Access control method and device and computer readable storage medium

Abstract

The invention provides an access control method, device and system and a computer readable storage medium. The method comprises the steps: receiving an access request of a user, the access request comprising user information and a target service resource; determining a resource permission tree of the user according to the user information, and constructing the resource permission tree of each userin advance according to the plurality of service resources, the authorization relationship among the plurality of users and the dependency relationship among the plurality of service resources; a complex permission judgment problem is simplified into a tree structure traversal search problem, so that the permission judgment process is greatly simplified.

Description

technical field [0001] The invention belongs to the field of authority management, and in particular relates to an access control method, device and computer-readable storage medium. Background technique [0002] This section is intended to provide a background or context for implementations of the invention that are recited in the claims. The descriptions herein are not admitted to be prior art by inclusion in this section. [0003] Rights management generally involves function rights management and data rights management. Among them, functional permissions are usually implemented based on the mature RBAC (role-based access control) mechanism; while there are not many generalized technologies for data permission management, the data permission logic is generally integrated into specific business codes. [0004] At present, management systems usually have the characteristics of "weak account and strong business". However, the existing data permission implementation methods...

AI Technical Summary

Problems solved by technology

[0004] At present, management systems usually have the characteristics of "weak account and strong business". However, the existing data permission implementation methods have the following problems: (1) Dynamic authorization leads to complex permission determination, and business resources are usually in various roles or users. Medium dynamic flow; when it is necessary to determine the authority relationship, it is necessary to trace a large number of business scenarios, and the determination logic is complex

(2) Implicit dependencies lead to blurred authority boundaries. In management systems, sometimes there are implicit dependencies on business relationships between business resources, which in turn leads to implicit inheritance on authorization relationships, which leads to the failure of business resources. The authority boundary definition rules are not clear

For example, in the procurement system, the employees of the demand department put forward the procurement requirements, and the employees of the demand department have the authority to access the procurement demand information (a kind of business resource). Employees of the procurement department have the authority to access the information of the procurement project (another business resource). During the procurement process, the employees of the procurement department should be allowed to access the procurement demand information associated with the procurement project. Access rights, there is no direct authorization operation for procurement requirements, which leads to the failure of conventional authority definition rules

It brings great inconvenience to the authority management of the management system

Images