Method and system for assigning computer software user rights

Abstract

The invention belongs to the technical field of computer software security, and discloses a computer software authority distribution method and system, which constructs a tree-like interface element model for the interface elements of the software according to the dependency relationship between each interface element, and assigns the dependent The API interface is bound to the nodes of the model; when authorizing a role, associate several nodes in the interface element model that are not the root node of the tree with the role; derive indirect permission nodes and associate them according to the direct permission nodes associated with the role to the role; the union of all direct permission nodes and indirect permission nodes associated with the role is used as the interface element permission of the role; API interface permissions are generated according to all direct permission nodes and indirect permission nodes associated with the role; when receiving the user's use The request of the software, according to the interface element permissions of the user role, only displays the interface elements that the user has the right to see; when making a request to the server, the server performs authentication according to the API interface permissions of the user role.

Description

technical field [0001] The invention belongs to the technical field of computer software security, and discloses a computer software user authority distribution method and system. Background technique [0002] Computer software, especially management software, usually requires different permissions assigned to different user roles. Permissions generally include two types: one is the visibility permissions of interface elements, for example, for different roles, you can see different operation buttons on the interface; the other is API interface access permissions, for example, different roles have the right to call The HTTP / HTTPS interface is different; the API interface here refers to the data request initiated by the client to the server. In the Web system, it refers to the HTTP(S) request initiated from the browser to the Web server; The request initiated by the background; in the mobile terminal, it refers to the request initiated from the mobile APP to the server backg...

AI Technical Summary

Problems solved by technology

[0004] 1. By configuring the corresponding relationship between roles and interface elements, assign and control permissions for interface elements; the defect of this method is that it only protects software resources from unauthorized users at the interface layer, but cannot prevent users from bypassing the page. Obtain data by directly sending server requests (for example, using tools such as postman), which has weak security

[0005] 2. Permission allocation and control for the API interface. When the user does not have the authority to operate the interface of a certain API interface, a response to insufficient authority is given; although this method meets security, it exposes the interface elements that the user does not have the right to use. Not friendly enough for users

The disadvantage of this method is that it needs to be authorized twice independently, which greatly increases the workload of the software administrator to assign permissions to the role, the ease of use is poor, and the software implementation complexity is high

Images