim 1,
The role classification unit,
Extracting mapping data according to the resource use relationship between the user and the user, classifying role information according to the similarity using a machine learning-based clustering algorithm through the extracted mapping data, and recommending the classified role information calculated with
Authority analysis system, characterized in that. 3. The method of claim 2,
The role classification unit,
Classifying users of less than a standard in which the degree of similarity of authority values for each user in each cluster classified according to the cluster similarity is set as a gray list.
Authority analysis system, characterized in that. According to claim 1,
The role classification unit,
By analyzing the role information through the artificial intelligence engine, it includes providing a right assignment type including a direct permission assignment method, a compulsory authority assignment method, or a role authority assignment method,
The direct authority assignment method is a method in which role information related to authority assignment is randomly assigned without being classified based on user attributes,
The compulsory authority assignment method is a method in which authority is assigned when role information related to authority assignment has a complexity of less than or equal to a preset standard based on user attributes,
The role authority assignment method is a method in which authority is assigned when role information related to authority assignment has a complexity greater than or equal to the preset standard based on user attributes.
Authority analysis system, characterized in that. According to claim 1,
The migration unit,
A user interface for identifying the authority for the classified role information is provided to the manager, and the user for the classified role information through the user interface for identifying the authority as the classified role information is provided to the manager Receives that response information including approval or rejection is determined, and approval or rejection of the user's right to the classified role information based on the received response information, thereby allowing the user's authority to the classified role information Storing this reconciled final role information in the analytic repository
Authority analysis system, characterized in that. 6. The method of claim 5,
The migration unit,
Synchronizing the final role information stored in the analysis repository based on the architecture of the authority repository through the migration engine
Authority analysis system comprising a characterized in that. According to claim 1,
The data collection unit,
A resource related to a request to add or delete a permission configured through selection as a user through the provided user interface by providing a user interface for the collection of permission data to the user, and inserting an intelligent script into an application running on the user's device to collect data
Authority analysis system comprising a characterized in that.

Images