A role-based permission management method, device, equipment and medium

Abstract

The present invention discloses a method, device, equipment and medium for permission control based on roles, the method comprising obtaining a permission control rule set corresponding to the operation system according to an operation system identifier; generating a corresponding role for a rule in the permission control rule set; adding a corresponding relationship between a user identifier and a role corresponding to the user identifier to a user role allocation table according to a permission configuration instruction; obtaining a target role according to a target user identifier and the user role allocation table, and sending the target role to the operation system so that the operation system renders a menu according to the menu items in the target role, and controls pages in the menu according to the permission items in the target role. The present invention uses the concept of role as a transfer, realizes the decoupling between the user and the specific permission corresponding to the user, improves the permission control efficiency, and reduces the permission control cost.

Description

Technical Field

[0001] The present invention relates to the field of authority control, and in particular to a role-based authority control method, device, equipment and medium. Background Art

[0002] As the operating system becomes more complex, the types of business it can support are also gradually increasing. Operators related to various businesses may have to participate in the use of the operating system. However, an operator is only responsible for the operation of his or her related business. At this time, it is necessary to introduce an authority control mechanism to prevent business accidents caused by unauthorized operations or erroneous operations.

[0003] In the prior art, the menu contents that operators can manipulate can be controlled, so that when an operator of a certain operation system accesses the operation system, he can only obtain the menu list related to the business he is responsible for instead of all menus. However, this control technology has the following defects:

[0004] First, since there is no intermediate permission management link, permission management needs to be performed on each operator, which requires a lot of repetitive work and high maintenance costs.

[0005] Second, controlling user permissions only through menu content permission management involves certain potential risks, and the possibility of errors increases. If a user exceeds his or her authority and obtains an unauthorized access link, he or she can also perform corresponding operations.

[0006] Third, there is no separation of read and write permissions, which cannot meet the actual needs of only giving some users read-only permissions to some menus in complex scenarios and not being able to write data. Summary of the invention

[0007] In order to solve the technical problems that the prior art permission control is complex and the permission control cannot be accurate to read and write control, the embodiments of the present invention provide a role-based permission management method, device, equipment and medium.

[0008] In one aspect, the present invention provides a role-based permission management method, the method comprising:

[0009] Acquire a permission control rule set corresponding to the operation system according to the operation system identifier, wherein each element in the permission control rule set includes a menu rendering rule and a menu reading and writing rule;

[0010] Generate a corresponding role for a rule in the permission control rule set, wherein the role includes a role identifier and a permission control parameter corresponding to the role identifier, and the permission control parameter includes a menu item and a permission item;

[0011] In response to the permission configuration instruction directed to the operation system, adding the correspondence between the user identifier in the permission configuration instruction and the role corresponding to the user identifier to the user role allocation table according to the permission configuration instruction;

[0012] Obtain a permission verification instruction pointing to the operating system, the permission verification instruction including a target user identifier, obtain a target role based on the target user identifier and the user role allocation table, and send the target role to the operating system so that the operating system can render a menu based on the menu items in the target role, and manage the pages in the menu based on the permission items in the target role.

[0013] In another aspect, the present invention provides a role-based permission management method, the method comprising:

[0014] In response to a login instruction, obtaining a user identifier in the login instruction;

[0015] Generate an authority verification instruction according to the user identifier and the identifier of the operation system, and transmit the verification instruction request to the authority control server, so that the authority control server can query the user role allocation table corresponding to the operation system, query the role corresponding to the user identifier in the user role allocation table, and feed back the role to the operation system;

[0016] Obtaining permission control parameters corresponding to a target role in the roles, wherein the permission control parameters include menu items and permission items;

[0017] If the menu item is not empty, the page is rendered according to the menu item, and the read and write permissions for the page in the menu item are controlled according to the permission item.

[0018] On the other hand, the present invention provides a role-based permission management device, the device comprising:

[0019] A rule building module, used to obtain a permission control rule set corresponding to the operation system according to the operation system identifier, wherein each element in the permission control rule set includes a menu rendering rule and a menu reading and writing rule;

[0020] A role construction module, used to generate a corresponding role for a rule in the permission control rule set, wherein the role includes a role identifier and a permission control parameter corresponding to the role identifier, and the permission control parameter includes a menu item and a permission item;

[0021] a role configuration module, configured to respond to a permission configuration instruction directed to the operation system and add a corresponding relationship between a user identifier in the permission configuration instruction and a role corresponding to the user identifier to a user role allocation table according to the permission configuration instruction;

[0022] A role publishing module is used to obtain a permission verification instruction pointing to the operating system, wherein the permission verification instruction includes a target user identifier, obtain a target role based on the target user identifier and the user role allocation table, and send the target role to the operating system so that the operating system can render a menu based on the menu items in the target role and manage the pages in the menu based on the permission items in the target role.

[0023] On the other hand, the present invention provides a role-based permission management device, the device comprising:

[0024] A login module, configured to obtain a user identifier in response to a login instruction;

[0025] The permission verification module is used to generate a permission verification instruction according to the user identification and the identification of the operation system, and transmit the verification instruction request to the permission control server, so that the permission control server can query the user role allocation table corresponding to the operation system, query the role corresponding to the user identification in the user role allocation table, and feed back the role to the operation system;

[0026] A permission control acquisition module, used to obtain permission control parameters corresponding to a target role in the roles, wherein the permission control parameters include menu items and permission items;

[0027] The permission control module is used to render a page according to the menu item if the menu item is not empty, and to control the read and write permissions for the page in the menu item according to the permission item.

[0028] On the other hand, the present invention provides a device, characterized in that the device includes a processor and a memory, the memory storing at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to implement a role-based permission management method.

[0029] On the other hand, the present invention provides a computer storage medium, characterized in that the storage medium stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded by a processor and executed by a role-based permission management method.

[0030] The present invention provides a role-based permission management method, device, equipment and medium. The present invention centrally manages each operating system, assigns roles to each user who accesses the operating system, and manages the user's permissions according to the role. By using the concept of role as a transfer, the decoupling between the user and the specific permissions corresponding to the user is achieved, the efficiency of permission management is improved, and the cost of permission management is reduced. By dividing the permissions into rendering permissions and read-write access permissions for management, the purpose of precise management is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 It is a schematic diagram of the implementation environment provided by the present invention;

[0033] Figure 2 It is a flow chart of a role-based permission management method provided by the present invention;

[0034] Figure 3 It is a menu tree schematic diagram provided by the present invention;

[0035] Figure 4 It is a menu schematic diagram corresponding to the menu tree provided by the present invention;

[0036] Figure 5 It is a flowchart provided by the present invention before obtaining the authority control rule set corresponding to the operation system according to the operation system identifier;

[0037] Figure 6 is a schematic diagram of a first configuration interface provided by the present invention;

[0038] Figure 7 is a schematic diagram of a second configuration interface provided by the present invention;

[0039] Figure 8 It is a schematic diagram of the corresponding relationship between each permission control parameter and the user in the actual application of the role 1 and the role 2 provided by the present invention;

[0040] Fig. 9 The present invention provides a role flow chart corresponding to the rules in the permission control rule set;

[0041] Fig.10 It is a schematic diagram of a third configuration interface provided by the present invention;

[0042] Fig.11 It is a flow chart of a role-based permission management method provided by the present invention;

[0043] Fig.12 is a role switching flow chart provided by the present invention;

[0044] Fig.13 It is a schematic diagram of an implementation scenario provided by the present invention;

[0045] Fig.14 It is a block diagram of a role-based permission management and control device provided by the present invention;

[0046] Fig.15 It is a block diagram of a role-based permission management and control device provided by the present invention;

[0047] Fig.16 It is a schematic diagram of the hardware structure of a device provided by the present invention for implementing the method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0049] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0050] In order to make the purpose, technical solution and advantages disclosed in the embodiments of the present invention more clearly understood, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present invention and are not used to limit the embodiments of the present invention.

[0051] In order to implement a role-based permission management method disclosed in an embodiment of the present invention, an implementation environment thereof is provided in an embodiment of the present invention.

[0052] See also Figure 1 The implementation environment includes: at least one operating system 01, a permission management server 03 and at least one client 05.

[0053] The client 05 is connected in communication with the operation system 01. The client 05 operates its related business by accessing the operation system 01. The operation system 01 is connected in communication with the authority management server 03. The authority management server 03 is used to perform authority management on users accessing the operation system 01, and to feed back the authority management results to the operation system 01 so that the operation system 01 can render the access page for the users accessing the operation system 01 according to the authority management results, and provide authority control in the read and write dimensions.

[0054] The operation system 01 and the authority control server 03 may each include an independently operated server, or a distributed server, or a server cluster consisting of multiple servers.

[0055] The embodiment of the present invention provides a role-based permission management method, wherein the method uses the permission management server in the implementation environment as the implementation subject, such as Figure 2 As shown, including:

[0056] S101. Acquire a permission control rule set corresponding to the operation system according to the operation system identifier, wherein each element in the permission control rule set includes a menu rendering rule and a menu reading and writing rule.

[0057] Specifically, the permission control rule set and the operating system identifier can be in a one-to-one correspondence, and the permission control rule set includes at least one permission control rule, which records the access requirements of users who perform various businesses in the operating system to various menus in the operating system, and the read and write permission requirements of the users who perform various businesses for various menus in the operating system.

[0058] The menu tree corresponding to the operating system A is as follows Figure 3 As shown, it includes a root node (root), two branch nodes (s1, s2), branch node s1 includes two leaf nodes (s11, s12), and branch node s2 includes two leaf nodes (s21, s22). Each non-root node except the root node is a menu, and each leaf node corresponds to a page for executing a business function, that is, if the leaf node is allowed to be displayed, the page corresponding to the leaf node is also allowed to be displayed. The menu diagram corresponding to the menu tree is shown in Figure 4As shown, after the branch node s1 is expanded, its leaf nodes (s11, s12) can be seen. S11 and S12 each correspond to a page, which can be used to execute specific business functions. Similarly, after the branch node s2 is expanded, its leaf nodes (s21, s22) can be seen. S21 and S22 each correspond to a page, which can be used to execute specific business functions.

[0059] The menu rendering rule specifically describes the rendering rule of the user's menu. Only menus that are allowed to be rendered in the menu rendering rule can be seen by the user, and menus that are not allowed to be rendered in the menu rendering rule cannot be seen by the user. Since the user cannot see such menus, naturally, the content pointed to by such menus cannot be read or written. The menus that are allowed to be rendered in the menu rendering rule constitute a visual menu tree.

[0060] The menu read and write rules specifically describe the user's read and write permissions for pages corresponding to leaf menus in the visual menu tree.

[0061] In a possible embodiment, if Figure 5 As shown, before obtaining the permission control rule set corresponding to the operation system according to the operation system identifier, it also includes:

[0062] S1011. Respond to the operation system configuration instruction and obtain the user ID of the issuer of the operation system configuration instruction.

[0063] S1013. Determine whether the issuer of the operation system configuration instruction has the operation system configuration authority according to the user identifier of the issuer of the operation system configuration instruction.

[0064] S1015. If yes, render a first configuration interface, where the first configuration interface is used to configure basic information of the operating system.

[0065] Specifically, Figure 6 As shown, the basic information of the operating system may include the name of the operating system, description, whether it is sensitive, associated code and additional parameters.

[0066] S1017. In response to the basic information submission instruction, determine whether the basic information of the operating system pointed to by the basic information submission instruction is legal.

[0067] Specifically, a legitimacy check is performed in step S1017, and the legitimacy check includes checking whether required items are missing in the basic information of the operating system, and whether the operating system is repeatedly constructed.

[0068] S1019. If yes, render a second configuration interface, where the second configuration interface is used to configure the rules.

[0069] like Figure 7As shown, the configuration rules include configuration menu rendering rules and menu reading and writing rules. The configuration menu rendering rules are implemented by editing each node in the menu tree, and the configuration menu reading and writing rules are implemented by editing the permissions of each leaf node in the menu tree.

[0070] S10111. In response to a configuration rule submission instruction, the rule pointed to by the configuration rule submission instruction is verified. If the verification passes, the rule is added to the permission management rule set corresponding to the operation system.

[0071] S103. Generate a corresponding role for the rule in the permission control rule set, wherein the role includes a role identifier and a permission control parameter corresponding to the role identifier, and the permission control parameter includes a menu item and a permission item.

[0072] Specifically, the user identifier and the role identifier may be in a one-to-many relationship, that is, one user identifier may switch between multiple roles.

[0073] Specifically, the menu items are a menu tree composed of menus accessible to the role, and the permission items record the read and write access permissions of the child nodes of the menu tree.

[0074] Taking the operating system above as an example, it corresponds to role 1 and role 2.

[0075] The leaf nodes that role 1 can access are s11 and s21, and it can perform read and write operations on the pages corresponding to s11 and s21 respectively. Its menu items include s1, s2, s11 and s21, and the permission items include s11(w) and s21(w), where w means write. The permission item s11(w) indicates that role 1 has read and write permissions for the page corresponding to menu s11, and the permission item s21(w) indicates that role 1 has read and write permissions for the page corresponding to menu s21.

[0076] The leaf nodes that role 2 can access are s12 and s22, and they can perform read-only operations on the pages corresponding to s12 and s22 respectively. The menu items include s1, s2, s12 and s22, and the permission items include s12(r) and s22(r), where r represents read. The permission item s12(r) indicates that role 2 has read-only permission for the page corresponding to menu s12, and the permission item s22(r) indicates that role 2 has read-only permission for the page corresponding to menu s22.

[0077] like Figure 8As shown, it shows a schematic diagram of the corresponding relationship between each permission control parameter and the user in the actual application of role 1 and role 2. A certain operator (user) has two roles. The leaf nodes that role 1 can access are s11 and s21, and the pages corresponding to s11 and s21 are read and written. Then its menu items include s1, s2, s11 and s21, and the permission items include s11 (w) and s21 (w); the leaf nodes that role 2 can access are s12 and s22, and the pages corresponding to s12 and s22 are read-only operations. Then its menu items include s1, s2, s12 and s22, and the permission items include s12 (r) and s22 (r).

[0078] In a feasible embodiment, the corresponding roles are generated for the rules in the permission control rule set, such as Fig. 9 As shown, including:

[0079] S1031. Respond to the role generation instruction and obtain the user ID of the person who issued the role generation instruction.

[0080] S1033. Determine whether the issuer of the role generation instruction has the role generation authority according to the user identification of the issuer of the role generation instruction.

[0081] S1035. If yes, render a third configuration interface, where the third configuration interface is used to configure role information.

[0082] Specifically, Fig.10 As shown, the role information includes a role name and a role description.

[0083] S1037. In response to the role information submission instruction, determine whether the role information pointed to by the role information submission instruction is legal.

[0084] Specifically, a legitimacy check is performed in step S1037, and the legitimacy check includes checking whether required items are missing in the role information and whether the role information is repeatedly constructed.

[0085] S1039. If yes, generate a role according to the role information, and render a fourth configuration interface, wherein the fourth configuration interface is used to associate permission control parameters with the role.

[0086] S10311. In response to the role association instruction, associate the role with its corresponding permission management parameter.

[0087] S105. In response to the permission configuration instruction directed to the operation system, add the correspondence between the user identifier in the permission configuration instruction and the role corresponding to the user identifier to the user role allocation table according to the permission configuration instruction.

[0088] Specifically, the adding the correspondence between the user identifier in the authority configuration instruction and the role corresponding to the user identifier to the user role allocation table according to the authority configuration instruction includes:

[0089] S1051. Obtain the user ID of the publisher of the permission configuration instruction.

[0090] S1053. Determine whether the publisher has configuration authority based on the user identifier.

[0091] S1055. If yes, then add the correspondence between the user identifier in the permission configuration instruction and the role corresponding to the user identifier to the user role allocation table according to the permission configuration instruction.

[0092] S107. Obtain a permission verification instruction pointing to the operating system, wherein the permission verification instruction includes a target user identifier, obtain a target role based on the target user identifier and the user role allocation table, and send the target role to the operating system so that the operating system can render a menu based on the menu items in the target role, and manage the pages in the menu based on the permission items in the target role.

[0093] The embodiment of the present invention discloses a role-based permission management method, which centrally manages each operation system, assigns roles to each user who accesses the operation system, and manages the user's permissions according to the role. By using the concept of role as a transfer, the decoupling between the user and the specific permission corresponding to the user is achieved, the permission management efficiency is improved, and the permission management cost is reduced. By dividing the permission into two parts, rendering permission and read-write access permission, the purpose of precise management is achieved.

[0094] The embodiment of the present invention provides a role-based permission management method, the method takes the operating system in the implementation environment as the implementation subject, such as Fig.11 As shown, including:

[0095] S201. In response to a login instruction, obtain a user identifier in the login instruction.

[0096] Specifically, the method further includes the step of verifying the login instruction. If the verification passes, the user identifier in the login instruction is obtained.

[0097] S203. Generate an authorization verification instruction based on the user identifier and the operating system identifier, and transmit the verification instruction request to the authorization control server, so that the authorization control server can query the user role allocation table corresponding to the operating system, query the role corresponding to the user identifier in the user role allocation table, and feed back the role to the operating system.

[0098] Specifically, if there is only one role corresponding to the user identifier, then the role is the target role.

[0099] Furthermore, in a preferred embodiment, if the user identifier corresponds to more than one role, the method further includes:

[0100] S2031. Rendering a role selection configuration page according to the acquired roles, wherein the role selection configuration page is used to render all roles corresponding to the user identification.

[0101] S2033. Obtain a role selection instruction, wherein the role selection instruction includes a target role.

[0102] S205. Obtain permission control parameters corresponding to a target role in the roles, wherein the permission control parameters include menu items and permission items.

[0103] S207. If the menu item is not empty, render the page according to the menu item, and control the read and write permissions for the page in the menu item according to the permission item.

[0104] Specifically, if the menu item is empty, the user is prompted that he does not have the authority to access the operating system.

[0105] Further, in a preferred embodiment, Fig.12 As shown, it also includes:

[0106] S301. Obtain a role switching instruction, wherein the role switching instruction includes a target role.

[0107] S303. Obtain the permission control parameters corresponding to the target role, where the permission control parameters include menu items and permission items.

[0108] S305. If the menu item is not empty, render the page according to the menu item, and control the read and write permissions for the page in the menu item according to the permission item.

[0109] Specifically, if the menu item is empty, the user is prompted that he does not have the authority to access the operating system.

[0110] like Fig.13 As shown, it shows a schematic diagram of an implementation scenario of an embodiment of the present invention, in which the implementation scenario includes:

[0111] Operations staff: staff who access, maintain or manage the operations system.

[0112] Authority control personnel: personnel who access, maintain or manage the authority control server.

[0113] The operation personnel access the operation system, and the operation system obtains the user's role and corresponding permission control parameters from the permission control server, and performs page rendering and read-write control according to the permission control parameters.

[0114] The permission control server can manage permissions for multiple operating systems. In a specific embodiment, the SDK pointed to by the permission server can be integrated during the development of the operating system, so that the centralized permission control service provided by the permission server can be quickly used. Software Development Kit (SDK) is generally a collection of development tools used by software engineers to build application software for specific software packages, software frameworks, hardware platforms, operating systems, etc.

[0115] The embodiment of the present invention discloses a role-based permission management method, which avoids repeated authorization of each user by the operation system, realizes the decoupling of operation service and permission management, and allows operation personnel to concentrate on operating within their scope of responsibility without worrying about overstepping their authority or operating incorrectly.

[0116] On the other hand, the present invention provides a role-based permission management device, such as Fig.14 As shown, the device comprises:

[0117] A rule building module 401 is used to obtain a permission control rule set corresponding to the operation system according to the operation system identifier, wherein each element in the permission control rule set includes a menu rendering rule and a menu reading and writing rule;

[0118] A role construction module 403, for generating a corresponding role for a rule in the permission control rule set, wherein the role includes a role identifier and a permission control parameter corresponding to the role identifier, wherein the permission control parameter includes a menu item and a permission item;

[0119] A role configuration module 405, for responding to a permission configuration instruction directed to the operation system, and adding a correspondence between a user identifier in the permission configuration instruction and a role corresponding to the user identifier to a user role allocation table according to the permission configuration instruction;

[0120] The role publishing module 407 is used to obtain a permission verification instruction pointing to the operating system, the permission verification instruction includes a target user identifier, obtain the target role based on the target user identifier and the user role allocation table, and send the target role to the operating system so that the operating system can render a menu according to the menu items in the target role, and manage the pages in the menu according to the permission items in the target role.

[0121] Specifically, the role-based permission management device and method embodiments described in the embodiments of the present invention are based on the same inventive concept.

[0122] On the other hand, the present invention provides a role-based permission management device, such as Fig.15 As shown, the device comprises:

[0123] A login module 501, configured to obtain a user identifier in response to a login instruction;

[0124] The permission verification module 503 is used to generate a permission verification instruction according to the user identifier and the identifier of the operation system, and transmit the verification instruction request to the permission control server, so that the permission control server can query the user role allocation table corresponding to the operation system, query the role corresponding to the user identifier in the user role allocation table, and feed back the role to the operation system;

[0125] The permission control acquisition module 505 is used to obtain the permission control parameters corresponding to the target role in the roles, and the permission control parameters include menu items and permission items;

[0126] The permission control module 507 is used to render a page according to the menu item if the menu item is not empty, and control the read and write permissions for the page in the menu item according to the permission item.

[0127] Specifically, the role-based permission management device and method embodiments described in the embodiments of the present invention are based on the same inventive concept.

[0128] An embodiment of the present invention further provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded by a processor and executing a role-based permission management method described in an embodiment of the present invention, and the details are not repeated here.

[0129] Further, Fig.16 A schematic diagram of the hardware structure of a device for implementing the method provided by an embodiment of the present invention is shown, and the device may participate in constituting or include the apparatus provided by an embodiment of the present invention. Fig.16As shown, the device 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Fig.16 The structure shown is for illustration only and does not limit the structure of the electronic device. Fig.16 More or fewer components as shown, or with Fig.16 Different configurations are shown.

[0130] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the device 10 (or mobile device). As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0131] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, to implement the above-mentioned role-based permission management method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the device 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0132] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the device 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0133] The display may be, for example, a touch screen liquid crystal display (LCD) that may enable a user to interact with a user interface of device 10 (or mobile device).

[0134] It should be noted that the sequence of the embodiments of the present invention described above is for description only and does not represent the advantages and disadvantages of the embodiments. The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0135] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and server embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0136] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0137] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A role-based permission management method, characterized in that: The method comprises: The authority control server obtains the authority control rule set corresponding to the operation system according to the operation system identifier, and each element in the authority control rule set includes menu rendering rules and menu reading and writing rules. The menus allowed to be rendered in the menu rendering rules constitute a visual menu tree, and the menu tree includes a root node, branch nodes and leaf nodes. The branch nodes and the leaf nodes are menus, and each leaf node corresponds to a page that executes a business function; the menu reading and writing rules describe the page reading and writing permissions corresponding to the leaf node; The permission control server generates a corresponding role for a rule in the permission control rule set, wherein the role includes a role identifier and a permission control parameter corresponding to the role identifier, wherein the permission control parameter includes a menu item and a permission item, wherein the menu item is a menu tree corresponding to the role, and the permission item is a read and write access right for a leaf node of the menu tree corresponding to the role; The authority control server responds to the authority configuration instruction directed to the operation system, and according to the authority configuration instruction, adds the correspondence between the user identifier in the authority configuration instruction and the role corresponding to the user identifier to the user role allocation table; The permission control server obtains a permission verification instruction pointing to the operating system, wherein the permission verification instruction includes a target user identifier, obtains a target role based on the target user identifier and the user role allocation table, and sends the target role to the operating system; so that the operating system can render a menu based on the menu items in the target role, and control the pages in the menu based on the permission items in the target role.

2. The method according to claim 1, characterized in that Before obtaining the permission control rule set corresponding to the operation system according to the operation system identifier, the method further includes: Respond to the operation system configuration instruction and obtain the user ID of the issuer of the operation system configuration instruction; Determining whether the issuer of the operation system configuration instruction has the operation system configuration authority according to the user identifier of the issuer of the operation system configuration instruction; If yes, then render a first configuration interface, where the first configuration interface is used to configure basic information of the operating system; In response to a basic information submission instruction, determining whether the basic information of the operating system pointed to by the basic information submission instruction is legal; If yes, then render a second configuration interface, where the second configuration interface is used to configure the rule; In response to the configuration rule submission instruction, the rule pointed to by the configuration rule submission instruction is verified, and if the verification passes, the rule is added to the permission management rule set corresponding to the operation system.

3. The method according to claim 1, characterized in that The generating a corresponding role for the rule in the permission control rule set includes: Respond to the role generation instruction and obtain the user ID of the issuer of the role generation instruction; Determining whether the issuer of the role generation instruction has the role generation authority according to the user identification of the issuer of the role generation instruction; If yes, then render a third configuration interface, wherein the third configuration interface is used to configure the role information; In response to a role information submission instruction, determining whether the role information pointed to by the role information submission instruction is legal; If so, a role is generated according to the role information, and a fourth configuration interface is rendered, wherein the fourth configuration interface is used to associate permission control parameters with the role; In response to the role association instruction, the role and its corresponding permission control parameter are associated.

4. The method according to claim 1, characterized in that: The adding, according to the permission configuration instruction, the corresponding relationship between the user identifier in the permission configuration instruction and the role corresponding to the user identifier to the user role allocation table includes: Obtaining the user ID of the publisher of the permission configuration instruction; Determining whether the publisher has configuration authority according to the user identifier; If so, the corresponding relationship between the user identifier in the permission configuration instruction and the role corresponding to the user identifier is added to the user role allocation table according to the permission configuration instruction.

5. A role-based permission management method, characterized in that: Applied to an operating system, the method comprises: In response to a login instruction, obtaining a user identifier in the login instruction; Generate an authority verification instruction according to the user identifier and the identifier of the operating system, and transmit the verification instruction request to the authority control server, so that the authority control server can query the user role allocation table corresponding to the operating system, query the role corresponding to the user identifier in the user role allocation table, and feed back the role to the operating system; Obtaining permission control parameters corresponding to a target role in the roles, wherein the permission control parameters include menu items and permission items; If the menu item is not empty, the page is rendered according to the menu item, and the read and write permissions for the page in the menu item are controlled according to the permission item; The authority control server is used to perform the following operations: Obtaining a permission control rule set corresponding to the operation system, wherein each element in the permission control rule set includes a menu rendering rule and a menu read-write rule. The menus allowed to be rendered in the menu rendering rule constitute a visual menu tree. The menu tree includes a root node, a branch node, and a leaf node. The branch node and the leaf node are both menus, and each leaf node corresponds to a page that executes a business function. The menu read-write rule describes the page read-write permission corresponding to the leaf node. Generate a corresponding role for the rule in the permission control rule set, the role including a role identifier and a permission control parameter corresponding to the role identifier, the permission control parameter including a menu item and a permission item, the menu item being a menu tree corresponding to the role, and the permission item being a read and write access right of a leaf node of the menu tree corresponding to the role; In response to the authority configuration instruction directed to the operation system, the corresponding relationship between the user identifier in the authority configuration instruction and the role corresponding to the user identifier is added to the user role allocation table according to the authority configuration instruction.

6. The method according to claim 5, characterized in that: If there is only one role corresponding to the user identifier, then the role is the target role; If the user identifier corresponds to more than one role, rendering a role selection configuration page according to the acquired roles, the role selection configuration page being used to render all roles corresponding to the user identifier; A role selection instruction is obtained, wherein the role selection instruction includes a target role.

7. A role-based permission management and control device, characterized in that: The device comprises: A rule construction module is used for the permission control server to obtain the permission control rule set corresponding to the operation system according to the operation system identifier, wherein each element in the permission control rule set includes menu rendering rules and menu reading and writing rules, and the menus allowed to be rendered in the menu rendering rules constitute a visual menu tree, and the menu tree includes a root node, branch nodes and leaf nodes, and the branch nodes and the leaf nodes are menus, and each leaf node corresponds to a page that executes a business function; the menu reading and writing rules describe the page reading and writing permissions corresponding to the leaf node; A role construction module, used for the permission control server to generate a corresponding role for a rule in the permission control rule set, wherein the role includes a role identifier and a permission control parameter corresponding to the role identifier, wherein the permission control parameter includes a menu item and a permission item, wherein the menu item is a menu tree corresponding to the role, and the permission item is a read and write access right of a leaf node of the menu tree corresponding to the role; A role configuration module, configured for the authority control server to respond to the authority configuration instruction directed to the operation system, and to add the corresponding relationship between the user identifier in the authority configuration instruction and the role corresponding to the user identifier to the user role allocation table according to the authority configuration instruction; A role publishing module is used for the permission control server to obtain a permission verification instruction pointing to the operating system, wherein the permission verification instruction includes a target user identifier, obtain a target role based on the target user identifier and the user role allocation table, and send the target role to the operating system; so that the operating system can render a menu according to the menu items in the target role and control the pages in the menu according to the permission items in the target role.

8. A role-based permission management and control device, characterized in that: Applied to an operating system, the device comprises: A login module, configured to obtain a user identifier in response to a login instruction; The permission verification module is used to generate a permission verification instruction according to the user identifier and the identifier of the operation system, and transmit the verification instruction request to the permission control server, so that the permission control server can query the user role allocation table corresponding to the operation system, query the role corresponding to the user identifier in the user role allocation table, and feed back the role to the operation system; A permission control acquisition module, used to obtain permission control parameters corresponding to a target role in the roles, wherein the permission control parameters include menu items and permission items; A permission control module, used for rendering a page according to the menu item if the menu item is not empty, and controlling the read and write permissions for the page in the menu item according to the permission item; The authority control server is used to perform the following operations: Obtaining a permission control rule set corresponding to the operation system, wherein each element in the permission control rule set includes a menu rendering rule and a menu read-write rule. The menus allowed to be rendered in the menu rendering rule constitute a visual menu tree. The menu tree includes a root node, a branch node, and a leaf node. The branch node and the leaf node are both menus, and each leaf node corresponds to a page that executes a business function. The menu read-write rule describes the page read-write permission corresponding to the leaf node. Generate a corresponding role for the rule in the permission control rule set, the role including a role identifier and a permission control parameter corresponding to the role identifier, the permission control parameter including a menu item and a permission item, the menu item being a menu tree corresponding to the role, and the permission item being a read and write access right of a leaf node of the menu tree corresponding to the role; In response to the authority configuration instruction directed to the operation system, the corresponding relationship between the user identifier in the authority configuration instruction and the role corresponding to the user identifier is added to the user role allocation table according to the authority configuration instruction.

9. A device, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement a role-based permission management method as described in any one of claims 1-4 or a role-based permission management method as described in any one of claims 5-6.

10. A computer storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor as a role-based permission management method as described in any one of claims 1-4 or a role-based permission management method as described in any one of claims 5-6.

Images