Permission control method, device, equipment and storage medium

Abstract

The present invention discloses a permission control method, device, equipment and storage medium, the method comprising: receiving login information sent by a client, obtaining corresponding virtual group information and temporary authorization information according to the login information; querying business data from a business library according to the virtual group information and temporary authorization information, and marking the data operation authority corresponding to the business data; saving the business data and the data operation authority corresponding to each other as a permission data packet, and returning the permission data packet to the client. Business data is obtained according to the virtual group information and temporary authorization information, and the generated permission data packet is returned to the corresponding client, so that users can obtain business data with authority within the virtual group group. Through temporary authorization, the business data access rights of users outside the group can be guaranteed within a limited time period, which meets the temporary interaction and temporary sharing requirements of specific business data between users, realizes the refined control of business data, and improves the privacy of business data.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a permission control method, device, equipment and storage medium. Background Art

[0002] With the development of computer technology, more and more technologies (big data, distributed, blockchain, artificial intelligence, etc.) are being applied in the financial field. The traditional financial industry is gradually transforming to financial technology (Fintech). However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology.

[0003] Most of the current permission systems are implemented based on RBAC (Role-Based Access Control). RBAC-based permission systems can meet most coarse-grained permission control requirements, but cannot meet the temporary interaction and temporary sharing requirements of certain specific business data between different users. It is difficult to achieve refined control of specific business data. Therefore, the privacy protection of business data at a fine-grained level needs to be improved. Summary of the invention

[0004] The present invention provides a permission control method, device, equipment and storage medium, aiming to achieve refined control of business and improve the privacy of business data.

[0005] To achieve the above object, the present invention provides a permission control method, the method comprising:

[0006] Receive the login information sent by the client, and obtain the corresponding virtual grouping information and temporary authorization information according to the login information;

[0007] Querying service data from a service library according to the virtual grouping information and the temporary authorization information, and marking data operation permissions corresponding to the service data;

[0008] The business data and the data operation rights are correspondingly saved as a rights data packet, and the rights data packet is returned to the client.

[0009] Preferably, after the step of storing the business data and the data operation authority in correspondence with each other as an authority data packet and returning the authority data packet to the client, the step further includes:

[0010] Receiving a temporary authorization request sent by the client, and obtaining temporary authorization information in the temporary authorization request;

[0011] The temporary authorization information is associated with the business authority of the authorization object.

[0012] Preferably, after the step of associating the temporary authorization information with the service authority of the authorization object, the step further includes:

[0013] Monitoring the expiration time of the temporary authorization information;

[0014] If the current time reaches the expiration time point, the association between the temporary authorization information and the authorization object is released.

[0015] Preferably, before the step of receiving the login information sent by the client and acquiring the corresponding virtual grouping information and temporary authorization information according to the login information, the step further includes:

[0016] Creating a virtual group model, the virtual group model including a group architecture, group members, business domains, and operation permissions; and / or

[0017] Create an empowerment model, including empowerment business data, empowerment objects, and validity period;

[0018] The step of acquiring corresponding virtual grouping information and temporary authorization information according to the login information comprises:

[0019] According to the login information and the virtual grouping model, acquiring virtual grouping information corresponding to the login information;

[0020] According to the login information and the authorization model, the login information is obtained to obtain corresponding temporary authorization information.

[0021] Preferably, after the step of storing the business data and the data operation authority in correspondence with each other as an authority data packet and returning the authority data packet to the client, the step further includes:

[0022] receiving a request from the client to modify one or more business data in the permission data packet;

[0023] Verifying data operation permissions based on the modification request, wherein the data operation permissions include modification permissions;

[0024] If the verification passes, the one or more business data are modified according to the modification request, and the modified one or more business data are saved.

[0025] Preferably, the step of querying service data from a service library according to the virtual grouping information and the temporary authorization information comprises:

[0026] Based on the virtual group information, querying the service library for virtual group service data corresponding to the virtual group information;

[0027] Based on the temporary authorization information, querying the authorization service data corresponding to the authorization information from the service database;

[0028] The virtual grouping service data and the empowered service data are saved as service data.

[0029] Preferably, before the step of querying the service data from the service library according to the virtual grouping information and the temporary authorization information and marking the data operation authority corresponding to the service data, the step further includes:

[0030] Receive the business data uploaded by the client, and save the business data to the business library.

[0031] In addition, to achieve the above object, the present invention further provides a permission control device, the permission control device comprising:

[0032] An acquisition module, used to receive the login information sent by the client, and acquire the corresponding virtual grouping information and temporary authorization information according to the login information;

[0033] A query module, used to query the service data from the service library according to the virtual grouping information and the temporary authorization information, and mark the data operation authority corresponding to the service data;

[0034] The merging module saves the business data and the data operation authority in correspondence as an authority data packet, and returns the authority data packet to the client.

[0035] In addition, to achieve the above-mentioned purpose, the present invention also provides a permission control device, which includes a processor, a memory and a permission control program stored in the memory. When the permission control program is executed by the processor, the steps of the permission control method described above are implemented.

[0036] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer storage medium, on which a permission control program is stored, and when the permission control program is executed by a processor, the steps of the permission control method described above are implemented.

[0037] Compared with the prior art, the present invention provides a permission control method, device, equipment and storage medium, the method comprising: receiving login information sent by a client, obtaining corresponding virtual group information and temporary authorization information according to the login information; querying business data from a business library according to the virtual group information and the temporary authorization information, and marking the data operation permissions corresponding to the business data; saving the business data and the data operation permissions in correspondence as a permission data packet, and returning the permission data packet to the client. Thus, the corresponding business data is obtained according to the virtual group information and the temporary authorization information, and the generated permission data packet is returned to the corresponding client, so that the user can obtain the business data of the permissions within the virtual group group. Through temporary authorization, the business data access rights of users outside the group in a limited time period can be guaranteed, and the temporary interaction and temporary sharing requirements of specific business data between multiple users are met, so that the refined control of business data is realized and the privacy of business data is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Schematic diagram of the hardware structure of the permission control device involved in each embodiment of the present invention;

[0039] Figure 2 It is a flowchart of the first embodiment of the permission control method of the present invention;

[0040] Figure 3 This is a schematic diagram of a scenario of an embodiment of a permission control method of the present invention;

[0041] Figure 4 It is a flowchart of the second embodiment of the permission control method of the present invention;

[0042] Figure 5 It is a functional module diagram of the first embodiment of the authority control device of the present invention.

[0043] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0044] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0045] The permission control device mainly involved in the embodiments of the present invention refers to a network connection device that can achieve network connection. The permission control device can be a server, a cloud platform, etc.

[0046] Reference Figure 1 , Figure 11 is a schematic diagram of the hardware structure of the permission control device involved in each embodiment of the present invention. In the embodiment of the present invention, the permission control device may include a processor 1001 (such as a central processing unit, CPU), a communication bus 1002, an input port 1003, an output port 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components; the input port 1003 is used for data input; the output port 1004 is used for data output, and the memory 1005 can be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 can optionally be a storage device independent of the aforementioned processor 1001. Those skilled in the art can understand that Figure 1 The hardware structure shown in the figure does not constitute a limitation of the present invention, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0047] Continue to refer to Figure 1 , Figure 1 The memory 1005 as a readable storage medium may include an operating system, a network communication module, an application module, and a permission control program. Figure 1 In the embodiment, the network communication module is mainly used to connect to the server and perform data communication with the server; and the processor 1001 can call the permission control program stored in the memory 1005 and execute the permission control method provided in the embodiment of the present invention.

[0048] An embodiment of the present invention provides a permission control method.

[0049] Permission management systems all have customized business requirements. Different users have different functional interfaces and different business permissions. From a project perspective, different users have different roles, and different roles are bound to different functional modules, and it is necessary to ensure that users cannot operate functions outside of their permissions. Generally, general permission management can be achieved through RBAC (role-based access). However, this type of permission management can only solve most of the coarse-grained permission control needs. If you need to fine-tune the control of specific business data, you will face greater challenges. For example, if there are multiple resources under the same permission, some scenarios require isolating the data of different users and maintaining the visibility and operation restrictions of small groups. In this mode, the traditional model cannot meet the needs. Therefore, the privacy protection of business data at a fine-grained level needs to be improved.

[0050] Reference Figure 2 , Figure 2 It is a flowchart of the first embodiment of the permission control method of the present invention.

[0051] In this embodiment, the permission control method is applied to a permission control device, and the method includes:

[0052] Step S101, receiving login information sent by the client, and acquiring corresponding virtual grouping information and temporary authorization information according to the login information;

[0053] In this embodiment, the user enters login information through the login interface of the client, and after the client receives the login information, it sends the login information to the permission control device. Generally, the login information includes information such as user name, account number, password, etc. The client enters the system based on the login information. In this embodiment, the client can be a mobile terminal, computer terminal and other devices. Generally, the client needs to apply for or register the login information in advance, or the permission control system directly allocates multiple login information.

[0054] Furthermore, an RBAC check is performed based on the login information to check the user rights corresponding to the login information, and after successful verification, a corresponding function menu is sent to the client according to the user rights, and the function menu is presented to the user through the client. If the check fails, the function menu is hidden. Generally, the corresponding user and user rights under the user name or account are queried based on the login information. If the user and user rights are consistent, it is determined that the RBAC check has been passed; conversely, if the user and user rights are inconsistent, it is determined that the RBAC check has not been passed.

[0055] In this embodiment, before the step of receiving the login information sent by the client and acquiring the corresponding virtual grouping information and temporary authorization information according to the login information, the following step is further included:

[0056] Step S101-1: The virtual group model includes a group structure, group members, business domains, and read and write permissions;

[0057] A virtual grouping model is created in advance, and the virtual grouping model is used to set the member architecture. The virtual grouping model defines the groups, the members of each group, the corresponding business domain, and the read and write permissions of each member. For example, the grouping architecture can be to divide the finance department into Finance Department A and Finance Department B, and the Finance Department A includes Finance Department A Group 1 and Finance Department A Group 2, wherein the Finance Department A Group 1 includes 2 members, and the Finance Department A Group 2 includes 3 members; the Finance Department B can include Finance Department B Group 1 and Finance Department B Group 2, wherein the Finance Department B Group 1 includes 3 members, and the Finance Department B Group 2 includes 3 members. The group members generally include information such as member positions, member names, and work numbers. The business domains are divided according to actual conditions, such as sales domains, technical domains, management domains, logistics domains, etc. The read and write permissions include read and write within the group, read and write outside the group, read-only within the group, read-only outside the group, etc.

[0058] Step S101 - 2 : Create an authorization model, including authorization business data, authorization objects, and validity period.

[0059] In this embodiment, the empowerment model includes empowered business data, empowered objects, and validity period. The empowered objects may be members of other groups in the system, and the validity period may be a temporary period or a long-term validity period. For example, Xiao Li, a member of Group 1 of the Finance Department A, grants the read and write permissions of business data a to Xiao Wang, a member of Group 2 of the Finance Department B, with a validity period of 7 days from now. Then, the empowered business data is business data a, the empowered object is Xiao Wang, a member of Group 2 of the Finance Department B, and the validity period is 7 days from now.

[0060] Based on the constructed virtual grouping model and the empowerment model, the framework of the permission control system is formed, and the relevant information can be directly filled in at a later stage without repeatedly setting up the framework, or only the virtual grouping model and the empowerment model need to be slightly adjusted before being put into use, which greatly facilitates the actual architecture management.

[0061] Specifically, the corresponding virtual group service authority is acquired based on the virtual group information, and the virtual group service authority is an internal authority. The authorized service authority is acquired based on the temporary authorized information, and the temporary authorized service authority is an external authority.

[0062] Based on this, the step of obtaining corresponding virtual grouping information and temporary authorization information according to the login information includes:

[0063] Step S101a: acquiring virtual group information corresponding to the login information according to the login information and the virtual group model;

[0064] After the login information is obtained, the virtual group information corresponding to the login information is obtained based on the virtual group model, and the virtual group of the corresponding user in the virtual group model is queried based on the login information.

[0065] Step S101b: According to the login information and the authorization model, obtain the temporary authorization information corresponding to the login information.

[0066] After obtaining the login information, based on the weighting model, temporary weighting information corresponding to the login information is obtained. Based on the login information, temporary weighting information of the corresponding user in the weighting model is queried.

[0067] Step S102, querying service data from a service library according to the virtual grouping information and the temporary authorization information, and marking the data operation authority corresponding to the service data;

[0068] In this embodiment, before step S102, the following steps are also included:

[0069] Step S102-1, receiving business data written by the client, and saving the business data to the business library.

[0070] If Xiao Wang, a member of Group 2 of the Finance Department B, creates business data A001 and uploads the business data A001 to the authority control system through the client, the authority control system saves the business data to the business library. The business library includes valid business data uploaded by all members under the authority control system.

[0071] Specifically, the step S102: querying the service number from the service library according to the virtual grouping information and the temporary authorization information includes:

[0072] Step S102a, querying virtual group service data corresponding to the virtual group information from the service library based on the virtual group information;

[0073] Scan the service data in the service library, query the corresponding service data based on the virtual group information, and save the query result as virtual group service data. The service data in the virtual group service data list are arranged according to preset rules, and the preset rules include service data creation and / or modification time, service data creator, service name, service data importance, etc.

[0074] Step S102b, querying the authorization service data corresponding to the temporary authorization information from the service database based on the temporary authorization information;

[0075] Scan the business data in the business database, query the corresponding business data based on the temporary authorization information, and save the query results as authorized business data. The business data in the authorized business data list are arranged according to preset rules, and the preset rules include business data creation and / or modification time, business data creator, business name, business data importance, etc.

[0076] Step S102c: Save the virtual grouping service data and the empowered service data as service data.

[0077] After obtaining the virtual group service data and the empowered service data, the virtual group service data and the empowered service data are saved as service data.

[0078] Specifically, refer to Figure 3 , Figure 3 Schematic diagram of a scenario of an embodiment of the permission control method of the present invention. Figure 3 As shown, the business data is displayed in the form of a list: the business data list includes a virtual group business list and an authorized business list, wherein the business data included in the virtual group business list are A001, A002, A003, A004, A005, etc.; the business data included in the authorized business list are B004, C002, C110, C402, D050, etc.

[0079] Specifically, the business permissions also include data read permissions corresponding to each business data. The data operation permissions of each business data are obtained respectively, and the data operation permissions are saved corresponding to the business data, and the data operation permissions of each business data are marked. The data operation permission list includes read permissions, modification, and addition, among which the read and write permissions include read and write within the group, read and write outside the group, read-only within the group, and read-only outside the group.

[0080] Step S103: Save the business data and the data operation authority in correspondence as an authority data packet, and return the new data packet to the client.

[0081] After obtaining the business data and the data operation permission, merge the two, generate a permission data packet and save it. In this embodiment, the merging method may be to mark each business data with its corresponding operation permission, and then generate the permission data packet. For example, the result list may be [{'A001', 'Read-only'}, {'A002', 'Read-write'}]. The merging method may also be to merge the business data of the same operation permission into a business data group, and then generate a permission data packet for the merged multiple business data groups. For example, the result list may be [{'Read-only': A001, A003, A006, B009}], where A003, A006, and B009 are all pre-created business data.

[0082] After obtaining the permission data packet, the permission data packet is returned to the client, and the result list is presented to the corresponding member / user through the client.

[0083] This embodiment uses the above scheme to receive the login information sent by the client, obtain the corresponding virtual group information and temporary authorization information according to the login information; query the business data from the business library according to the virtual group information and the temporary authorization information, and mark the data operation permissions corresponding to the business data; save the business data and the data operation permissions in correspondence as a permission data packet, and return the permission data packet to the client. Thus, the corresponding business data is obtained according to the virtual group information and the temporary authorization information, and the generated permission data packet is returned to the corresponding client, which is convenient for users to obtain business data with permissions within the virtual group group. Through temporary authorization, the business data access rights of users outside the group in a limited time period can be guaranteed, and the temporary interaction and temporary sharing requirements of specific business data between multiple users are met, so as to realize the refined control of business data and improve the privacy of business data.

[0084] like Figure 4 As shown, the second embodiment of the present invention proposes a permission control method based on the above Figure 2 In the first embodiment shown, after the step of saving the business data and the data operation rights in correspondence with each other as a rights data packet and returning the rights data packet to the client, the step further includes:

[0085] Step S104, receiving the temporary authorization request sent by the client, and obtaining authorization information in the temporary authorization request;

[0086] In this embodiment, the member who creates the business data, that is, the creator, has the permission to operate the business authorization. The creator can authorize the business data he created. It can be understood that the member with the permission to operate the business authorization can also be a non-creator, such as the creator's superior, system administrator, etc.

[0087] The creator activates the temporary authorization request through touch operation or voice command, and the client sends the authorization request to the permission control device after receiving the authorization request. The temporary authorization request includes authorization information. The authorization information includes authorization business data, authorization object and validity period. For example, the creator grants the read-only permission of the created data business B002 to other group member Xiao Zhang, with a validity period of January 2020. The corresponding authorization business data is data business B002, the authorization object is Xiao Zhang, and the validity period is January 2020.

[0088] Furthermore, the authorization request may also include authorization information of multiple business data, so as to achieve batch authorization.

[0089] Step S105: Associating the authorization information with the business authority of the authorization object.

[0090] The authorization information is associated with the authorization object in the system, and the authorization information is associated with the service authority of the corresponding authorization object. The authorization service data in the authorization information belongs to the authorization service of the authorization object.

[0091] Furthermore, after the step of saving the business data and the data operation authority in correspondence with each other as an authority data packet and returning the authority data packet to the client, the step further includes:

[0092] receiving a request from the client to modify one or more business data in the result list;

[0093] Verifying data operation permissions based on the modification request, wherein the data operation permissions include modification permissions;

[0094] If the verification passes, the one or more business data are modified according to the modification request, and the modified one or more business data are saved.

[0095] Specifically, the business authority also includes modification authority. A user with modification authority can activate a modification request through voice or touch operation. After receiving the modification request, the client sends the modification request to the authority control device. The modification request includes one or more business data to be modified, modification content, etc.

[0096] In this embodiment, in order to protect the security of business data and prevent malicious tampering, it is also necessary to verify the operation authority of the user who sends the modification request, and the operation authority includes the modification authority. The verification can be face, fingerprint, or password verification. After the verification is passed, the one or more business data are modified according to the modification request, and the modified one or more business data are saved. The modification log is also retained for later review.

[0097] Furthermore, after the step of saving the business data and the data operation authority in correspondence with each other as an authority data packet and returning the authority data packet to the client, the step further includes:

[0098] Step a: monitoring the expiration time point of the temporary authorization information;

[0099] Step b: If the current time reaches the expiration time point, the temporary authorization information and the authorization object are released.

[0100] Specifically, all temporary authorization information is screened and saved, the expiration time points of the temporary authorization information are obtained, and the temporary authorization information is sorted according to the order of the expiration time points;

[0101] Compare the first expiration time point with the current time point. If the first expiration time point reaches the current time, mark the corresponding temporary authorization information as invalid, and remove the association between the temporary authorization information and the authorization object. As a result, the authorization object no longer has the temporary authorization. Delete the authorization information corresponding to the expiration time point, and continue to monitor the next expiration time point.

[0102] This embodiment uses the above scheme to receive the login information sent by the client, obtain the corresponding virtual group information and temporary authorization information according to the login information; query the business data from the business library according to the virtual group information and the temporary authorization information, and mark the data operation permissions corresponding to the business data; save the business data and the data operation permissions in correspondence as a permission data packet, and return the permission data packet to the client. Thus, the corresponding business data is obtained according to the virtual group information and the temporary authorization information, and the generated permission data packet is returned to the corresponding client, which is convenient for users to obtain business data with permissions within the virtual group group. Through temporary authorization, the business data access rights of users outside the group in a limited time period can be guaranteed, and the temporary interaction and temporary sharing requirements of specific business data between multiple users are met, so as to realize the refined control of business data and improve the privacy of business data.

[0103] In addition, this embodiment also provides a permission control device. Figure 5 , Figure 5This is a schematic diagram of the functional modules of the first embodiment of the authority control device of the present invention.

[0104] In this embodiment, the authority control device is a virtual device stored in Figure 1 The memory 1005 of the permission control device shown is used to implement all functions of the permission control program: for receiving login information sent by the client, and obtaining corresponding virtual grouping information and temporary authorization information according to the login information; for querying business data from the business library according to the virtual grouping information and the temporary authorization information, and marking the data operation permissions corresponding to the business data; for saving the business data and the data operation permissions in correspondence as a permission data packet, and returning the permission data packet to the client.

[0105] Specifically, the authority control device includes:

[0106] The acquisition module 10 is used to receive the login information sent by the client, and acquire the corresponding virtual grouping information and temporary authorization information according to the login information;

[0107] A query module 20, configured to query service data from a service library according to the virtual grouping information and the temporary authorization information, and mark data operation permissions corresponding to the service data;

[0108] The merging module 30 stores the business data and the data operation rights in correspondence as a rights data packet, and returns the rights data packet to the client.

[0109] Furthermore, the storage module is also used for:

[0110] Receiving a temporary authorization request sent by the client, and obtaining temporary authorization information in the temporary authorization request;

[0111] The temporary authorization information is associated with the business authority of the authorization object.

[0112] Furthermore, the storage module is also used for:

[0113] Monitoring the expiration time of the temporary authorization information;

[0114] If the current time reaches the expiration time point, the association between the temporary authorization information and the authorization object is released.

[0115] Furthermore, the acquisition module is also used for:

[0116] Creating a virtual group model, the virtual group model including a group architecture, group members, business domains, and operation permissions; and / or

[0117] Create an empowerment model, including empowerment business data, empowerment objects, and validity period;

[0118] Furthermore, the acquisition module is also used for:

[0119] According to the login information and the virtual grouping model, the login information is obtained to obtain corresponding virtual grouping information;

[0120] According to the login information and the authorization model, the login information is obtained to obtain corresponding temporary authorization information.

[0121] Furthermore, the storage module is also used for:

[0122] receiving a request from the client to modify one or more business data in the permission data packet;

[0123] Verifying data operation permissions based on the modification request, wherein the data operation permissions include modification permissions;

[0124] If the verification passes, the one or more business data are modified according to the modification request, and the modified one or more business data are saved.

[0125] Furthermore, the storage module is also used for:

[0126] Based on the virtual group information, querying the service library for virtual group service data corresponding to the virtual group information;

[0127] Based on the temporary authorization information, querying the authorization service data corresponding to the authorization information from the service database;

[0128] The virtual grouping service data and the empowered service data are saved as service data.

[0129] Furthermore, the query module is also used for:

[0130] Receive the business data uploaded by the client, and save the business data to the business library.

[0131] In addition, an embodiment of the present invention further provides a computer storage medium, on which a permission control program is stored. When the permission control program is executed by a processor, the steps of the permission control method described above are implemented, which will not be repeated here.

[0132] Compared with the prior art, the present invention proposes a permission control method, device, equipment and storage medium, the method comprising: receiving login information sent by a client, obtaining corresponding virtual group information and temporary authorization information according to the login information; querying business data from a business library according to the virtual group information and the temporary authorization information, and marking the data operation permissions corresponding to the business data; saving the business data and the data operation permissions in correspondence as a permission data packet, and returning the permission data packet to the client. Thus, the corresponding business data is obtained according to the virtual group information and the temporary authorization information, and the generated permission data packet is returned to the corresponding client, so that the user can obtain the business data with permissions within the virtual group group. Through temporary authorization, the business data access rights of users outside the group in a limited time period can be guaranteed, and the temporary interaction and temporary sharing requirements of specific business data between multiple users are met, so that the refined control of business data is realized and the privacy of business data is improved.

[0133] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0134] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0135] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present invention.

[0136] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A permission control method, characterized in that: The method comprises: Receive login information sent by the client, and obtain corresponding virtual group information and temporary authorization information according to the login information; specifically, obtain corresponding virtual group service rights based on the virtual group information, the virtual group service rights are in-group rights, and obtain authorized service rights based on the temporary authorization information, the authorized service rights are out-group rights; Querying service data from a service library according to the virtual grouping information and the temporary authorization information, and marking data operation permissions corresponding to the service data; The business data and the data operation rights are saved in correspondence as a rights data packet, and the rights data packet is returned to the client; After the step of storing the business data and the data operation authority in correspondence with each other as an authority data packet and returning the authority data packet to the client, the method further includes: Receiving a temporary authorization request sent by the client, and obtaining temporary authorization information in the temporary authorization request; Associating the temporary authorization information with the business authority of the authorization object; The step of querying service data from a service library according to the virtual grouping information and the temporary authorization information comprises: Based on the virtual group information, querying the service library for virtual group service data corresponding to the virtual group information; Based on the temporary authorization information, query the authorization service data corresponding to the authorization information from the service database; The virtual grouping service data and the empowered service data are saved as service data.

2. The method according to claim 1, characterized in that After the step of associating the temporary authorization information with the service authority of the authorization object, the method further includes: Monitoring the expiration time of the temporary authorization information; If the current time reaches the expiration time point, the association between the temporary authorization information and the authorization object is released.

3. The method according to claim 1, characterized in that Before the step of receiving the login information sent by the client and acquiring the corresponding virtual grouping information and temporary authorization information according to the login information, the step further includes: Creating a virtual group model, the virtual group model including a group architecture, group members, business domains, and operation permissions; and / or Create an empowerment model, including empowerment business data, empowerment objects, and validity period; The step of acquiring corresponding virtual grouping information and temporary authorization information according to the login information comprises: According to the login information and the virtual grouping model, acquiring virtual grouping information corresponding to the login information; According to the login information and the authorization model, the login information is obtained to obtain corresponding temporary authorization information.

4. The method according to claim 1, characterized in that: After the step of storing the business data and the data operation authority in correspondence with each other as an authority data packet and returning the authority data packet to the client, the method further includes: receiving a request from the client to modify one or more business data in the permission data packet; Verifying data operation permissions based on the modification request, wherein the data operation permissions include modification permissions; If the verification passes, the one or more business data are modified according to the modification request, and the modified one or more business data are saved.

5. The method according to claim 1, characterized in that: Before the step of querying the service data from the service library according to the virtual grouping information and the temporary authorization information and marking the data operation authority corresponding to the service data, the step further includes: Receive the business data uploaded by the client, and save the business data to the business library.

6. A permission control device, characterized in that: The authority control device comprises: An acquisition module is used to receive login information sent by a client, and acquire corresponding virtual group information and temporary authorization information according to the login information; specifically, acquire corresponding virtual group service rights based on the virtual group information, the virtual group service rights are in-group rights, and acquire authorized service rights based on the temporary authorization information, the authorized service rights are out-group rights; the acquisition module is also used to receive a temporary authorization request sent by the client, and acquire temporary authorization information in the temporary authorization request; associate the temporary authorization information with the service rights of the authorization object; A query module, used to query service data from a service library according to the virtual grouping information and the temporary authorization information, and mark the data operation authority corresponding to the service data; the query module is also used to query virtual grouping service data corresponding to the virtual grouping information from the service library based on the virtual grouping information; query authorized service data corresponding to the authorization information from the service library based on the temporary authorization information; save the virtual grouping service data and the authorized service data as service data; The merging module saves the business data and the data operation authority in correspondence as an authority data packet, and returns the authority data packet to the client.

7. A permission control device, characterized in that: The permission control device includes a processor, a memory, and a permission control program stored in the memory. When the permission control program is executed by the processor, the steps of the permission control method according to any one of claims 1 to 5 are implemented.

8. A computer storage medium, characterized in that: The computer storage medium stores a permission control program, and when the permission control program is executed by the processor, the steps of the permission control method according to any one of claims 1 to 5 are implemented.

Images