Permission processing method and device, storage medium and program product

Abstract

The embodiment of the invention provides a permission processing method and device, a storage medium and a program product. In the permission processing method, the authorization decision object is associated with the operation permission and is not associated with the resource, so that when the permission of the target object to the first operation type of the first resource is configured, a new authorization decision object does not need to be created according to the first resource and the first operation type; however, the created first authorization decision-making object corresponding to the first operation type can be reused, and the corresponding relation between the first authorization decision-making object and the first resource is dynamically established. Based on the implementation mode, the created authorization decision-making object can be repeatedly used according to the operation type of the requested operation authority, so that the probability that a large number of authorization decision-making objects are newly added due to the fact that the types of resources applicable to the operation authority are increased is reduced; the number of authorization decision-making objects in the authority system can be maintained in a stable range, the definition and maintainability of the authority system are improved, and therefore the management cost of the authority system is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to a permission processing method, device, storage medium and program product. BACKGROUND

[0002] Permission management is an important part of computer security, which involves how to control the access ability of users or system components to specific resources (such as files, databases, network services, etc.). The goal of permission management is to ensure that only properly authorized subjects can perform specified operations to protect the confidentiality, integrity and availability of data. Permission management usually includes authentication (verifying user identity), authorization (determining which resources and operations a user can access), and audit (recording and reviewing access activities) key links. In the field of computers, permission systems are usually used to implement permission management. Permission systems can design permission management policies based on permission models, and perform authentication, authorization and audit, and other permission management steps based on permission models.

[0003] However, the traditional role-based permission model is suitable for single-dimensional condition permission authorization. When the complexity of the permission system increases, the number of roles that need to be defined and maintained will increase dramatically, thereby bringing higher management costs to the permission system. Therefore, a new solution is needed. SUMMARY

[0004] Aspects of the present application provide a permission processing method, device, storage medium and program product to reduce the management cost of the permission system.

[0005] The permission processing method provided by the embodiments of the present application comprises: obtaining a first permission configuration request, the first permission configuration request being used to request allocation of operation permission of a first operation type of a target object to a first resource; determining a first authorization decision object corresponding to the target object from at least one authorization decision object created according to the first operation type, the at least one authorization decision object each being associated with operation permission of a preset operation type; establishing a corresponding relationship between the first authorization decision object and the target object and the first resource, so as to authenticate the target object according to the first authorization decision object when the target user requests to perform the first type of operation on the first resource.

[0006] Optionally, determining the first authorization decision object corresponding to the target object from the at least one authorization decision object created according to the first operation type comprises: determining whether there is a first operation permission corresponding to the first operation type in the operation permission associated with the at least one authorization decision object; if there is, the authorization decision object associated with the first operation permission is taken as the first authorization decision object corresponding to the target object.

[0007] Optionally, the establishing the correspondence between the first authorization decision object and the target object and the first resource comprises: establishing an authorization relationship between the first authorization decision object and the target object; and adding the first resource into an effective resource range of the authorization relationship, so that the authorization relationship is effective to the first resource.

[0008] Optionally, the method further comprises: obtaining a second permission configuration request, the second permission configuration request being used to request to assign the target object with an operation permission of a second operation type on a second resource; and adding the second resource into the effective resource range of the authorization relationship, so that the authorization relationship is effective to the second resource.

[0009] Optionally, the method further comprises: in response to an added operation of an operation type, obtaining an added second operation type, the second operation type being different from the operation type of the operation permission associated with the at least one authorization decision object; creating a second operation permission corresponding to the second operation type and a second authorization decision object; and establishing a correspondence between the second operation permission and the second authorization decision object.

[0010] Optionally, the first authorization decision object comprises a first role; and the establishing the authorization relationship between the first authorization decision object and the target object comprises: assigning the first role to the target object.

[0011] Optionally, the first authorization decision object comprises a first permission policy; and the establishing the authorization relationship between the first authorization decision object and the target object comprises: adding the target object into an effective subject range of the first permission policy.

[0012] Embodiments of the present application further provide a server, comprising: a memory and a processor; the memory is used to store one or more computer instructions; and the processor is used to execute the one or more computer instructions to perform the steps in the method provided by the embodiments of the present application.

[0013] Embodiments of the present application further provide a computer readable storage medium storing a computer program, the computer program being executed by a processor to implement the steps in the method provided by the embodiments of the present application.

[0014] Embodiments of the present application further provide a computer program product, comprising: a computer program / instruction, the computer program / instruction being executed by a processor to implement the steps in the method provided by the embodiments of the present application.

[0015] In the permission processing method provided by the embodiments of the present application, the authorization decision object is associated with the operation permission and is not associated with the resource, and then when the permission of the first operation type of the target object to the first resource is configured, a new authorization decision object does not need to be created according to the first resource and the first operation type, but the first authorization decision object corresponding to the first operation type that has been created can be reused, and the corresponding relationship between the first authorization decision object and the first resource is dynamically established. Based on this implementation, the created authorization decision object can be reused according to the operation type of the requested operation permission, which reduces the probability of adding a large number of authorization decision objects due to the increase in the types of resources to which the operation permission is applicable, and is beneficial to maintaining the number of authorization decision objects in the permission system within a stable range, improving the clarity and maintainability of the permission system, and thus reducing the management cost of the permission system. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and its description, which serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0017] Figure 1 A flowchart of a permission processing method provided by an illustrative embodiment of the present application is shown in the figure;

[0018] Figure 2 A role-based permission model provided by an illustrative embodiment of the present application is shown in the figure;

[0019] Figure 3 A permission model based on a permission policy provided by an illustrative embodiment of the present application is shown in the figure;

[0020] Figure 4 A structure diagram of a server provided by an illustrative embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme of the present application will be described clearly and completely below in combination with the embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0022] The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the description of the application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0023] It should be understood that the term "and / or" as used herein is merely descriptive and not intended to limit the scope of the application. In addition, the character " / " generally represents an "or" relationship between the front and rear associated objects.

[0024] It should also be noted that the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a product or system including a list of elements does not only include those elements, but also includes other elements not expressly listed, or further includes elements inherent in such product or system. Without more limitations, the element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the product or system comprising the element.

[0025] In order to facilitate the understanding of the technical solutions provided in the present application, the following will explain some concepts related to the embodiments of the present application.

[0026] The permission system is a key component for ensuring system security, which is used to implement a series of rules and access control policies in the process of subject accessing object to determine whether to allow the access behavior. Among them, the subject (Principal) refers to the entity initiating the access request, which can be a user, a process, a service or other system components. Among them, the object refers to the object being accessed or operated, i.e. the resource to be protected. The basic elements of the permission system usually include: user, role, permission, operation, resource, permission model, etc.

[0027] Among them, the user is the actual operator or account in the permission system, and the user needs to access different resources or perform specific operations. The role is a set of related permissions, which is used to represent the typical responsibilities or functional requirements of a class of users. For example, the permission system can include administrator, editor, reader, etc. Among them, the permission is a specific access permission to the resource or operation, such as the permission to read the file, the permission to modify the record, the permission to delete the article, etc. Among them, the operation refers to the specific user behavior, such as creating, deleting, granting permission, revoking permission, etc. Among them, the resource is the object of operation, for example, the resource can be a file, data, code, application, etc., or a specific cloud resource, such as a cloud desktop or a virtual resource group.

[0028] Among them, the permission model is a program framework or architecture that implements the permission system, and common permission models can include: an RBAC (Role-Based Access Control) model, an ABAC (Attribute-Based Access Control) model, an ACL (Access Control List) model, a PBAC (Policy-Based Access Control) model, and the like.

[0029] In the RBAC model, a user obtains corresponding permissions by being assigned to different roles. There are multiple basic types in the RBAC model, such as RBAC0 (basic model), RBAC1 (role hierarchical model) in which there can be a hierarchical structure and inheritance relationship between roles, and RBAC2 (constrained role model) in which features such as separation of duties and session management are added.

[0030] In the ABAC model, permissions can be granted to a subject based on a combination of multiple attributes of objects, subjects (such as users), environments, and operations. For example, a user can only access a specific resource at a specific time, place, or using a specific device.

[0031] In the ACL model, each resource is configured with a corresponding access control list, and the access control list of any resource is used to describe users or user groups that can access the resource and the types of access operations that the users or user groups can perform. For example, in the access control list of a certain resource, it can be described that user U1 can perform a read operation on the resource, and user U2 can perform a write operation on the resource.

[0032] In the PBAC model, permissions are usually granted according to a series of complex permission policy rules that comprehensively consider multiple conditions and attributes, such as but not limited to time, place, resource attribute, user attribute, environmental condition, and multiple context factors. Based on the permission policy, it can be defined under what conditions a specific subject can perform what operation on what resource. For example, a permission policy in the PBAC model can be: members of the finance department can access financial reports during office hours on weekdays.

[0033] In the above various permission models, the RBAC model and the ABAC model are suitable for permission authorization based on a single-dimensional condition, and the definition of the permission includes operation permission and resource permission. For example, taking an order resource as an example, when configuring whether a user has the permission to delete an order, the following permission model can be created: user-delete order permission, or user-role A-delete order permission, which includes the resource permission corresponding to the order and the operation permission corresponding to the delete operation. When it is necessary to configure whether a user has the permission to delete a specific type of order, the permission model changes to: user-role A-permission to delete M1 type of order, user-role B-permission to delete M2 type of order. When it is necessary to configure whether a user has the permission to modify a specific type of order, the permission model changes to: user-role C-permission to modify M1 type of order, user-role D-permission to modify M2 type of order. That is, when there are multiple different types of orders and different types of operations, the number of roles that need to be created is the product of the number of order types (i.e., resource types) and the number of operation types. For example, when there are resources B1, resources B2, operation C1, and operation C2, the following permission model can be created: user U1-role A1-resource B1-operation C1 permission, user U1-role A2-resource B1-operation C2 permission, user U1-role A3-resource B2-operation C1 permission, and user U1-role A4-resource B2-operation C2 permission. When the number of operation types and the number of resource types increases, the number of roles that need to be created in the permission model also increases sharply, thereby causing a "role explosion" phenomenon. The role explosion not only leads to an increase in management complexity, but also reduces the clarity and maintainability of the permission system.

[0034] In the ACL model and the PBAC model and other permission policy-based models, the definition of the permission also includes operation permission and resource permission. For example, when configuring whether a user has the permission to delete an order, the following permission model can be created: user-permission policy-delete order permission, or user-role-permission policy-delete order permission. For example, the permission policy can include: allowing deleting orders using office equipment from 9:00 to 12:00 on weekdays. In such models, when the number of operation types and the number of resource types increases, the number of permission policies that need to be defined will also increase, thereby causing a "permission policy explosion" phenomenon. The permission policy is a combination of multiple-dimensional conditions, and when the number of permission policies increases, the management complexity of the permission system also increases, and the clarity and maintainability of the permission system are reduced.

[0035] In some embodiments of the present application, a solution is provided to solve the above technical problems. The core idea of the solution is to separate the permissions into resource permissions and operation permissions, use roles to limit the operation permissions, and limit the resource range of the operation permissions on the authorization relationship of the user-authorization decision object to describe whether a user has a certain type of operation permission on a certain resource. Further, the number of roles is related to the number of types of operation permissions and is independent of the number of resource types, which reduces the risk of role explosion when the number of resource types is large.

[0036] The technical solutions provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0037] Figure 1 is a flowchart of a permission processing method provided by an exemplary embodiment of the present application. The method can include the steps as shown in Figure 1 .

[0038] Step 101, a first permission configuration request is obtained, and the first permission configuration request is used to request to assign a target object an operation permission of a first operation type on a first resource.

[0039] Step 102, according to the first operation type, a first authorization decision object corresponding to the target object is determined from at least one authorization decision object that has been created, and each of the at least one authorization decision object is associated with an operation permission of a preset operation type.

[0040] Step 103, a corresponding relationship between the first authorization decision object and the target object and the first resource is established, so that when the target user requests to perform the first type of operation on the first resource, the target object is authenticated according to the first authorization decision object.

[0041] It should be noted that the "first", "second", etc. in the present disclosure are used to distinguish different description objects, and do not represent the order of succession, nor limit that the "first" and "second" are different types.

[0042] The permission processing method provided by the embodiments of the present application can be executed by a permission system. The permission system can configure permissions for a target object based on the method provided by the embodiments of the present application, thereby providing permission control services based on the configured permissions. The permission processing method can be applied in various scenarios. For example, in an enterprise internal management scenario, the managers of an enterprise can assign different employees with operation permissions for different resources according to the responsibilities and levels of the employees, so as to ensure the security of enterprise data. For example, in an e-commerce management scenario, the managers of an e-commerce platform can assign different roles such as operation personnel, suppliers, logistics providers, etc. with operation permissions for different resources, such as product management permissions, order processing permissions, inventory monitoring permissions, etc., so as to ensure the safe and efficient operation of each link. Of course, in addition to the above application scenarios, the present application can also be applied to permission configuration scenarios of financial information, permission configuration scenarios of medical information, permission configuration scenarios of cloud services, etc., which will not be described one by one.

[0043] In step 101, the first permission configuration request can be initiated by a permission administrator through a client. The first permission configuration request can carry description information of the permission configuration. For example, the description information can be: assigning a specified target object with a permission to perform a first operation type of operation on a first resource. The target object can be a single user or a user group, or can be a service account of a user, or can be a system process, etc. The first resource refers to one or more resources that the target object needs to operate. For example, in an e-commerce scenario, the first resource can be specified product data, order records, inventory data, etc. In a cloud desktop service scenario, the first resource can be any specified cloud desktop instance. The first operation type can be any specified operation type, such as read, write, create, delete, authorize, or modify, etc.

[0044] In the embodiment, the permission system can pre-create at least one authorization decision object for distribution. The authorization decision object refers to an object for the permission system to make authorization decisions. The authorization decision object represents a predefined permission or a set of permissions, and the permission system can determine whether a target object has a certain permission based on the authorization decision object associated with the target object. In different permission models, the implementation of the authorization decision object is different. In a role-based permission model, such as the RBAC model described above, the authorization decision object can be a role. In a policy-based permission model, such as the PBAC model described above, the authorization decision object can be a permission policy. The at least one authorization decision object is respectively associated with an operation permission of a preset operation type, and the operation types of the operation permissions associated with different authorization decision objects are different. Optionally, the operation types of the operation permissions can include, but are not limited to, at least one of reading, writing, executing, creating, deleting, authorizing, and modifying. One authorization decision object can be associated with one or more operation permissions. For example, any pre-created authorization decision object can be associated with at least one of a read permission, a write permission, a create permission, a delete permission, an authorization permission, and a modify permission.

[0045] Figure 2 The permission model when the authorization decision object is a role is illustrated as shown in FIG. 3. A target object can be defined by a user ID or a nickname, a role can be defined by a role name, and an authorization relationship between the target object and the role is established. Meanwhile, an operation permission corresponding to a specified operation type can be defined, and an association relationship between the role and the operation permission is established. Figure 2 Figure 3 The permission model when the authorization decision object is a permission policy is illustrated as shown in FIG. 4. A target object can be defined by a user ID or a nickname, a role can be defined by a permission policy content, and an authorization relationship between the target object and the permission policy is established. Meanwhile, an operation permission corresponding to a specified operation type can be defined, and an association relationship between the permission policy and the operation permission is established. Figure 3

[0046] ​​Based on this, in step 102, a first authorization decision object corresponding to the target object can be determined from the created at least one authorization decision object according to the first operation type. For example, if the first operation type is a creation type, an authorization decision object associated with a creation permission can be determined from the at least one authorization decision object as the first authorization decision object. For another example, if the first operation type is a deletion type, an authorization decision object associated with a deletion permission can be determined from the at least one authorization decision object as the first authorization decision object. Alternatively, when the first authorization decision object is determined from the created at least one authorization decision object according to the first operation type, whether a first operation permission corresponding to the first operation type exists in the operation permissions associated with the at least one authorization decision object can be determined; if so, an authorization decision object associated with the first operation permission can be taken as the first authorization decision object corresponding to the target object. Based on this, the reuse of the created authorization decision object is realized. If the first operation permission corresponding to the first operation type does not exist in the operation permissions associated with the at least one authorization decision object, a first operation permission corresponding to the first operation type can be created, and an authorization decision object associated with the first operation permission can be created.

[0047] Alternatively, taking an authorization decision object as a role as an example, the association relationship between the at least one authorization decision object created in advance and the operation permission can be represented as: [role A1-read permission], [role A2-write permission], [role A3-creation permission], [role A4-deletion permission], [role A5-authorization permission], and [role A6-modification permission]. If the first operation permission is a deletion permission, role 4 can be taken as the first authorization decision object.

[0048] Alternatively, taking an authorization decision object as a permission policy as an example, the association relationship between the at least one authorization decision object created in advance and the operation permission can be represented as: [permission policy P1-read permission], [permission policy P2-write permission], [permission policy P3-creation permission], [permission policy P4-deletion permission], [permission policy P5-authorization permission], and [permission policy P6-modification permission]. If the first operation permission is a deletion permission, permission policy P4 can be taken as the first authorization decision object.

[0049] After the first authorization decision object corresponding to the target object is determined based on the above embodiments, the corresponding relationship between the first authorization decision object and the target object and the first resource can be established by using step 103, so that the first operation permission takes effect on the target object and the first resource. In some optional embodiments, the association relationship among the first authorization decision object, the target object and the first resource can be established, and the data table can be used to record the association relationship. When the target object is subjected to access control, the record in the data table can be queried, and it can be judged whether there is a record corresponding to the target resource requested to be accessed by the target object and the target operation type in the data table. If there is, it can be determined that the target object has the permission to perform the operation of the target operation type on the target resource, otherwise it is confirmed that the target object does not have the permission to perform the operation of the target operation type on the target resource.

[0050] In some optional embodiments, the authorization relationship between the first authorization decision object and the target object can be established, and the first resource can be added to the effective resource range of the authorization relationship, so that the authorization relationship takes effect on the first resource. Wherein, establishing the authorization relationship between the first authorization decision object and the target object refers to the process of granting the first operation permission corresponding to the first authorization decision object to the target object by assigning the first authorization decision object to the target object. In some role-based access control scenarios, the first authorization decision object can be implemented as a first role, and the first role can be assigned to the target object to establish the authorization relationship between the first authorization decision object and the target object. In some permission policy-based access control scenarios, the first authorization decision can be implemented as a first permission policy, and the target object can be added to the effective subject range of the first permission policy to establish the authorization relationship between the first role and the target object. Wherein, the effective subject range of the permission policy refers to the set of subject objects constrained or applicable by the permission policy, used to define the range of subjects, such as users, user groups, service accounts, system processes, etc. After the target object is added to the effective subject range of the first permission policy, the permission system can judge whether the target object meets the constraint condition corresponding to the first permission policy when performing access control according to the first permission policy, and if so, it can be determined that the target object has the first operation permission corresponding to the first permission policy.

[0051] The effective resource range of the authorization relationship is used to define a set of resources on which the authorization relationship takes effect. In this embodiment, the authorization relationship between the first authorization decision object and the target object can be taken as a whole, and when configuring the operation permissions of the target object on different resources of the same operation type, the effective resource range in the authorization relationship can be updated to quickly configure permissions for multiple different resources. Taking role-based access control as an example, assuming that there are resources B1 and B2, operations C1 and C2, a permission model can be created as follows: user U1-[role A1-operation permission C1]-resource B1, user U1-[role A1-operation permission C1]-resource B2, user U1-[role A2-operation permission C2]-resource B1, and user U1-[role A2-operation permission C2]-resource B2. That is, when there are two resources and two operation types, two roles can be created to meet the configuration requirements of two operation permissions on two resources.

[0052] In this embodiment, the authorization decision object is associated with the operation permission and is not associated with the resource, and when configuring the permission of the target object on the first resource of the first operation type, a new authorization decision object does not need to be created according to the first resource and the first operation type, but the first authorization decision object corresponding to the first operation type that has been created can be reused, and a corresponding relationship between the first authorization decision object and the first resource is dynamically established. Based on this embodiment, the created authorization decision object can be reused according to the operation type of the requested operation permission, which reduces the probability of adding a large number of authorization decision objects due to an increase in the types of resources to which the operation permission applies, and is beneficial to maintaining the number of authorization decision objects in the permission system within a stable range, improving the clarity and maintainability of the permission system, and thus reducing the management cost of the permission system.

[0053] In addition, in this embodiment, when the authorization decision object is associated with the operation permission and is not associated with the resource, different authorization decision objects can be established to correspond to different resources, so that operation permissions of different operation types can be flexibly combined with different resources, thereby on the one hand meeting the permission configuration requirements of different types of operations on different resources, and on the other hand, the number of authorization decision objects is related to the number of types of operation permissions and is not related to the number of types of resources, thereby reducing the risk of role explosion or permission policy explosion when the number of types of resources is large.

[0054] In some optional embodiments, when the resource permission of the target object is updated, a second permission configuration request can be acquired, which can be sent by the permission administrator through the client. The second permission configuration request is used to request to assign the target object with an operation permission of a first operation type on a second resource, the second resource being different from the first resource. In this case, the second resource can be added to the effective resource range of the authorization relationship between the first authorization decision object and the target object, so as to make the authorization relationship effective on the second resource. Based on this implementation, when the resource range of the authorized access is increased and the operation type on the resource is unchanged, the increased resource can be added to the effective resource range of the authorization relationship to update the effective range of the authorization relationship, without the need to newly create an authorization decision object, thereby reducing the number of authorization decision objects that need to be increased when the resource permission is expanded, and reducing the risk of "role explosion" or "permission policy explosion".

[0055] In the foregoing embodiments, the implementation of configuring the permission of the target object based on the pre-generated operation permission and the correspondence between the operation permission and the authorization decision object is described. In some scenarios, when the operation type is increased, a new operation permission and a new authorization decision object can be generated for the newly added operation type, so as to facilitate the permission management of the newly added operation type. Alternatively, in response to the addition of the operation type, a second operation type that is different from the operation type of the operation permission associated with the at least one authorization decision object that has been created can be acquired. After the second operation type is acquired, a second operation permission corresponding to the second operation type and a second authorization decision object can be created, and a correspondence between the second operation permission and the second authorization decision object can be established. Further, when the permission administrator requests to assign the target object with the operation permission of the second operation type on the first resource, the second operation permission corresponding to the second operation type can be determined from the created operation permissions, the second authorization decision object corresponding to the second operation permission can be established in the authorization relationship of the target object, and the first resource can be added to the effective resource range of the authorization relationship.

[0056] Based on this implementation, in the case of increasing the operation type, the increased authorization decision object is independent of the resource, and further, there is no need to generate authorization decision objects corresponding to different resources respectively, thereby effectively reducing the number of authorization decision objects and facilitating the management efficiency of the permission system.

[0057] The permission processing method provided in the embodiments of the present application can be applied to various application scenarios, such as an enterprise internal management scenario, an electronic commerce management scenario, a permission configuration scenario of financial information, a permission configuration scenario of medical information, a permission configuration scenario of cloud services, and the like. In the following, the permission processing method provided in the embodiments of the present application will be further exemplarily described by taking a permission configuration scenario of cloud services as an example.

[0058] A cloud service provider can provide a cloud desktop service (hereinafter referred to as a cloud desktop) to a user. The cloud desktop allows the user to quickly build and use a cloud computer environment on various terminal devices, so that the user can access his personalized workspace smoothly through a network no matter where the user is. When an enterprise adopts the cloud desktop for office work, a permission administrator of the enterprise can group cloud desktop related resources and configure different operation permissions of different operation types for different employees with respect to different resources. The cloud desktop related resources can include, but are not limited to, at least one of a cloud desktop instance, an application program, and data.

[0059] The permission administrator can create multiple enterprise roles, such as a visitor, a normal administrator, a senior administrator, and the like, through a client provided by a permission system, and establish an association relationship between different enterprise roles and operation permissions of different operation types. For example, the operation permission associated with the visitor administrator is a read permission, the operation permission associated with the normal administrator is a write permission, and the operation permission associated with the senior administrator is a delete permission. A server in the permission system can obtain and save the different enterprise roles, the operation permissions of different operation types, and the association relationship between the different enterprise roles and the operation permissions of different operation types.

[0060] When the permission administrator configures permissions for a target employee S1 through the client, the permission administrator can initiate a permission configuration request through the client of the permission administrator, and the permission configuration request is used to request to assign the target employee S1 with a read permission of data in a cloud desktop instance D1. After the server receives the permission configuration request of the client, the server can determine the read permission corresponding to the read operation according to the saved operation permissions of different operation types, and determine a visitor role corresponding to the read permission according to the saved association relationship between the different enterprise roles and the operation permissions of different operation types. Then, the server can establish a corresponding relationship between the visitor role and the target employee S1 and the cloud desktop instance D1. When the target employee S1 requests to read data in the cloud desktop instance D1, the server can authenticate the target employee S1 based on the established corresponding relationship. The permission administrator can also initiate other permission configuration requests for the target employee S1 through the client, such as a request to assign the target employee S1 with a delete permission of data in the cloud desktop instance D1. After the server receives the permission configuration request of the client, the server can determine a delete permission corresponding to the delete operation according to the saved operation permissions of different operation types, and determine a senior administrator role corresponding to the read permission according to the saved association relationship between the different enterprise roles and the operation permissions of different operation types. Then, the server can establish a corresponding relationship between the senior administrator role and the target employee S1 and the cloud desktop instance D1. When the target employee S1 requests to delete data in the cloud desktop instance D1, the server can authenticate the target employee S1 based on the established corresponding relationship.

[0061] Through the above measures, the cloud desktop environment can not only provide flexible and convenient remote work experience, but also ensure the security of enterprise data assets and the efficiency of management.

[0062] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can also be executed by different devices as the execution subject. For example, the execution subject of steps 101 to 104 can be device A; for another example, the execution subject of steps 101 and 102 can be device A, and the execution subject of step 103 can be device B; and the like.

[0063] In addition, in some of the processes described in the above embodiments and the accompanying drawings, a plurality of operations appearing in a specific order are included, but it should be clear that these operations can be executed in the order appearing in this text or in parallel, and the serial numbers of the operations such as 101, 102, etc. are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes can include more or fewer operations, and the operations can be executed in sequence or in parallel.

[0064] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant national and regional laws, regulations and standards, and provide corresponding operation portal for user to choose authorization or refusal.

[0065] Figure 4 The structure of the server provided by an example embodiment of the present application is shown, which is suitable for the permission processing method provided by the foregoing embodiments. As shown in Figure 4 The server includes a memory 401, a processor 402, and a communication component 403.

[0066] The memory 401 is used to store computer programs and can be configured to store other various data to support operations on the server. Examples of these data include instructions for any application or method operating on the server.

[0067] The processor 402 is coupled with the memory 401 and is configured to execute a computer program in the memory 401 to: acquire, by the communication component 403, a first permission configuration request, the first permission configuration request being used to request to assign a target object with an operation permission of a first operation type on a first resource; determine, according to the first operation type, a first authorization decision object corresponding to the target object from at least one authorization decision object that has been created, the at least one authorization decision object each being associated with an operation permission of a preset operation type; and establish a correspondence between the first authorization decision object and the target object and the first resource, so as to authenticate the target object according to the first authorization decision object when the target user requests to perform the first type of operation on the first resource.

[0068] Optionally, when the processor 402 determines the first authorization decision object corresponding to the target object from the at least one authorization decision object that has been created according to the first operation type, the processor 402 is specifically configured to: determine, in the operation permissions associated with the at least one authorization decision object, whether there is a first operation permission corresponding to the first operation type; if there is, the authorization decision object associated with the first operation permission is taken as the first authorization decision object corresponding to the target object.

[0069] Optionally, when the processor 402 establishes the correspondence between the first authorization decision object and the target object and the first resource, the processor 402 is specifically configured to: establish an authorization relationship between the first authorization decision object and the target object; and add the first resource to an effective resource range of the authorization relationship, so as to make the authorization relationship effective on the first resource.

[0070] Optionally, the processor 402 is further configured to: acquire a second permission configuration request, the second permission configuration request being used to request to assign the target object with an operation permission of the first operation type on a second resource; and add the second resource to the effective resource range of the authorization relationship, so as to make the authorization relationship effective on the second resource.

[0071] Optionally, the processor 402 is further configured to: in response to an addition operation of an operation type, acquire an added second operation type, the second operation type being different from the operation types of the operation permissions associated with the at least one authorization decision object; create a second operation permission corresponding to the second operation type and a second authorization decision object; and establish a correspondence between the second operation permission and the second authorization decision object.

[0072] Optionally, the first authorization decision object includes a first role, and when the processor 402 establishes the authorization relationship between the first authorization decision object and the target object, the processor 402 is specifically configured to: assign the first role to the target object.

[0073] Optionally, the first authorization decision object comprises a first permission policy; and the processor 402, in establishing the authorization relationship between the first authorization decision object and the target object, is specifically configured to add the target object to an effective subject range of the first permission policy.

[0074] Further, as shown in Figure 4 the server further comprises other components such as a power supply component 404, a display component 405, and an audio component 406. Figure 4 In the embodiment, only some components are shown schematically, and it does not mean that the server only comprises Figure 4 the components shown in the figure. Figure 4 In the embodiment, the components in the dashed box are optional components rather than mandatory components, and the specific implementation can be determined according to the product form of the electronic device. The electronic device of the embodiment can be implemented as a terminal device such as a desktop computer, a notebook computer, a smart phone, or an IOT device, or a server device such as a conventional server, a cloud server, or a server array. If the electronic device of the embodiment is implemented as a terminal device such as a desktop computer, a notebook computer, a smart phone, etc., it can contain Figure 4 the components in the dashed box in the embodiment; if the electronic device of the embodiment is implemented as a server device such as a conventional server, a cloud server, or a server array, it can not contain Figure 4 the components in the dashed box in the embodiment.

[0075] The memory 401 can be implemented by any type of volatile or non-volatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0076] The communication component 403 is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as Wi-Fi (Wireless Fidelity), 2G (for example, Global System for Mobile Communications (GSM) and so on), 3G (for example, Wideband Code Division Multiple Access (WCDMA), 4G (for example, Long Term Evolution (LTE) and so on), 4G+ (for example, LTE-Advanced (LTE-A) and so on), or 5G (5th Generation Mobile Communication Technology), or a combination thereof. In an example embodiment, the communication component receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an example embodiment, the communication component can be implemented based on a Near Field Communication (NFC) technology, a Radio Frequency Identification (RFID) technology, an Infrared Data Association (IrDA) technology, an Ultra Wide Band (UWB) technology, a Bluetooth (BT) technology and other technologies.

[0077] The power supply component 404 is configured to supply power to various components of the device where the power supply component is located. The power supply component can include a power management system, one or more power supplies, and other components associated with generating, managing and distributing power to the device where the power supply component is located.

[0078] The display component includes a screen, which can include a Liquid Crystal Display (LCD) and a Touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense a touch, a slide and a gesture on the touch panel. The touch sensor can not only sense a boundary of a touching or a sliding action, but also detect duration and pressure related to the touching or sliding action.

[0079] The audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) that is configured to receive an external audio signal when a device in which the audio component is located is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory or transmitted via the communication component. In some embodiments, the audio component further includes a speaker for outputting an audio signal.

[0080] In the embodiment, the authorization decision object is associated with the operation permission and is not associated with the resource, and thus when the permission of the target object to the first operation type of the first resource is configured, a new authorization decision object does not need to be created according to the first resource and the first operation type, but the first authorization decision object corresponding to the first operation type that has been created can be reused, and the corresponding relationship between the first authorization decision object and the first resource is dynamically established. Based on this implementation, the created authorization decision object can be reused according to the operation type of the requested operation permission, which reduces the probability of adding a large number of authorization decision objects due to the increase in the types of resources to which the operation permission is applicable, and is beneficial to maintaining the number of authorization decision objects in the permission system within a stable range, improving the clarity and maintainability of the permission system, and thus reducing the management cost of the permission system.

[0081] In addition, in this implementation, when the authorization decision object is associated with the operation permission and is not associated with the resource, different authorization decision objects can be established to correspond to different resources, so as to flexibly combine operation permissions of different operation types with different resources, thereby on the one hand meeting the permission configuration requirements of different types of operations on different resources, and on the other hand, the number of authorization decision objects is related to the number of types of operation permissions and is not related to the number of types of resources, which reduces the risk of role explosion or permission policy explosion when the number of types of resources is large.

[0082] Correspondingly, the embodiment of the application further provides a computer readable storage medium storing a computer program, and the computer program is executed to implement each step that can be executed by the server in the method embodiment.

[0083] The embodiment of the application further provides a computer program product, including: computer programs / instructions, which are executed by a processor to implement the steps in the method provided by the embodiment of the application.

[0084] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer readable program code.

[0085] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing device or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 Figure 1

[0086] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 Figure 1

[0087] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 Figure 1

[0088] In one typical configuration, the computing device includes one or more processors (Central Processing Units, CPUs), input / output interfaces, network interfaces, and memory.

[0089] ​​​​​​Memory can include non-persistent memory, Random Access Memory (RAM), and / or non-volatile memory, such as read only memory (ROM) or flash memory, in computer readable media. Memory is an example of computer readable media.

[0090] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital video disc (DVD), or other optical storage, magnetic cassettes, magnetic disks storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0091] It should also be noted that the terms "comprising", "containing", or any other variant thereof, are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements does not include only those elements in the list, but can also include other elements not expressly listed or inherent to such process, method, product, or apparatus. Without more limitations, an element defined by the phrase "comprising a" does not exclude the existence of additional identical elements in the process, method, product, or apparatus that includes the element.

[0092] The above description is merely illustrative of the application, and not restrictive. Various modifications and changes can become apparent to those skilled in the art. Incorporating any modification, equivalent substitution, improvement, etc. within the spirit and principle of the application shall be included in the scope of claims of the application.

Claims

1. A rights processing method, characterized by, The method comprises: obtaining a first permission configuration request, the first permission configuration request being used for requesting to assign a target object with an operation permission of a first operation type on a first resource; determining, according to the first operation type, a first authorization decision object corresponding to the target object from at least one authorization decision object that has been created, each of the at least one authorization decision object being associated with an operation permission of a preset operation type; establishing a correspondence between the first authorization decision object and the target object and the first resource, so as to authenticate the target object according to the first authorization decision object when the target object requests to perform the first type of operation on the first resource.

2. The method of claim 1, wherein, The step of determining, according to the first operation type, a first authorization decision object corresponding to the target object from at least one authorization decision object that has been created comprises: judging whether there is a first operation permission corresponding to the first operation type in the operation permissions associated with the at least one authorization decision object; if there is, taking the authorization decision object associated with the first operation permission as the first authorization decision object corresponding to the target object.

3. The method of claim 1, wherein, The step of establishing a correspondence between the first authorization decision object and the target object and the first resource comprises: establishing an authorization relationship between the first authorization decision object and the target object; and adding the first resource to an effective resource range of the authorization relationship, so as to make the authorization relationship effective on the first resource.

4. The method of claim 3, wherein, The method further comprises: obtaining a second permission configuration request, the second permission configuration request being used for requesting to assign the target object with an operation permission of the first operation type on a second resource; adding the second resource to the effective resource range of the authorization relationship, so as to make the authorization relationship effective on the second resource.

5. The method of claim 1, wherein, The method further comprises: in response to an addition operation on an operation type, obtaining an added second operation type, the second operation type being different from the operation types of the operation permissions associated with the at least one authorization decision object; creating a second operation permission corresponding to the second operation type and a second authorization decision object; establishing a correspondence between the second operation permission and the second authorization decision object.

6. The method according to any one of claims 1 to 5, characterized in that, The first authorization decision object comprises a first role, and the step of establishing an authorization relationship between the first authorization decision object and the target object comprises assigning the first role to the target object.

7. The method according to any one of claims 1 to 5, characterized in that, The first authorization decision object comprises a first permission policy, and the step of establishing an authorization relationship between the first authorization decision object and the target object comprises adding the target object to an effective subject range of the first permission policy.

8. A server, characterized by The method comprises: a memory and a processor; the memory is used for storing one or more computer instructions; the processor is used for executing the one or more computer instructions to perform the steps in the method according to any one of claims 1-7.

9. A computer readable storage medium storing a computer program, characterized in that, A computer program is executed by a processor to implement the permission processing method according to any one of claims 1-7.

10. A computer program product, characterised in that, The method comprises: a computer program / instruction, which is executed by a processor to implement the permission processing method according to any one of claims 1-7.

Images