Resource permission control method, system, device and storage medium based on permission graph

Abstract

The present invention discloses a resource permission control method, system, device and storage medium based on permission graph, and the above method includes: permission graph forming step: in the knowledge graph within the organization, according to the permission rules owned by the user, the owner entities of all data resource permissions that the user can reach are combined into the user's permission graph; permission graph caching step: putting the permission graph into the cache and specifying the expiration time of the permission graph; permission judgment step: when the user accesses the data resource, check whether there is a permission graph corresponding to the user in the cache list, if so, return to the permission graph for permission judgment; if not, return to the permission graph forming step. It can greatly speed up the speed of users accessing data resources, and is suitable for flexible and changeable organizational structures and complex permission control scenarios.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a resource permission control method, system, device and storage medium based on a permission graph. Background Art

[0002] Permission control is generally divided into two categories: functional permissions and data permissions. Functional permissions can generally be used to make a rough distinction between functions by matching functional paths, while data permissions are distinguished in a fine-grained manner based on the owner of the data resources.

[0003] The knowledge graph is essentially an associative network knowledge expression based on a graph model. The knowledge graph abstracts entities as vertices and the relationships between entities as edges. It models and describes knowledge in a structured form and visualizes knowledge. The knowledge graph is the application direction with the closest association and the widest range of scenarios for graph databases. The knowledge graph uses the graph database as a storage engine to intelligently process massive amounts of information, forming a large-scale knowledge base and supporting business applications.

[0004] At present, the design of permission system generally uses RBAC (Role-Based Access Control) role-based access control system, such as RBAC-0 model, RBAC-1 model, RBAC-2 model. In this system design, permissions are associated with roles, and users obtain permissions of these roles by becoming members of appropriate roles.

[0005] However, the RBAC system does not have good support for permission control of data resources. Generally, it only has basic data resource permission control such as inheritance between superiors and subordinates and visibility at the same level. It cannot solve the data permission problems caused by the changeable and unstable organizational structures such as virtual organizations, working groups, and project organizations in today's enterprises. Summary of the invention

[0006] In view of the above-mentioned technical problem that the display of permission control on data resources has limitations, the present invention proposes a resource permission control method, system, device and storage medium based on a permission graph.

[0007] In a first aspect, an embodiment of the present application provides a resource permission control method based on a permission graph, comprising:

[0008] Permission graph formation step: In the knowledge graph within the organization, according to the permission rules of the user, all the owner entities of the data resource permissions that the user can access are combined into the permission graph of the user;

[0009] Permission graph caching step: putting the permission graph into a cache and specifying an expiration time of the permission graph;

[0010] Permission determination step: when the user accesses a data resource, check whether the permission graph corresponding to the user exists in the cache list. If so, return to the permission graph for permission determination; if not, return to the permission graph forming step.

[0011] In the above-mentioned resource permission control method, the permission judgment step includes: judging whether the entity that owns the data resource is in the permission graph corresponding to the user; if so, the user has the permission to access the data resource; if not, the user does not have the permission to access the data resource.

[0012] The resource authority control method further includes:

[0013] Data resource control step: manage the data resource as an entity and then enter the knowledge graph; or; add a reference relationship to the entity through the data resource list.

[0014] The resource authority control method further includes:

[0015] Permission graph updating step: when an entity or edge in the knowledge graph changes, the change of the entity or edge is propagated to the user entity node according to the path specified by the permission rule, and the permission graph corresponding to the user entity node is deleted.

[0016] In a second aspect, an embodiment of the present application provides a resource permission control system based on a permission graph, including:

[0017] Permission graph forming unit: in the knowledge graph within the organization, according to the permission rules of the user, the owner entities of all data resource permissions that the user can access are combined into the permission graph of the user;

[0018] A permission graph cache unit: puts the permission graph into a cache and specifies an expiration time of the permission graph;

[0019] Permission judgment unit: when the user accesses the data resource, checks whether the permission graph corresponding to the user exists in the cache list, and if so, returns the permission graph for permission judgment; if not, returns to the permission graph forming unit.

[0020] The above-mentioned resource authority control system, wherein the authority judgment unit includes: judging whether the entity owning the data resource is in the authority graph corresponding to the user, if so, the user has the authority to access the data resource, if not, the user does not have the authority to access the data resource.

[0021] The resource authority control system mentioned above further includes:

[0022] Data resource control unit: manage the data resource as an entity and then enter the knowledge graph; or; add a reference relationship to the entity through the data resource list.

[0023] The resource authority control system mentioned above further includes:

[0024] Permission graph updating unit: When an entity or edge in the knowledge graph changes, the change of the entity or edge is propagated to the user entity node according to the path specified by the permission rule, and the permission graph corresponding to the user entity node is deleted.

[0025] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the resource permission control method based on the permission graph as described in the first aspect above is implemented.

[0026] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the resource permission control method based on the permission graph as described in the first aspect above.

[0027] Compared with the prior art, the advantages and positive effects of the present invention are:

[0028] 1. The present invention proposes a data resource control method based on a permission graph. The knowledge graph technology can be used to perform very precise control over the ownership and permissions of data resources. The permissions of data resources can be judged and controlled based on organizational hierarchy, personnel relationships, and even the relationships of any specified entities. Flexible data resource permission configuration and use can be achieved, and it is suitable for flexible and changeable organizational structures and complex permission control scenarios.

[0029] 2. The present invention proposes to speed up the judgment of data resource permissions by caching permission graphs, which can greatly speed up the speed of users accessing data resources and set an expiration time to ensure that the cached permission graph is updated on time; when the entities, edges and other contents in the knowledge graph change, the expired cached permission graph can be deleted, allowing the user to reconstruct the permission graph the next time he visits, thereby correctly judging the data resource permissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of the steps of a resource permission control method based on a permission graph provided by the present invention;

[0031] Figure 2 A schematic diagram of the knowledge graph within an organization provided by the present invention;

[0032] Figure 3A schematic diagram of controlling data resources by entering a knowledge graph provided by the present invention;

[0033] Figure 4 A schematic diagram of realizing data resource control without entering the knowledge graph provided by the present invention;

[0034] Figure 5 A framework diagram of a resource authority control system based on an authority graph provided by the present invention;

[0035] Figure 6 A framework diagram of a computer device according to an embodiment of the present application.

[0036] Wherein, the accompanying drawings are marked as follows:

[0037] 1. Data resource control unit; 2. Permission map forming unit; 3. Permission map cache unit; 4. Permission judgment unit; 5. Permission map update unit; 81. Processor; 82. Memory; 83. Communication interface; 80. Bus. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0039] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as the content disclosed in this application is insufficient.

[0040] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0041] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0042] The present invention is described in detail below in conjunction with the various embodiments shown in the accompanying drawings, but it should be noted that these embodiments are not limitations of the present invention, and any equivalent transformations or substitutions in functions, methods, or structures made by ordinary technicians in the field based on these embodiments are all within the scope of protection of the present invention.

[0043] Before describing in detail various embodiments of the present invention, the core inventive concept of the present invention is summarized and described in detail through the following several embodiments.

[0044] The present invention utilizes knowledge graph technology and proposes two modes, namely, entering the graph and not entering the graph, to control data resource permissions, and proposes a method for judging the user's data resource permissions by generating a permission graph cache and using the permission graph.

[0045] Embodiment 1:

[0046] Figure 1 The present invention provides a method for controlling resource permissions based on a permission graph. Figure 1 As shown, this embodiment discloses a specific implementation method of a resource permission control method based on a permission graph (hereinafter referred to as "method").

[0047] Specifically, the method disclosed in this embodiment mainly includes the following steps:

[0048] Step S1: In the knowledge graph within the organization, according to the permission rules of the user, the owner entities of all data resource permissions that the user can access are combined into the permission graph of the user;

[0049] Among them, the data resources can be managed as entities and then enter the knowledge graph; or; a reference relationship to the entity can be added through a data resource list.

[0050] Step S2: putting the permission graph into a cache and specifying an expiration time of the permission graph;

[0051] Step S3: When the user accesses a data resource, check whether the permission graph corresponding to the user exists in the cache list. If so, return to the permission graph to perform permission judgment; if not, return to step S1.

[0052] Wherein, step S3 includes: determining whether the entity that owns the data resource is in the permission graph corresponding to the user, if so, the user has the permission to access the data resource, if not, the user does not have the permission to access the data resource.

[0053] Specifically, when an entity or edge in the knowledge graph changes, the change of the entity or the edge is propagated to the user entity node according to the path specified by the permission rule, and the permission graph corresponding to the user entity node is deleted.

[0054] The following, combined Figure 2 , Figure 3 , Figure 4 The specific application process of this method is as follows:

[0055] like Figure 2 As shown, Figure 2 It is a knowledge graph within an organization, including entities and their relationships. Based on such an entity relationship knowledge graph within the organization, there are two ways to control data resources:

[0056] One way is to manage data as one or more types of entities and then enter the knowledge graph, and clearly use edges to represent the relationship between data resource entities and other entities, such as Figure 3 As shown;

[0057] Another way is not to create data resource entities in the knowledge graph, but to add reference relationships to entities in the data resource list, such as Figure 4 This resource control method that is not shown in the figure can reduce the storage amount.

[0058] The method of granting permissions to data resources can be defined in the knowledge graph as a path that authorizes specified points and edges.

[0059] For example, an employee's supervisor has the employee's data resource permissions:

[0060] grant permission to gV(resource).outE(“own”).out().hasLabel(“employee”).outE(“leader”).inV()

[0061] Employees in a project-related group have data resource permissions for all groups in the project:

[0062] grant permission to gV(resource).outE("owner").out().hasLabel("group").outE("relation").inV().hasLabel("project").outE("relation").inV().hasLabel("group").outE("hasMember").inV()

[0063] A typical data resource permission control scenario is to determine whether a user has permission to a specified data resource.

[0064] In such Figure 3 In the first solution shown, it can be converted to: in a graph, find whether there is a path with specified conditions between a point and another point, where the authorization of each data resource is converted into a path judgment with specified conditions between two points. If there is a path between the two points, it means that the user has permission to the data resource. If there is no path between the two points under all data resource authorization conditions, it means that the user does not have permission to the data resource.

[0065] like Figure 4 In the second solution shown, the data resource can be added to the graph as a temporary entity, and the method of the first solution is used to find out whether there is a path between the temporary entity point and the user point.

[0066] Real-time data resource permission judgment requires a query similar to graph traversal, which is time-consuming. Considering that user organization, project and other data are relatively stable, a user permission graph cache can be generated to speed up the judgment of permissions. The user permission graph cache method is as follows:

[0067] When a user accesses a data resource, the cache list is checked. If there is a cached permission map, the cached permission map is directly returned for permission judgment: whether the entity that owns the data resource is in the user's cached permission map. If so, it means that the user has permission to access, otherwise it does not have permission to access.

[0068] If there is no cached permission graph, for a certain user, all permission rules owned by the user, that is, the graph permission path, are used to reach all permission owner entities that the user can reach (excluding data resource entities), which may include employees, projects, groups and other entities, to form the user's permission graph.

[0069] Put the permission map corresponding to this user into the cache and specify the expiration time of the user's permission map to prevent the cache from not being updated.

[0070] When an entity or edge in the knowledge graph changes, it is necessary to scan all data permission rules in the system, propagate the change of this entity or edge to all affected user entity nodes through the paths specified by these data permission rules, and delete the permission graph cache of the corresponding user. If a large number of entities or edges need to change, when performing batch changes, you can first delete the permission graph cache of all users, and then perform batch entity and edge changes.

[0071] Through this caching method, the system maintains a cached permission graph for users who frequently access the system, which can greatly speed up the speed at which users access data resources. When the entities, edges, and other contents in the knowledge graph change, the expired cached permission graph can be deleted, allowing the user to reconstruct the permission graph the next time they visit, thereby correctly judging the data resource permissions.

[0072] The above caching method can speed up the judgment of data resource permissions, improve system performance, and achieve flexible data resource permission configuration and use, which is suitable for flexible and changeable organizational structures and complex permission control scenarios.

[0073] Embodiment 2:

[0074] In combination with a resource permission control method based on a permission graph disclosed in Example 1, this embodiment discloses a specific implementation example of a resource permission control system based on a permission graph (hereinafter referred to as "system").

[0075] Reference Figure 5 As shown, the system comprises:

[0076] Data resource control unit 1: manages data resources as entities and then enters the knowledge graph; or; adds reference relationships to entities through the data resource list;

[0077] Permission graph forming unit 2: in the knowledge graph within the organization, according to the permission rules owned by the user, the owner entities of all data resource permissions that the user can access are combined into the permission graph of the user;

[0078] Permission graph cache unit 3: puts the permission graph into the cache and specifies the expiration time of the permission graph;

[0079] Permission determination unit 4: when the user accesses the data resource, checks whether the permission graph corresponding to the user exists in the cache list, and if so, returns to the permission graph for permission determination; if not, returns to the permission graph forming unit 2;

[0080] Specifically, the authority judgment unit 4 includes: judging whether the entity owning the data resource is in the authority graph corresponding to the user, if so, the user has the authority to access the data resource, if not, the user does not have the authority to access the data resource.

[0081] Permission graph updating unit 5: When an entity or edge in the knowledge graph changes, the change of the entity or edge is propagated to the user entity node according to the path specified by the permission rule, and the permission graph corresponding to the user entity node is deleted.

[0082] For the technical solutions of the resource permission control system based on permission graph disclosed in this embodiment and the resource permission control method based on permission graph disclosed in Embodiment 1, please refer to Embodiment 1 and will not be repeated here.

[0083] Embodiment three:

[0084] Combination Figure 6 As shown, this embodiment discloses a specific implementation of a computer device. The computer device may include a processor 81 and a memory 82 storing computer program instructions.

[0085] Specifically, the processor 81 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0086] Among them, the memory 82 may include a large-capacity memory for data or instructions. By way of example and not limitation, the memory 82 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 82 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 82 may be inside or outside the data processing device. In a specific embodiment, the memory 82 is a non-volatile memory. In a specific embodiment, the memory 82 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (Programmable Read-Only Memory, PROM for short), an erasable PROM (Erasable ProgrammableRead-Only Memory, EPROM for short), an electrically erasable PROM (Electrically Erasable ProgrammableRead-Only Memory, EEPROM for short), an electrically alterable ROM (Electrically Alterable Read-Only Memory, EAROM for short) or a flash memory (FLASH) or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data output dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0087] The memory 82 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 81 .

[0088] The processor 81 implements any one of the resource authority control methods in the above embodiments by reading and executing computer program instructions stored in the memory 82 .

[0089] In some of these embodiments, the computer device may further include a communication interface 83 and a bus 80. Figure 6 As shown, the processor 81, the memory 82, and the communication interface 83 are connected via a bus 80 and communicate with each other.

[0090] The communication interface 83 is used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication port 83 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0091] The bus 80 includes hardware, software or both, and couples the components of the computer device to each other. The bus 80 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 80 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 80 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0092] In addition, in combination with the resource permission control method in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the resource permission control methods in the above embodiment is implemented.

[0093] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A resource permission control method based on permission graph, characterized in that: include: Permission graph formation step: In the knowledge graph within the organization, according to the permission rules of the user, all the owner entities of the data resource permissions that the user can access are combined into the permission graph of the user; Permission graph caching step: putting the permission graph into a cache and specifying an expiration time of the permission graph; Permission determination step: when the user accesses a data resource, checking whether the permission graph corresponding to the user exists in the cache list, and if so, returning the permission graph to perform permission determination; If not, return to the permission graph forming step; Determine whether the entity that owns the data resource is in the permission graph corresponding to the user. If so, determine whether there is a path with specified conditions between the nodes in the permission graph, where the specified condition is whether there is a path between the entity node of the data resource and the user node under the data resource authorization condition. If there is a path between the entity node of the data resource and the user node, the user has the right to access the data resource. If there is no path with specified conditions between the nodes, the user does not have the right to access the data resource. If not, add the entity of the data resource to the permission graph as a temporary entity, and determine whether there is a path between the temporary entity node of the data resource and the user node to determine whether the user has the right to access the data resource.

2. The resource authority control method according to claim 1, characterized in that: Also includes: Data resource control step: managing the data resource as an entity and then entering the knowledge graph; Or; add a reference relationship to the entity through the data resource list.

3. The resource authority control method according to claim 1, characterized in that: Also includes: Permission graph updating step: when an entity or edge in the knowledge graph changes, the change of the entity or edge is propagated to the user entity node according to the path specified by the permission rule, and the permission graph corresponding to the user entity node is deleted.

4. A resource permission control system based on permission graph, characterized in that: include: Permission graph forming unit: in the knowledge graph within the organization, according to the permission rules of the user, the owner entities of all data resource permissions that the user can access are combined into the permission graph of the user; A permission graph cache unit: puts the permission graph into a cache and specifies an expiration time of the permission graph; Permission judgment unit: when the user accesses the data resource, checking whether the permission graph corresponding to the user exists in the cache list, and if so, returning the permission graph to perform permission judgment; If not, returning to the permission graph forming unit; Determine whether the entity that owns the data resource is in the permission graph corresponding to the user. If so, determine whether there is a path with specified conditions between the nodes in the permission graph, where the specified condition is whether there is a path between the entity node of the data resource and the user node under the data resource authorization condition. If there is a path between the entity node of the data resource and the user node, the user has the right to access the data resource. If there is no path with specified conditions between the nodes, the user does not have the right to access the data resource. If not, add the entity of the data resource to the permission graph as a temporary entity, and determine whether there is a path between the temporary entity node of the data resource and the user node to determine whether the user has the right to access the data resource.

5. The resource authority control system according to claim 4, characterized in that: Also includes: Data resource control unit: manages the data resource as an entity and then enters the knowledge graph; Or; add a reference relationship to the entity through the data resource list.

6. The resource authority control system according to claim 4, characterized in that: Also includes: Permission graph updating unit: When an entity or edge in the knowledge graph changes, the change of the entity or edge is propagated to the user entity node according to the path specified by the permission rule, and the permission graph corresponding to the user entity node is deleted.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the resource authority control method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the resource authority control method according to any one of claims 1 to 3 is implemented.

Images