WO2012027993A1

WO2012027993A1 - Management method and device for resource use permission of operator

Info

Publication number: WO2012027993A1
Application number: PCT/CN2011/073331
Authority: WO
Inventors: 冯永华
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-08-30
Filing date: 2011-04-26
Publication date: 2012-03-08
Also published as: CN101931534A

Abstract

A management method for the resource use permission of an operator is provided in the present invention. The method includes: a system platform authenticates an operator according to the authentication request sent from the operator (101); when the operator is authenticated successfully, the system platform adjusts the current resource use permission of the operator according to the history record of the operation performed by the operator in the system platform (102). A management device for the resource use permission of an operator is also provided in the present invention. By adjusting the resource use permission of the operator according to the history record of the operation performed by the operator, the permission of the operator can be automatically configured according to the work habits and behaving of the operator, and the configuration for the resource use permission is more flexible and reasonable.

Description

Management method and device for operator resource license

The present invention relates to the field of communications, and in particular, to a method and apparatus for managing operator resource usage licenses. Background technique

The call center is a technology based on Computer Telephony Integration (CTI). The call center can fully utilize the multiple functions of the communication network and the computer network to integrate with the enterprise to form a complete integrated information service system. Efficiently provide high quality, high efficiency and comprehensive services by using various advanced communication methods. The initial forms of the call center include artificial hotline, interactive automatic voice and multimedia services. Currently, the call center has developed into an IP-based triple-play next-generation call center, which can be applied not only to various enterprises, but also to applications. Other groups or institutions.

The International Organization for Standardization (ISO) defines five security service functions in IS07498-2: identity authentication services, access control services, data privacy services, data integrity services, non-repudiation services, which are applicable to call centers. When the above functions are implemented, the access control service is based on the identity authentication service, and the system identifies and authenticates the subject in advance through the identity authentication service, and then determines whether to allow the subject to access the object through the access control service to reach the control subject. The purpose of accessing the object.

Access control is a way to explicitly grant or limit access capabilities and scope in some way. The access itself involves the subject and the object. In other words, the access control guarantees that the subject uses the object in a controlled and lawful manner. The subject here refers to a visitor such as a user, a process, a service, a third-party system, etc., and the object refers to a target object such as a system resource, a user operation, a task, an interface of a third-party system, and the like. Access control is the core module of the system. With access control, system resources can be controlled, By legally using it, by restricting the subject's access to the object, it is possible to prevent the intrusion of illegal users and to prevent the inadvertent operation of legitimate users.

Generally, designing an access control service requires consideration of permissions (also referred to as resource licenses in a broad sense) and authorizations, where permissions are the subject's permission to access the object, and authorization is the process by which the administrator grants access to the object to the principal. The relationship between subject, object, authority, and authorization varies with access control policies, since the introduction of subject, object, and access control matrix

At the beginning of (ACM), various models for access control, such as autonomous access control (DAC), mandatory access control (MAC) model, and role-based access control (RBAC) model, have emerged, and the access control model has been studied. It has been extended to more areas, such as the extension to the task-based access control model (TBAC), the task-oriented RBAC model (T-RBAC), and the use of the control core model (UCONABC).

However, the various access control models proposed so far have their own limitations and shortcomings, so no matter which field is applied, there will be corresponding problems. Taking the call center as an example, if the DAC model is used in the call center, the management rights will be dispersed, which is not conducive to centralized management. It will also cause information to spread and leak, and there will be abuse of authority. If MAC is used, the system will be made. Excessive emphasis on confidentiality, inadequate consideration of system continuous workability and manageability, cumbersome security level definition, and inflexible implementation, not suitable for more complex scenarios such as the Internet; in addition, because modern call center platforms involve numbers Resources, privacy information, trusted management, Internet, workflow, distributed systems, which require access control services to take into account the impact of call center subject attributes and object attributes on authorization, so the RBAC model can not take this aspect into account.

For other system platforms or networks other than call centers, similar problems can occur when using the current access control model.

In view of the problem that the related technologies cannot be used in a complicated system or network due to the respective defects of various models, an effective solution has not been proposed yet. Summary of the invention

The present invention proposes a management method and apparatus for operator resource use permission, which is capable of operating a complex system or network, due to the respective defects of various access control models in the related art, that is, the authority of the operator (ie, Resource usage licenses are dynamically managed and adjusted to make the configuration of resource licenses more flexible and reasonable.

The technical solution of the present invention is implemented as follows:

According to an aspect of the present invention, a management method of an operator resource usage license is provided. The management method of the operator resource usage license according to the present invention includes: the system platform authenticating the operator according to an operator-initiated authentication request; in the case where the operator passes the authentication, the system platform is according to the operation The history of operations performed by the member on the system platform adjusts the operator's current resource usage permissions.

The system platform authenticating the operator according to the authentication request initiated by the operator includes: determining, by the system platform, the identity information of the operator according to the authentication request, and searching for the historical record; Comparing the operation parameter carried in the authentication request with the historical record, and determining whether the operation parameter meets a preset authentication pre-passing condition; if the determination result is yes, the system platform allows the operator to directly Passing the authentication; if the judgment result is no, the system platform authenticates the operator according to the authentication request.

The operation parameter may include at least one of the following: a sending time of the authentication request, a sending location of the authentication request, and a service type requesting to perform an operation.

In addition, before the system platform adjusts the current resource usage permission of the operator according to the historical record of the operation of the operator on the system platform, the method further includes: the system platform according to the historical record Determining, by the operator, a resource usage permission adjustment parameter, where the resource usage permission adjustment parameter is used to indicate that the operator operates on the system platform;

The adjusting the current resource usage permission of the operator includes: according to a preset Determining, by the plurality of different levels of resource usage licenses, a plurality of resource usage permission adjustment parameter ranges, determining resource usage licenses corresponding to the resource usage permission adjustment parameters of the operator, if the determined resource usage licenses and If the operator's current resource usage license is different, the operator's resource usage license is adjusted to the determined resource usage license.

In addition, the system platform determines, according to the historical record, the resource usage permission adjustment parameter of the operator, including:

Determining, by the system platform, the maturity of the operations performed by the operator corresponding to each type of service according to the history record, and determining, according to the history record, the operations performed by the operator corresponding to each type of service Capability, where, for each type of service, maturity is used to indicate the degree of stability of all operations performed by the operator corresponding to the type of service, and the capability is used to indicate that the operator corresponds to the The efficiency of all operations of the type service; the system platform determines the operation status of the operator corresponding to the service type according to the maturity and capability of the operation performed by the operator corresponding to each service type, And a resource use permission adjustment parameter indicating a situation in which all operations performed by the operator are performed.

In addition, after adjusting the current resource usage permission of the operator, if the operator requests to use the specified resource, the method may further include: determining, according to the adjusted resource usage permission, whether the operator is capable of using Specifying the resource; if the determination result is yes, allowing the operator to use the specified resource; if the determination result is no, the operator is prohibited from using the specified resource.

Optionally, the historical record includes one or a combination of the following: a start time of each valid operation performed by the operator, an effective duration of the operator performing each operation, and each operation performed by the operator. The corresponding service type, the number of valid operations performed by the operator corresponding to each service type, the evaluation of the operation of the operator by the user, the quality inspection evaluation of the operation of the operator by the system, The timely rate at which the operator responds to a user's request.

Optionally, the above system platform includes a call center. According to another aspect of the present invention, a management apparatus for an operator resource usage license is provided. The management device for operating an operator resource license according to the present invention includes: a data conversion module, configured to acquire, from a system platform, a history of operations performed by an operator on the system platform; and an authentication module, configured to perform an authentication request initiated by an operator The operator performs authentication; and the access control module is configured to adjust the current resource usage permission of the operator according to the history record acquired by the data conversion module, if the authentication module confirms that the operator passes the authentication.

The authentication module is further configured to determine the identity information of the operator according to the authentication request, and search for the history record, and compare the operation parameter carried in the authentication request with the historical record, and determine Whether the operation parameter meets the preset authentication pre-passing condition; if the determination result is yes, the authentication module allows the operator to directly pass the authentication; if the determination result is no, the authentication module according to the authentication request The operator is authenticated.

In addition, the access control module is further configured to determine, according to the history record acquired by the data conversion module, the resource usage permission adjustment parameter of the operator, where the resource usage permission adjustment parameter is used to indicate that the operator is The operation of the system platform is performed; and the access control module is further configured to determine the operator according to a preset relationship between a plurality of different levels of resource usage licenses and a plurality of resource usage permission adjustment parameter ranges. Resource usage permission corresponding to the resource usage permission adjustment parameter, if the determined resource usage permission is different from the current resource usage permission of the operator, adjusting the resource usage permission of the operator to the determined resource License.

The invention adjusts the operator's resource use permission according to the operator's operation history, so that the operator's authority can be dynamically configured according to the operator's work habits and work performance, so that the resource use license configuration is more flexible and reasonable. DRAWINGS

1 is a flowchart of an operator resource use license management method according to an embodiment of the present invention; FIG. 2 is a block diagram of an operator resource use license management apparatus according to an embodiment of the present invention; Schematic diagram

3 is a detailed structural diagram of an operator resource use license management apparatus according to an embodiment of the present invention;

4 is a schematic diagram showing the structure of an emergency command center platform using an operator resource use license management apparatus according to an embodiment of the present invention;

Figure 5 is a flow chart of police officers providing services to the public in the system shown in Figure 4;

Fig. 6 is a flow chart showing the management control by the operator resource use license management apparatus of the embodiment of the present invention in the course of the police officer providing the service to the citizen. detailed description

In view of the problem in the related art that a complex system or network cannot be used due to various defects of various access control models, the present invention proposes to adjust an operator's resource usage according to an operator's operation history for an authenticated operator. Licensing, so that the operator's authority can be dynamically configured according to the operator's work habits and work performance, making the resource license configuration more flexible and reasonable.

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

According to an embodiment of the present invention, a management method of an operator resource usage license is provided. As shown in FIG. 1, a management method of an operator resource use license according to an embodiment of the present invention includes the following steps:

Step 101: The system platform authenticates the operator according to the authentication request initiated by the operator. Step 102: In the case that the operator passes the authentication, the system platform uses the current resource of the operator according to the historical record of the operation of the operator on the system platform. The license is adjusted.

By means of the above processing, by adjusting the operator's resource use permission according to the operator's operation history, the operator's authority can be dynamically configured according to the operator's work habits and work performance, making the resource use license configuration more flexible and reasonable.

When the system platform authenticates the operator according to the operator-initiated authentication request, the system is flat. The station determines the identity information of the operator according to the authentication request and searches for the history record; the system platform compares the operation parameters carried in the authentication request with the history record, and determines whether the operation parameter meets the preset pre-passing condition; if the judgment result is yes, The system platform allows the operator to directly pass the authentication; if the judgment result is no, the system platform authenticates the operator according to the authentication request. The operation parameter conforms to the preset authentication pre-passing condition, which may be: the history record includes the same operation parameter as the current authentication, or contains an operation parameter similar to the current authentication. The operation parameter includes at least one of the following: a sending time of the authentication request, a sending location of the authentication request, and a service type requesting the operation. When the operator requests authentication, the service type carried in the authentication request sent is service type A, the time for initiating the request is time B of the day, and the place where the authentication request is initiated (address, which can be the network address) is C. At that time, it can be found in the history whether the operator has operated on the service type A, whether the operator has operated at the location C in the operation history, and usually at which time of the day the operator initiates the operation. After the search, the authentication request can be judged according to a preset rule. For example, the rule may be configured to consider that the authentication request is reasonable if there are records in the history that are the same as or similar to the above three items; or may be configured as long as the three items in the history can be found or The same record can be considered reasonable. The specific similarity judgment rule may also be preset by the system. For example, it may be configured that the time difference is within two hours, which may be regarded as a similar moment.

Before the system platform adjusts the current resource usage license of the operator according to the history of the operation of the operator on the system platform, the system platform may determine the resource usage permission adjustment parameter of the operator according to the historical record, wherein the resource usage permission adjustment parameter Used to indicate that the operator is operating on the system platform. For the specific information in the history that should be obtained as the resource usage adjustment parameter, it can be set according to the requirements of the system platform, for example, if the operator is evaluated. Mainly need to consider the workload information, you can put the workload of the operator Information such as working hours and other factors are used as resource use permission adjustment parameters. If the evaluation of the operator mainly needs to consider the work ability, the operator's work efficiency and work quality (evaluation) information can be used as resource use permission adjustment parameters. For how to obtain the resource license adjustment parameters based on the information obtained from the history, all operators can use a unified method for calculation and statistics.

After the resource usage permission adjustment parameter of the operator is obtained, when the operator's current resource usage permission is adjusted, the correspondence between the plurality of different levels of the resource usage license and the plurality of resource use permission adjustment parameter ranges may be set according to the preset. The relationship determines the resource usage license corresponding to the resource usage permission adjustment parameter of the operator. If the determined resource usage license is different from the operator's current resource usage license, the operator's resource usage license is adjusted to the determined resource usage license.

For a human service system such as a call center or an emergency command center, the history of operations performed by the operator may mainly include one or a combination of the following: the start time of each effective operation performed by the operator, and the effective operation of each operation by the operator The duration, the type of service corresponding to each operation performed by the operator, the number of valid operations performed by the operator corresponding to each type of service, the evaluation of the user's operation on the operator, and the quality evaluation of the system's operation on the operator The time rate at which the operator responds to the user's request, the address (location) of the operator at each operation.

In order to adjust the operator resource license, the historical operation of the operator can be determined based on the history. For example, according to the history, the operator's ability, proficiency, proficiency, proficiency can be directly obtained according to the historical record. However, it should be understood that the ability and proficiency can also be obtained according to operating habits and attendance. The operational habits and attendance are intermediate results of the processing of historical records. Finally, the operator's resource license can be adjusted according to the determined capability and proficiency and the adjustment rules set for these information, so as to dynamically adjust the operator's authority. The following is an example of determining the ability and proficiency of the operator to perform the operation.

When the system platform adjusts the current resource usage permission of the operator according to the history of the operation of the operator on the system platform, the system platform can determine the maturity of the operation performed by the operator corresponding to each service type according to the history record, and Determining the degree of capability of the operator to perform operations corresponding to each type of service based on the history, wherein for each type of service, maturity is used to indicate the degree of stability of all operations performed by the operator corresponding to the type of service, If you perform 10 times, the performance of each operation is basically the same, indicating that the maturity is higher, and if you perform 10 times, one of the operations performed very well, and the other performed very poorly, that is, Saying that the performance is fluctuating, it means that the maturity is poor, and the specific maturity can be achieved through a series of satisfactions, which will be explained later; the ability degree is used to represent all operations performed by the operator corresponding to the type of business. Efficiency; the system platform corresponds to each of the operators The maturity and ability of the operation of the type of operation, determine the operation of the operator corresponding to the type of service, and thereby obtain all the operations performed by the operator under the current resource use permission (ie, resource license adjustment) Parameter); The system platform adjusts the operator's resource usage license based on all operational conditions performed under the current resource usage license.

Specifically, when determining the maturity of operations performed by the operator corresponding to each type of service based on the history, the following formula can be used to determine:

M=AxBxC;

Where M is the maturity of the operation performed by the operator corresponding to a service type, A is the satisfaction of the user with the operation corresponding to the service type of the operator, and B is the corresponding one of the system to the operator. The quality of the business operation evaluation satisfaction, C is the ratio of user complaints that occur to the operator in all operations corresponding to the type of business. At this point, you can get the operator's operational maturity for a type of business.

And, when determining the ability of the operator to perform the operation corresponding to each type of service based on the history, the following formula can be used to determine:

N=CxDxE Where N is the capability of the operator to perform an operation corresponding to a service type, and C, D, and E are respectively a timely response rate, a timely processing rate, and an effective working rate corresponding to the operation of the operator for the service type, wherein :

Timely response rate = number of timely responses / ACD (automatic call distribution) queue success number; timely processing rate = timely processing times / timely response times;

Effective work rate = effective working time / total working time. At this time, according to the above parameters and the corresponding calculation method, the operator's operational ability for a certain type of service can be obtained.

Depending on the operator's operational maturity and ability for a type of service, the operator's operational status for that type of service can be obtained, which can be a performance indicator by the operator corresponding to the type of operation of the service type. Specifically, an operational performance indicator corresponding to the type of business performed by the operator can be determined according to the following formula:

L= MxNxW;

Where L is the performance indicator of the operation performed by the operator corresponding to the service type, M is the maturity of the operation performed by the operator corresponding to the service type, and N is the operation performed by the operator corresponding to the service type. Capability, W is the default weight value for this type of business.

Generally, for some system platforms, there are many different levels of resource licenses. Under each level of resource license, the operator can only operate on one type of service. At this time, the operator operates on the type of service. The performance indicator can be used as the resource license adjustment parameter of the operator. If the operator's performance indicator for operating the business type reaches a certain value (or the value of the current performance indicator falls within the value range corresponding to a resource license) After that, the operator's resource usage license can be adjusted.

For a more complex system platform, the operator can operate on multiple service types under one level of resource license. In this case, the performance indicators of multiple service types corresponding to the current resource license of the operator need to be integrated. Consider, get performance statistics that reflect the operational status of all types of operations performed by the operator. For example, it can correspond to the following formula The performance indicators for each type of business are weighted to obtain the operator's performance statistics: TT / Wi i +W ₂ X ₂ +...+W _n X _n \ ^λ I \ ^λ

W= 丄丄丄 = >

w _l +w ₂ +...+w _n / J w Ix I. I / J I. Where W is the comprehensive performance indicator and _Wi is the weighted value of the i-th business, which is the performance indicator of the i-th business.

At this point, the operator's performance statistics can be used as the operator's resource usage adjustment parameters, similarly, if the operator's performance statistics reach a certain value (or the current performance statistics result falls within a resource license) After the corresponding range of values, the operator's resource usage license can be adjusted.

In order to perform strict resource license control (ie, strict control of the operator's authorization), the types of resources allowed for each resource license level and the performance indicators corresponding to each level of resource license can be pre-configured. The range of values or the range of performance statistics, so that the level of resource usage that the operator is eligible to be determined can be determined. If the current resource usage level of the operator does not match the determined level, the current resource usage of the operator can be used. The license is adjusted to match the level of current performance indicators or performance statistics.

Optionally, for each value range corresponding to the resource use permission level, the value or range of values corresponding to the performance indicator or the performance statistics result may be flexibly configured according to the operator's requirements according to the level, and may be based on the service type. The importance of configuring different weight values (W) makes the adjustment of resource licenses more flexible and can adapt to different system platforms and different management requirements.

It should be noted that the previous description of the process of adjusting the operator's resource use permission based on the capability and maturity is merely for explaining the present invention, and the present invention is not limited thereto, and in practical applications, for capability and maturity The determination can omit some of the factors mentioned earlier, and add other factors to be considered, and the above calculation formula for capability and maturity is the same. It is a specific example. The calculation method involved in each formula can be changed according to actual needs. Similarly, the parameter acquisition method in the formula can also be flexibly configured. For example, for the above parameter A, the parameter represents the user's operation on the operator. Satisfaction with the operation corresponding to the type of service, for example, if the operator's current resource license can only allow the operator to operate one type of service, then the scores of each operation user in the history can be added, The total score obtained is taken as A, and the user's score for the operator can be averaged (or weighted averaged) with the mean as A; and if the operator can perform multiple types of operations, the average for each service can be The score or the average score is weighted average. For the satisfaction of the quality inspection evaluation, the similar method described above can also be used. The specific method is no longer - enumerated, as long as the system acquires the same parameter of the operator with the same resource license. Use a uniform method.

In addition, in the above description, the reference for adjusting the operator resource use permission is the ability and the degree of the operator, and in practical applications, it is also possible to simply consider the workload, that is, as long as the workload satisfies certain requirements, The operator can adjust the resource license. In addition, the workload requirement can be combined with the capability and quantity. The operator's attendance rate can be further considered and judged. In short, according to different system platforms. Requirement, you can use different rules, and extract the required content from the operation history to judge.

After adjusting the current resource usage license of the operator, if the operator requests to use the specified resource, the system platform determines whether the operator can use the specified resource according to the adjusted resource usage permission; if the judgment result is yes, the operator is allowed Use the specified resource; if the judgment is no, the operator is prohibited from using the specified resource.

In addition, in the above processing, the adjustment of the resource use permission may be performed based on the traditional access control model, for example, the above process may be adjusted based on the resource use permission allocated by the traditional access control model for the operator, wherein, the traditional The access control model can be a DAC model, a MAC model, and an RB AC model.

According to an embodiment of the present invention, a management apparatus for an operator resource usage license is also provided. As shown in FIG. 2, an apparatus for managing an operator resource usage license according to an embodiment of the present invention includes:

The data conversion module 21 is configured to acquire and save a history of operations performed by the operator on the system platform from the system platform;

The authentication module 22 is configured to authenticate the operator according to the authentication request initiated by the operator; and the access control module 23 is configured to perform the operation according to the history record acquired by the data conversion module 21 when the authentication module 22 confirms that the operator passes the authentication. The current resource license is adjusted.

The structure and operation principle of the management apparatus for the operator resource use permission according to the embodiment of the present invention will be described in detail below.

As shown in FIG. 3, the data conversion module 21 can be connected to the data provider, specifically for acquiring an operation history of the operator.

After the device according to the present invention is applied to the call center, the data conversion module can obtain the employee information of the call center, the platform environment, the platform device status, the call center duty table, and the call center attendance data (for example, the operator can check in) The information is checked out, etc., and converted into a format recognizable by the authentication module 22 and the access control module 23, where the conversion operation includes username matching, password encryption and decryption, password matching, and the like. The data provider can be a call center employee management system, a call center labor management system, a call center scheduling system, or other similar systems that provide scheduling management, attendance management, employee profile information management, and employee performance indicator statistical analysis. In this case, the management device for the operator resource usage license according to the embodiment of the present invention may be set as a subsystem of the scheduling system, or the device may be connected to the scheduling system to transmit the history.

The authentication module 22 is configured to process an authentication request (message or function call) of the authentication requester, and the authentication requester refers to each system of the call center platform, and these systems are different in the user login (for example, the ordinary employee, the squad leader login, etc.) Resource license operator) When the login interface is used to initiate an authentication request, the authentication module 22 obtains the necessary data (which may be the operator's history) from the data conversion module 21, processes the authentication request, and returns the authentication result.

When the authentication is performed, the authentication module 22 is specifically configured to determine the identity information of the operator according to the authentication request and search for the history record, and compare the operation parameters carried in the authentication request with the history record to determine whether the operation parameter meets the preset authentication pre- The pass condition; if the judgment result is yes, the authentication module allows the operator to directly pass the authentication; if the judgment result is no, the authentication module authenticates the operator according to the authentication request.

The access control module 23 is configured to process an access request (message or function call) of the access requester, and the access requester is the authentication requester itself or its subsystem, sub-module, and is also a subordinate system of the call center platform, and these systems are requested by the operator. When an access request is initiated when the resource is accessed (accessed), the access control module 23 acquires the necessary data from the data conversion module 21, processes the access request, and returns the access permission result.

The processing procedure of the operator resource license management apparatus according to the embodiment of the present invention is as follows:

The authentication requester initiates an authentication request to the device when the call center platform user logs in or the single sign-on interface is invoked, and the authentication module of the device requests the data conversion module for the necessary data (which may be an operation parameter of the operator in the history record), the data. The conversion module returns data required by the authentication module, and then the authentication module performs an authentication operation, and returns an authentication result to the authentication requester;

If the authentication result is authenticated, the authentication requester is a legitimate user of the call center, is allowed to enter the call center platform, and is subsequently used by the access requester for further use. The access requester is a subsystem or sub-module of the authentication requester, so access The requesting party initiates an access request to the device before the call center platform user accesses the resource, and the access control module of the device requests the data conversion module for the necessary data (which may be a history record of the operation of the operator), and the data conversion module returns the access control. The data required by the module, then the access control module performs the usage decision, uses the implementation, uses the logging operation, and returns the access permission result to the access requester, if the access permission result is If the access is made, the access requester will obtain the resource access permission, and the access requesting party can access the corresponding resource, and during the access process, the access control module continues to use the data conversion module to return the data in real time or periodically for use decision, use implementation, and use. Logging operation; if the access permission result is that access is not allowed, the access requester cannot access the corresponding resource.

Further, as shown in FIG. 3, the access control module 21 of the present embodiment includes a usage decision sub-module 31, a usage implementation sub-module 32, and a usage log sub-module 33.

Specifically, the implementation sub-module 32 is used to provide creation, reading, updating, and transmission of resource usage licenses, and is responsible for providing the current usage license read, decision-making usage license creation and update to the usage decision sub-module 31. Using the implementation sub-module 31 to perform an access response to the access requester, and transfer the use permission;

The usage decision sub-module 32 performs resource usage permission decisions based on the necessary data from the data conversion module 21, and the decision model can use various existing access control models such as DAC, MAC, RBAC, etc.;

The use log sub-module 33 is responsible for recording the specific information of the access request of the access requester, the specific information of the access response, that is, the time, the subject, the object, the related system, the license, and the like for recording the access resource.

In the process, according to the necessary data from the data conversion module 21, the decision sub-module 31 is used to make a resource use permission decision according to the decision model, and the decision result is transmitted to the usage implementation sub-module 32;

If the access requested this time is the first access, and the decision result of the usage decision sub-module 31 is to allow access, the implementation sub-module 31 is used to create the license data and store it, if the decision result of the decision sub-module 31 and the last access permission are used. Otherwise, the implementation sub-module 32 is used to update the license data and store (ie, update the resource usage license of the requesting party). If the license data is not accessed for the first time, and the license data is not required to be updated, the implementation sub-module 32 is used to send the license data to the license data. Access requester, license data can include access request time, expiration date, access requester, accessed resource, permission flag Information or a combination thereof.

In the case of a human service system platform (for example, an alarm agent, a complaint workflow system, a police consultation system, etc.), when the resource license adjustment is performed according to the capability and maturity of the operator (requesting party), the same can be referred to. The formula used in the method examples section is evaluated. The maturity/capability model is expressed as follows:

Performance indicator = ability degree X maturity X business type weight

Ability = (effective number of active services / effective working hours) X timely response rate

Maturity = User Satisfaction X Quality Assurance Satisfaction X Major Complaint Ratio

The service type weights may be separately designed according to different service types. For example, the service type is an alarm whose weight value is larger than the service type is a police consultation weight; the effective manual service number is a service duration greater than 3 seconds and less than 30 seconds. The number of manual connection, the service duration range is set according to the service type; the effective working time is the attendance time (ie, the check-out time-check-in time) minus the busy time; the timely response rate is the employee in a few seconds (the specific length of time can be based on Flexible setting) The number of internal answering calls accounts for the total number of successful queues for the employee; User satisfaction is equal to the weighted average of the user ratings, for example, (χ χ ο+γ χ ο.6+ζ χ 1 ) / ( X+Y+Z ), where X is the number of unsatisfactory times, the weighted value is 0, Υ is the general number, the weighted value is 0.6, Ζ is the number of satisfactions, and the weighted value is 1; Quality inspection satisfaction = arithmetic mean of the quality inspector's evaluation points / total Sub-contraction ratio = (significant number of major complaints X degree weighting) / overall number of major complaints, the smaller the weighted value, the greater the complaint.

Based on the above capability maturity model, not only can pre-authorization be based on capability and maturity, but also in-service authorization can be further combined with urgency. At this time, urgency can be used as an auxiliary indicator of capability and maturity. Indicates the occurrence of an emergency or the holding of a temporary activity, for example, when the maturity is below a certain value (may have a major complaint) or the urgency is above a certain value (may have an emergency time), the system immediately labors the operator The service is controlled and managed, and all employees are allowed to handle the police consultation phone immediately when the urgency is within a certain range (there may be a certain large-scale activity start). In addition, in the above device, each module/submodule can establish a long connection through the IP/TCP protocol to transmit a message at any time, and can also use a function call or the like.

When configuring the above device, one or more modules can be configured to exist in a separate process, as components are called by other systems, and each module can be distributedly deployed on the network, which has high deployment flexibility.

In the following, the emergency command center manual service platform will be taken as an example to describe in detail that the device can be used as a unified operator resource license management center for various system platforms such as a call center platform, and all system modules of the system platform can use the device. User authentication and resource access control functions are provided to dynamically and continuously control the operator's access behavior through pre-authorization and access authorization, which not only can effectively manage the resource license of each operator in the system platform with relatively simple rights allocation. And can be applied to a platform based on manual services and complex permissions such as a call center platform, and can objectively evaluate and dynamically adjust the authorization of employees according to requirements.

In the example to be described, the emergency command center is used as the system platform, and the citizens are used as users, and the police officers and police officers are used as operators. Among them, the police officers and the police officers are direct users of the system (direct users). The public can also act as direct users and system customers.

The Emergency Command Center is a commonly used system platform for public safety and for handling public emergencies. The emergency command center is generally built on a sound emergency management system and utilized

ICT technology is an emergency management system based on call center communication, command and dispatch, and an e-government platform.

In this example, as shown in FIG. 4, the emergency command center platform is composed of a scheduling system, an automatic call distribution (ACD), an agent (AGENT), and a business system, and the citizen can use the alarm or consultation. Terminals such as telephones, mobile phones, interactive televisions, and computers initiate communication requests, access ACDs through communication networks (eg, mobile phone networks, cable networks, the Internet, etc.), and ACDs are responsible for queuing communication requests into AGENT. The process is not described in detail herein, and the present invention focuses on the situation after access to AGENT. The police officer is responsible for answering incoming calls on AGNET, using the business system to provide services to the public, and handing over the citizen's request to the police officer when necessary. It can be seen that the services provided by the emergency command center platform include human services, alarm services, police consulting services and other related services.

In addition, as shown in FIG. 4, in the present example, the management device for the operator resource use permission can be set to the scheduling system, so that the history of the police officer's work analyzed by the shifting system can be directly utilized, if necessary. In this case, you can also refer to the shift schedule, attendance data, etc. in the shift system for related processing. Specifically, the scheduling system is composed of a resource usage license management apparatus, a data analysis and performance subsystem, a traffic prediction and adaptation subsystem, and a shift table management subsystem according to an embodiment of the present invention.

The data analysis and performance subsystem can collect, analyze and count the traffic volume of the emergency command center and the work of the police officers in multiple dimensions, and calculate the performance indicators of the police officers. In this example, the data analysis and performance subsystem can collect and analyze the traffic volume of the emergency command center from the ACD, including the number of incoming calls, the number of queues, the average queue length, the number of queued successes, etc., and collect and analyze the police personnel's manual service from AGENT. And attendance data, etc., including check-in time, check-out time, number of busy times, busy duration, number of manual connections, and service duration per call, user evaluation, etc.; and ability to collect and analyze police officers from the business system Data, including the number of work orders, the number of manual services, and the number of work orders submitted per call; in addition, the data analysis and performance subsystem can also collect and analyze quality inspection evaluation data from quality inspection systems (not shown), including evaluation The total score, the number of quality checks, and the evaluation score of the quality-checked call, etc., collect and analyze user complaint data from the complaints system (not shown), including the severity of each complaint.

The traffic prediction and adaptation subsystem can be used to predict based on data provided by the data analysis and performance subsystem, and then adapted based on the predicted results, scheduling template settings, and individualized requirements of the police to obtain the schedule.

The shift management subsystem allows police officers to apply for change shifts, shifts, leave, and planned activities (eg Such as outings, travel, etc., overall preferences (for example, like night shifts, etc.), and can automatically modify the schedules obtained in the traffic prediction and adaptation subsystem within the parameters controlled by the administrator, thereby changing their work schedule.

The management device for the operator resource usage license may be the device shown in Figs. 2 and 3, which not only provides an account authentication and encryption function based on the class table, but also provides an access control function. In the present example, the above-described data analysis and performance subsystem, traffic prediction and adaptation subsystem, and schedule management subsystem are used to manage the resource usage license management device for the operator resource license.

The shifting system can provide functions such as duty table generation, change, police attendance management, and performance management as a whole. After the operator management license is added, other systems of the emergency command center platform can be connected to the shifting system. And request the scheduling system at login, at the beginning of the operation, during the operation to obtain certification and access permissions. The core data of the shifting system is the schedule and individual needs. The shift table includes the duty manual number, the name of the duty person, the password of the duty person, the skill, the duty shift, the maturity of the duty, the affiliation of the squad, etc. The aforementioned maturity is a specific example of the performance indicator; the attributes of the shift include the shift. Start time, end time, and the corresponding shift group when the shift is on duty. In this embodiment, the working basis of the management device for the operator resource use permission is also a class table, and the duty person password of the class table is read according to the work number during the authentication, and the skill, duty shift, ability is read according to the police employee number during the access control. Maturity and other data.

Figure 5 is a flow chart of the process of handling the citizen's request by the emergency command center platform. The specific steps are as follows: Step 51, the public uses the terminal to enter the ACD through the network;

If the citizens successfully queue up to the agent, proceed to step 52, otherwise continue to wait;

Step 52: Determine whether the police officer responds to the citizen's request, and if yes, perform step 53; otherwise, the process ends;

Step 53: The police officers communicate with the public and learn that the public needs to inquire about a police information;

Step 54, after the police open the system to query the police information, provide the police information to the public, if the citizen requests to handle the associated police, step 55 is performed, otherwise step 56 is performed; Step 55: The police officer submits an alarm work order in the business system, and performs step 56; Step 56, the citizen evaluates the police officer, the system records the citizen's evaluation, and the processing ends after the communication terminal.

In step 54, the police officer can automatically log in to the business system using the single sign-on interface. Before the inquiry, the police officer needs to check in the AGENT in advance. When checking in, the AGENT must obtain the certification permission from the management device of the operator resource license to log in. Go to AGENT.

Figure 6 shows the specific process of police officers performing police query in the business system. As shown in Figure 6, the query process is as follows:

Step 61: When the police officer needs to open the business system, the business menu can be executed in the AGENT;

Step 62: For the process of the police officer logging in to the AGENT, the single sign-on can be used to avoid repeated login. The single sign-on interface is called by the AGENT, and the service system resolves the single sign-on request, and extracts the job number, password, and the like;

Step 63: The service system sends an authentication request and an access control request to the management device module of the operator resource usage permission of the scheduling system (the request may be sent through the IP network), where the authentication request includes the police officer's encrypted work number and the encrypted password and the system name. Information such as the service name, the access control request includes the police officer's encrypted work number and encrypted password, system name, service name, access time, access resource name, etc., where the system name is AGENT and the business system, and the service type (also Called the business name) is the police consultation. The access resource name is the police query menu of the business system (assuming the menu exists in the system) and a police information.

Step 64: The management device of the operator resource usage license processes the authentication request, and sends the certification permission of the police officer according to the authentication result, wherein the authentication module in the management device of the operator resource use permission can set the job number and password in the authentication request. And the work number password of the class table is compared with the corresponding information stored. If the same, the police officer is considered to be legal, and then the system name and business name in the request are judged to be in the license database, and if it exists, the system is considered legal, and then To AGENT And the business system issues certification licenses.

If the police officer passes the certification, go to step 65, otherwise go to step 67.

Step 65: The access control module of the management device of the operator resource license is based on the work number, system name, service name, access time, access resource name, capability degree, maturity, shift, check-in time, and sign in the resource access request. Time and other information, whether the decision allows the police officer to continue to visit;

Step 66: Send an access permission to the service system according to the result of the decision; if the access permission indicates that access is allowed, step 68 is performed; otherwise, step 67 is performed;

Step 67, AGENT prompts the public to open the business system and its reasons, and the processing ends; Step 68, the business system allows the police to log in and access, AGENT opens the business system, and displays the business system police query interface.

In addition, in the above step 55, the management system that the business system uses the operator resource usage permission in the scheduling system can also submit the access control request, and the access resource at this time is the work order creation menu (assuming this menu exists) and the work order. The specific process of the information is similar to the process shown in FIG. 6, and the description is not repeated herein.

With the above device, it is possible to provide automatic data analysis, automatic business division, and automatic authority granting. Specifically, the device can automatically acquire and analyze the working condition of the call center employee, obtain an analysis of the overall environment and device status of the call center, and use the basis to solve the shortcomings of the existing call center platform manually configuring the permissions in different systems, thereby avoiding the need Manually set up the cumbersome operation of skills, and integrate employee attendance, assessment, statistics and other data to improve call center security and combat information leakage, misappropriation, camouflage and other activities. The device is also capable of integrating various different rights configuration and rights management entries distributed in a distributed manner to implement unified security authentication and secure access permission functions. In addition, the device can also change according to the attributes of the subject and the object, according to authorization, conditions, and duties. Classification, dynamic control of employee resource access operations; The device also provides a convenient way to statistically analyze employee performance and obtain employee performance indicators. In summary, with the above technical solution of the present invention, by adjusting the operator's resource use permission according to the operator's operation history, the operator's authority can be dynamically configured according to the operator's work habits and work performance, so that the resources are made. The configuration of the license is more flexible and reasonable; and, by adjusting the resource license with reference to the capability and maturity of the operator, the configuration of the resource license can be made more objectively based on the ability of the operator.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalents, improvements, etc., which are included in the spirit and scope of the present invention, should be included in the present invention. Within the scope of protection.

Claims

Claim

A management method for an operator resource use license, the method comprising: the system platform authenticating the operator according to an authentication request initiated by an operator; and in the case that the operator passes the authentication, The system platform adjusts the operator's current resource usage permissions based on a history of operations performed by the operator on the system platform.

The management method according to claim 1, wherein the system platform authenticates the operator according to an authentication request initiated by an operator, including:

Determining, by the system platform, the identity information of the operator according to the authentication request and searching for the history record;

The system platform compares the operation parameter carried in the authentication request with the historical record, and determines whether the operation parameter meets a preset authentication pre-passing condition;

If the result of the determination is yes, the system platform allows the operator to directly pass the authentication; if the result of the determination is no, the system platform authenticates the operator according to the authentication request.

The management method according to claim 2, wherein the operation parameter comprises at least one of: a transmission time of the authentication request, a transmission location of the authentication request, and a service type in which the operation is requested.

4. The management method according to claim 1, wherein before the system platform adjusts an operator's current resource usage permission according to a history of operations performed by the operator on the system platform, The method further includes:

Determining, by the system platform, the resource usage permission adjustment parameter of the operator according to the historical record, wherein the resource use permission adjustment parameter is used to indicate that the operator performs an operation on the system platform;

The adjusting the current resource usage permission of the operator includes: Determining, according to a preset relationship of a plurality of different levels of resource usage licenses and a plurality of resource usage permission adjustment parameter ranges, a resource usage permission corresponding to the resource usage permission adjustment parameter of the operator, if the determined resource usage is determined The license is different from the operator's current resource usage license, and the operator's resource usage license is adjusted to the determined resource usage license.

The management method according to claim 4, wherein the system platform determines, according to the historical record, the resource usage permission adjustment parameter of the operator, including:

Determining, by the system platform, the maturity of the operations performed by the operator corresponding to each type of service according to the history record, and determining, according to the history record, the operations performed by the operator corresponding to each type of service Capability, where, for each type of service, maturity is used to indicate the degree of stability of all operations performed by the operator corresponding to the type of service, and the capability is used to indicate that the operator corresponds to the The efficiency of all operations of the type service; the system platform determines the operation status of the operator corresponding to the service type according to the maturity and capability of the operation performed by the operator corresponding to each service type, And obtain resource usage permission adjustment parameters indicating all operation conditions performed by the operator.

The management method according to claim 1, wherein after the operator adjusts the current resource usage permission of the operator, if the operator requests to use the specified resource, the method further includes:

Determining whether the operator can use the specified resource according to the adjusted resource usage permission; if the determination result is yes, allowing the operator to use the specified resource; if the determination result is no, the operator is prohibited Use the specified resource.

The management method according to any one of claims 1 to 6, wherein the history record comprises one or a combination of the following:

a start time of each effective operation performed by the operator, an effective duration of the operator performing each operation, a service type corresponding to each operation performed by the operator, the operation The number of valid operations performed by the member corresponding to each type of service, the user's evaluation of the operation of the operator, the quality inspection evaluation of the operation of the operator by the system, and the response of the operator to the user's request. on-time rate.

The management method according to any one of claims 1 to 6, wherein the system platform comprises a call center.

A management device for operating an operator resource license, the device comprising: a data conversion module, configured to acquire, from a system platform, a history record of operations performed by an operator on the system platform;

An authentication module, configured to authenticate the operator according to an authentication request initiated by an operator; and an access control module, configured to: according to the history record obtained by the data conversion module, when the authentication module confirms that the operator passes the authentication The operator's current resource usage license is adjusted.

The management device according to claim 9, wherein the authentication module is further configured to:

Determining the identity information of the operator according to the authentication request, and searching for the history record, comparing the operation parameter carried in the authentication request with the history record, and determining whether the operation parameter meets a preset authentication The pre-pass condition; if the judgment result is yes, the authentication module allows the operator to directly pass the authentication; if the judgment result is no, the authentication module authenticates the operator according to the authentication request.

The management device according to claim 9, wherein the access control module is further configured to:

Determining, by the history of the data conversion module, the resource usage permission adjustment parameter of the operator, wherein the resource usage permission adjustment parameter is used to indicate that the operator operates on the system platform;

And, the access control module is further configured to: according to a plurality of different levels of resources set in advance Determining a resource usage permission corresponding to the resource usage permission adjustment parameter of the operator, and determining the resource usage permission and the current resource of the operator, by using a correspondence between the source usage license and the plurality of resource usage permission adjustment parameter ranges The license usage of the operator is adjusted to the determined resource usage license.