KR102477292B1 - System for classifying and recommending authority based on artificial intelligence for access authority analysis - Google Patents

Abstract

An artificial intelligence-based authority classification and recommendation system for access authority analysis is disclosed. An authority analysis system according to an embodiment includes a data collection unit for collecting resource data of a user using an application for analyzing resource use details; a role classification unit classifying role information based on a similarity between the user and a resource usage relationship between the user and the user through an artificial intelligence engine for processing authority analysis of the collected resource data of the user; a storage unit configured to store, in an analysis storage, final role information in which a user's authority for the classified role information is adjusted according to the manager's review as the classified role information is provided to a manager; and a migration unit for migrating final role information stored in the analysis storage to an authority storage of a system providing services according to authority.

Description

Artificial intelligence-based authority classification and recommendation system for access authority analysis {SYSTEM FOR CLASSIFYING AND RECOMMENDING AUTHORITY BASED ON ARTIFICIAL INTELLIGENCE FOR ACCESS AUTHORITY ANALYSIS}

The description below relates to techniques for performing access rights analysis.

In the process of collecting rights, the classification of rights in the existing access rights system is inconvenient because the process of directly investigating and collecting rights by administrators and users is repeated. Since the process of investigating access rights is complicated and requests from practitioners are diverse, it is difficult for administrators to verify this and to confirm that it is accurate information.

For example, Korean Patent Registration No. 10-0832093 (May 27, 2008) discloses a technique for provisioning resource accounts and resource rights according to rights by managing resources with rights in integrated account management technology.

In this way, since analyzing and classifying user's access rights in a solution or service using access rights requires a lot of time and effort, an automation technology for analyzing resource rights is required.

An artificial intelligence-based authority classification/recommendation system and method for access authority analysis can be provided.

It is possible to provide a system and method that analyzes access rights in advance to generate final access rights as reliable data, rather than being implemented in the service to which access rights are finally applied.

Authority analysis system, data collection unit for collecting the resource data of the user using the application for analyzing the resource use history; a role classification unit classifying role information based on a similarity between the user and a resource usage relationship between the user and the user through an artificial intelligence engine for processing authority analysis of the collected resource data of the user; a storage unit configured to store, in an analysis storage, final role information in which a user's authority for the classified role information is adjusted according to the manager's review as the classified role information is provided to a manager; and a migration unit for migrating final role information stored in the analysis storage to an authority storage of a system providing services according to authority.

The role classification unit extracts mapping data according to the resource usage relationship between the user and the user, classifies role information according to similarity using a machine learning-based clustering algorithm through the extracted mapping data, and Role information may be calculated as a recommended role.

The role classification unit may classify into a gray list users whose authority value similarity for each user in each cluster classified according to the cluster similarity is equal to or less than a set criterion.

The role classification unit provides a permission assignment type including a direct permission assignment method, a compulsory permission assignment method, or a role permission assignment method as the role information is analyzed through an artificial intelligence engine, the direct permission assignment method comprising: Role information related to authority assignment is a method in which rights are randomly assigned without being classified based on user attributes. In the case of complexity, authority is allocated, and the role authority allocation method may be a method in which authority is allocated when role information related to authority allocation has a complexity greater than or equal to the preset standard based on user attributes. .

The migration unit provides the manager with a user interface for determining the authority for the classified role information, and provides the classified role information to the manager through a user interface for determining the authority for the classified role. Receiving that response information including approval or rejection of the user's right to information is determined, and based on the received response information, the user's right to the classified role information is approved or denied, thereby changing the classified role information. The final role information with the user's privileges adjusted can be stored in the analysis repository.

The migration unit may synchronize the final role information stored in the analysis storage based on the architecture of the authority storage through a migration engine.

The data collection unit provides the user with a user interface for collecting authority data, and inserts an intelligent script into an application running on the user's device to add or configure authority through selection by the user through the provided user interface. Resource data related to the deletion request may be collected.

It can provide help in building an authority system by solving the difficulties of repetitive tasks in setting access rights for administrators and suggesting and recommending an initial authority system.

Based on the actual resources used, the usage rate and usage frequency are analyzed, and the similarity of the usage groups is analyzed through an artificial intelligence-based analysis processing engine to easily build an authority system.

By using pre-established authority information to create an access authority system, the authority system can be easily managed after the access authority is completed.

1 is a diagram for explaining a general operation of a dictionary permission analysis system according to an embodiment.
2 is an example for explaining an operation of collecting resource data in a pre-authorization analysis system according to an embodiment.
3 is an example for explaining an operation of calculating a recommended role in a dictionary authority analysis system according to an embodiment.
4 is a graph showing a result of performing clustering in a prior authority analysis system according to an embodiment.
5 is an example of a result of measuring cluster relevance in a prior authority analysis system according to an embodiment.
6 is a diagram for explaining an operation of setting access rights in a prior permission analysis system according to an embodiment.
7 is an example for explaining an operation of migrating in a pre-authorization analysis system according to an embodiment.
8 is a block diagram for explaining the configuration of a dictionary permission analysis system according to an embodiment.
9 is a flowchart illustrating a method of performing an artificial intelligence-based authority classification and recommendation for access authority analysis in a prior authority analysis system according to an embodiment.

Hereinafter, an embodiment will be described in detail with reference to the accompanying drawings.

In the embodiment, a technique for classifying and recommending authority based on artificial intelligence for analyzing access authority will be described. Analyzing and classifying user access rights in solutions or services that use access rights is a task that requires a lot of time and effort. The pre-authorization analysis system simplifies the process of repeating user and artificial intelligence verification of grouping, role, or classification used in access authority, and can derive reliable results. Users who are granted access rights and requests from middle managers who approve access rights of users and administrators who approve or approve them also analyze overall access rights in an environment where users can become users, and finally analyze the classification system in relation to the analyzed access rights. can provide

1 is a diagram for explaining a general operation of a dictionary permission analysis system according to an embodiment.

Authority classification and recommendation services may be provided through data transmission and reception between the user 110, the administrator 120, and the dictionary authority analysis system 100. The dictionary authority analysis system 100 may be implemented by a server that provides authority classification and recommendation services.

The pre-authorization analysis system 100 is a system that applies the final access authority in advance to generate reliable data, rather than implementing it in the finally applied service. The dictionary authority analysis system 100 can be easily constructed by analyzing access authority (eg, role, group, or specific taxonomy) through artificial intelligence. The pre-authorization analysis system 100 is a system built in advance to easily create a final access authority system, and can manage the authority system after access authority is completed.

The dictionary permission analysis system 100 may provide a user interface for permission analysis through the permission analysis application 101 . At this time, the authority analysis application 101 may be operated in the device of the user 110 and the manager 120. The authority analysis application 101 may collect resource data (authority data for resources) through an intelligent script. As the intelligent script is inserted into the authority analysis application 101, data for authority analysis may be collected. Through the permission analysis application 101, the user 110 is provided with the menu configuration to be actually implemented to explicitly collect the permission, and the resource data configured according to the user 110's selection is sent to an artificial intelligence-based permission processing engine (hereinafter , which will be described as an artificial intelligence engine).

The AI engine can analyze permissions and recommend roles. The artificial intelligence engine can classify and recommend direct or indirect assignment of rights or role information based on the collected rights information. The artificial intelligence engine can classify authority for each user using data collected from users, and can apply or recommend appropriate authority and role to the user based on the classified data.

The analysis storage 102 configured in the dictionary permission analysis system 100 may store collected resource use information, classification, and recommended permission information. At this time, a database may be used for the analysis repository 102 . The analysis storage 102 provides a storage for storing and analyzing data collected for each analysis order, and may store a final authority analysis result and a role list. Analysis store 102 may provide migrations to apply final rights data to rights store 103 . At this time, it may be migrated from the analysis storage 102 to the permission storage 103 using the access permission through the migration engine. In this way, it can be applied to all systems requiring authority analysis (eg, ERP, personnel systems, etc.).

The pre-authorization analysis system according to an embodiment can automate the authority analysis and application, which was manually performed by an administrator (person in charge). Implicit permission data using log data and explicit permission data using user interface can be applied to the artificial intelligence engine to recommend actual applicable user rights to the administrator.

The preliminary authority analysis system according to an embodiment can reduce the time required for authority analysis in the actual construction stage by automating authority analysis. In addition, the pre-authorization analysis system can identify and block inconsistency and uncertainty of authority information in advance during actual operation conversion by explicitly collecting authority information through the user interface for authority collection. In addition, the pre-authorization analysis system can execute the authority system establishment process by standardizing the authority analysis system.

2 is an example for explaining an operation of collecting resource data in a pre-authorization analysis system according to an embodiment.

The pre-authorization analysis system can collect resource data for authorization analysis through intelligent scripts. It is possible to systematically collect resource data for permission analysis by inserting an intelligent script into an operating permission analysis application. The pre-authorization analysis system may extract user and resource mapping data when collecting information for a user to use a resource (menu). Mapping relationships between users and resources can be displayed according to distribution. Here, a resource may mean a menu or a specific function. Depending on the authority of each user, the authority to access a resource including a menu or a specific function (eg, print, file download, etc.) may be different.

3 is an example for explaining an operation of calculating a recommended role in a dictionary authority analysis system according to an embodiment.

The pre-authorization analysis system may classify role information based on the similarity (similar authority) of the resource usage relationship between the user and the user through an artificial intelligence engine for processing authority analysis of the collected resource data of the user. As the pre-authorization analysis system displays the distribution of mapping relationships between users and resources, it can recommend first role data that can organize roles according to cluster similarity using a machine learning clustering algorithm through data. The pre-authorization analysis system divides a plurality of recommended roles according to similarity and delivers them to the manager. A process of separation and integration of data transmitted to the manager may be performed. The pre-authorization analysis system can be classified into one group according to the user's resource usage mapping relationship. Groups with similar authority may be clustered according to mapping similarity and calculated as a primary recommendation role.

4 is a graph showing a result of performing clustering in a prior authority analysis system according to an embodiment.

The pre-authorization analysis system can perform a machine learning clustering algorithm to classify recommended roles according to similarity. For example, as a machine learning development environment, python can be used in anaconda3 + jupyter notebook environment. In addition, it can be applied to various development environments. Clustering according to authority values can be tested while sequentially increasing resource list samples for each user. At this time, clustering may be performed using the KMeans algorithm, the Agglomerative Clustering algorithm, and the like. In using the clustering algorithm, the pre-authorization analysis system can perform additional processes such as data sampling to be used for analysis and data transformation for data mining (removing redundancy, normalization, dimensionality reduction, etc.).

Referring to the graph of FIG. 4, the elbow chart shows the number of suitable clusters for the target sample (eg, user: 3000, authority value: 1000), and the number of clusters is '68 ', you can tell it's the elbow part. This indicates that optimal results can be obtained when the target sample is classified into 69 clusters.

Referring to FIG. 5 , an example of a result of measuring group appropriateness is shown. The sihouette technique is a method that quantitatively calculates the quality of a cluster. If the number of clusters is appropriate, it is close to 1, and closer to 0 means that the number of clusters is not appropriate. As shown in FIG. 4 , for example, when a target sample is classified into 69 clusters, a graph close to 1 appears, so it can be said that the appropriate number of clusters has been found.

6 is a diagram for explaining an operation of setting access rights in a prior permission analysis system according to an embodiment.

The prior authority analysis system 100 may help to easily apply the authority of systems for which access authority is set in advance. The dictionary permission analysis system 100 may include WEB/WAS, permission analysis application 101, analysis storage 102 and permission storage 103. A permission request/approval engine, a permission analysis processing engine, a permission request read/adjustment engine, and a migration engine may be configured in the permission analysis application 101 of the dictionary permission analysis system 100.

The pre-authorization analysis system 100 includes a user interface through which a user can select an authority through an authority analysis application, a user interface in which an intermediate manager can approve and modify authority, a user interface in which an intermediate manager can manage authority information, and a final A user interface through which an administrator can analyze authority information and adjust analysis contents may be provided. In addition, the pre-authorization analysis system 100 includes a user interface through which administrators can manage permission approval/denial, an engine through which data can be managed upon permission approval/denial, an interface through which administrators can manage resources, and permission relationships. It can provide an interface that can be managed, an artificial intelligence-based management interface to be used by administrators, and an interface that can manage mapping with data from actual data storage as an authority analysis repository.

The dictionary permission analysis system 100 may provide a user interface through the devices of the user 110 and the administrator 120 . Usage status may be collected in the device of the user 110 through an automatic information collector. In addition, usage status information collected through a user information collection user interface provided in the device of the user 110 may be provided. The data analyzed in the pre-authorization analysis system 100 is refined and configured as a personalized menu, and the finally configured information is provided so that the authority value can be entered so that it can be refined again as new authority data through the user information collection user interface. can

Specifically, the pre-entitlement analysis system may collect resource data through an automatic information collector capable of analyzing resource usage history. Through the collected resource data, the administrator can identify the resources used by each user, and can classify users with high similarity according to the user's attribute information. The classified user group can be classified as role information, and it can provide help in deciding whether to apply the authority assignment method according to the approach method. Alternatively, the pre-authorization analysis system may collect resource data input from users, classify resources for each user, and define roles according to the similarity of authority values. The pre-authorization analysis system may provide information on the authority allocation method as an analysis result. The administrator can check the roles defined by the selected role authority assignment method as summary information, and can check whether it can be used as actual role information.

The pre-authorization analysis system 100 may refine and store data collected from users as reference data in an analysis storage. The stored data may include user ID, resource information, etc., and the artificial intelligence engine may analyze such information based on artificial intelligence to change and save meaningful authority information. The main table of the analytics store can be represented as:

Users table: A table that stores user IDs, names, organizations, etc.

Organization table: This is the user's organization table, which is necessary to analyze the user's organization information and the relationship between organization and resource usage.

Resource table: A table that stores system resources using access rights

Role table: A table that stores roles classified through similarity analysis

Role-resource table: A table that stores the roles classified through similarity analysis and the resources mapped to the roles. The role-resource mapping relationship is divided into degrees, and role-resource information that is integrated or subdivided by degree of similarity is stored.

User-resource table: A table mapped to resources used by users (such as menu buttons). As resources are mapped for each user, similar mapping information provides information on how to apply permissions after classification through similarity analysis in the artificial intelligence engine.

User-resource-result table: Based on the information entered in the user-resource table, this is a table that stores the results of classification by the AI engine, and resource authority is finally provided to the user based on this table.

Organization-resource table: Stores information necessary to map the user's resource usage history to the user's organization and read the correlation between the organization and the resource

Preference table: This is a preference table that can adjust the score that can adjust the probability of similarity and input values to be input to the artificial intelligence engine. Based on the user’s similarity set value, clusters are classified through similarity analysis of resource use by user. recommended as separate role information

Greylist table: A table in which users with no similarity are clustered separately so that the administrator can directly analyze the content and determine whether to separate/merge the user's role.

Request/Approval Table: A table containing information for requesting and granting privileges. Permission Users apply for permission for resources and are granted permission through approval, and the approved content is saved through signature.

The pre-authorization analysis system 100 may check the analyzed result as permission collection is completed and provide a request for modification. Access rights may be requested by the user. The administrator can verify the access right requested by the user through the review screen, and can derive the final access right by repeating the process of approval/rejection/modification. An administrator may approve the requested access right through secondary authentication (eg, digital signature) and store the approved information. Alternatively, a resource required by the user may be requested from the user. The administrator can derive the access right by confirming the authority of the resource requested by the user and repeating the process of approval/rejection/modification.

When resources available for each user are defined, the pre-authorization analysis system 100 may perform a cluster classification task according to the similarity between the user and the resource use relationship through a clustering algorithm. The pre-authorization analysis system 100 can be classified simply or in detail according to the similarity set value according to the manager's data review, and as a result of the classification operation, the authority management type (direct authority assignment, compulsory authority assignment, role authority assignment) Analytical data can be provided for decision-making.

Direct authority assignment refers to a management type that can be applied when authority allocation is not classified based on user characteristics/attributes, and authority must be assigned randomly.

Compulsory permission assignment refers to a management type that can be applied to a predetermined number or less (for example, around 10) when the content of permission assignment is not complex and simple to classify according to user characteristics/attributes.

Role authority assignment refers to a management type that can be applied when the contents of authority assignment are relatively complicated to be classified according to user characteristics/attributes. The degree of relative complexity corresponds to most cases that follow the characteristics of the organization, and is a suitable model when the number of roles is more than a predetermined number (eg, at least 10 or more).

The manager determines the authority management type through analysis data, and in the case of role authority assignment, the role can be set and saved based on the classification result presented in the recommended classification task.

The pre-authorization analysis system 100 stores the authority classifications of unclassified missing users as a authority greylist, and organizes the greylist by arranging them as separate classifications by an administrator's reading or by including them as existing classified authorities. For example, the pre-authorization analysis system secondarily classifies the authority value of each user in each cluster that is firstly classified through similarity classification, and classifies users whose similarity is lower than a specific value into the gray list. Users classified as graylist are displayed in the similarity item within the cluster through the manager's device, and the manager can determine whether to include the user in the cluster.

Authorization data finally organized can be migrated to the authorization storage of the actual system. The pre-authorization analysis system can determine the authority type based on the result recommended by the artificial intelligence engine and reflect the final authority result value.

The pre-authorization analysis system according to an embodiment may analyze the usage rate and frequency of use based on actually used resources, and analyze the similarity of usage groups through an artificial intelligence engine to build an optimal authority system.

7 is an example for explaining an operation of migrating in a pre-authorization analysis system according to an embodiment.

The final rights values stored in the analytics store can be synchronized via the migration engine based on the architecture of the rights store. At this time, the administrator may be provided with a user interface capable of comparing values and adding or deleting necessary information.

Permission storage can be various systems that require access rights, and can have a separate permission system to suit the characteristics of each system. The information stored in the analysis storage stores the authority information as subdivided as possible and can be synchronized to fit the architecture of the authority storage information (DB table and field structure, etc.).

8 is a block diagram for explaining the configuration of a pre-authorization analysis system according to an embodiment, and FIG. 9 is an artificial intelligence-based authority classification and recommendation for access authority analysis in the pre-authorization analysis system according to an embodiment. It is a flow chart to explain how to do it.

The processor of the pre-authorization analysis system 100 may include a data collection unit 810, a role classification unit 820, a storage unit 830, and a migration unit 840. These components of the processor may be representations of different functions performed by the processor according to control instructions provided by program code stored in the pre-rights analysis system. The processor and components of the processor may control the dictionary permission analysis system to perform steps 910 to 940 included in the artificial intelligence-based method for performing permission classification and recommendation for access permission analysis of FIG. 9 . In this case, the processor and components of the processor may be implemented to execute instructions according to the code of an operating system included in the memory and the code of at least one program.

The processor may load into memory a program code stored in a file of a program for an artificial intelligence-based authority classification and recommendation method for access authority analysis. For example, when a program is executed in the pre-authorization analysis system, the processor may control the pre-authorization analysis system to load a program code from a file of the program into a memory under the control of an operating system. At this time, each of the processor and the collection unit 810, the role classification unit 820, the storage unit 830, and the migration unit 840 included in the processor executes a command of a corresponding part among the program codes loaded into the memory, and then There may be different functional representations of a processor for executing steps 910-940.

In step 910, the data collection unit 810 may collect resource data of the user using an application that analyzes resource use history. The data collection unit 810 provides the user with a user interface for collecting authorization data, inserts an intelligent script into an application running on the user's device, and adds the configured authorization or authorization through the user's selection through the provided user interface. Resource data related to the deletion request may be collected.

In step 920, the role classification unit 820 may classify the role information based on the similarity between the user and the user's resource use relationship through an artificial intelligence engine for processing authority analysis of the collected resource data of the user. The role classification unit 820 extracts mapping data according to the user and the user's resource use relationship, classifies role information according to similarity using a machine learning-based clustering algorithm through the extracted mapping data, and classifies the role information. can be calculated as a recommended role. The role classification unit 820 may classify into the gray list users whose similarity in authority values for each user in each cluster classified according to the cluster similarity is equal to or less than a set criterion. The role classification unit 820 may provide a permission assignment type including a direct permission assignment method, a compulsory permission assignment method, or a role permission assignment method as the role information is analyzed through an artificial intelligence engine.

As the storage unit 830 provides the classified role information to the manager in step 930, the final role information in which the authority of the user for the classified role information is adjusted according to the manager's review may be stored in the analysis storage.

In step 940, the migration unit 840 may migrate the final role information stored in the analysis storage to the authority storage of a system providing services according to authority. The migration unit 840 provides a user interface for determining the authority of the classified role information to the manager, and provides the classified role information to the manager, thereby providing the administrator with the user interface for identifying the authority of the classified role information. Receiving that response information including approval or rejection of the user's authority is determined, and based on the received response information, the user's authority for the classified role information is approved or denied, and the user's authority for the classified role information is adjusted. The final role information can be stored in the analytics repository. The migration unit 840 may synchronize final role information stored in the analysis storage based on the architecture of the authority storage through a migration engine.

The authority analysis system according to an embodiment may automate the authority analysis and application, which was manually performed by a person in charge. Implicit permission data using log data and explicit permission data using user interface can be applied to the artificial intelligence engine to recommend actual applicable user rights to the administrator.

The authority analysis system according to an embodiment stores the final authority analysis result and role list in an analysis storage for storing and analyzing data collected by analysis order, and provides migration to apply the final authority data to the actual operation storage. can

The authority analysis system according to an embodiment can significantly reduce the time and cost required for authority analysis in the actual construction stage by automating authority analysis.

The authority analysis system according to an embodiment can identify and block inconsistency and uncertainty of authority information in advance during actual operation conversion by explicitly collecting authority information through a user interface for authority collection.

An authority analysis system according to an embodiment can efficiently execute an authority system construction process by standardizing an authority analysis system into a system.

The devices described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. A processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. The device can be commanded. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. can be embodied in Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims (7)

In the authority analysis system,
A data collection unit for collecting resource data of a user using an application that analyzes resource use history;
a role classification unit classifying role information based on a similarity between the user and a resource usage relationship between the user and the user through an artificial intelligence engine for processing authority analysis of the collected resource data of the user;
a storage unit configured to store, in an analysis storage, final role information in which a user's authority for the classified role information is adjusted according to the manager's review as the classified role information is provided to a manager; and
A migration unit for migrating the final role information stored in the analysis storage to the authority storage of a system providing services according to authority.
including,
The role classification unit,
Direct authority assignment method, compulsory authority assignment method, or role by classifying users whose authority values are below the set criterion in each cluster classified according to the similarity into the gray list and analyzing role information through an artificial intelligence engine Including providing a permission assignment type including a permission assignment method,
The migration unit,
A user interface for determining the authority of the classified role information is provided to the manager, and the user interface for determining the authority as the classified role information is provided to the manager, the user of the classified role information Upon receiving that response information including approval or rejection of authority is determined, and based on the received response information, the user's authority for the classified role information is approved or denied, and the user's authority for the classified role information is received. Storing this adjusted final role information in an analysis store, and synchronizing the final role information stored in the analysis store based on the architecture of the authority store through a migration engine.
Authorization analysis system. According to claim 1,
The role classification unit,
Extract mapping data according to the resource usage relationship between the user and the user, classify role information according to similarity using a machine learning-based clustering algorithm through the extracted mapping data, and classify the classified role information as a recommended role. calculated with
Authority analysis system, characterized in that. delete According to claim 1,
The direct permission assignment method is a method in which role information related to permission assignment is not classified based on user attributes, and permissions are assigned randomly,
The compulsory permission assignment method is a method in which the permission is assigned when the role information related to the permission assignment has a complexity equal to or less than a predetermined standard based on the attributes of the user,
The role authority assignment method is a method in which authority is allocated when role information related to authority allocation has complexity greater than or equal to the preset standard based on user attributes.
Authority analysis system, characterized in that. delete delete According to claim 1,
The data collection unit,
Provides a user interface for collecting permission data to the user, inserts an intelligent script into an application running on the user's device, and selects a user through the provided user interface to provide a resource related to a permission addition or permission deletion request. to collect data
Authority analysis system comprising a characterized in that.

Images