A content permission management method and apparatus

Abstract

The present invention discloses a content authority management method and device, and relates to the field of computer technology. A specific implementation of the method includes: analyzing content publishing needs, determining content types, obtaining content models corresponding to the content types and authority dimensions corresponding to the content models; in response to a content publishing operation, receiving content filled in the content model and authority items selected in at least one authority dimension, constructing an association relationship between the content and the authority items and storing them in an ES index; receiving a query instruction, obtaining user authority features in the query instruction, searching for content corresponding to the user authority features in the ES index and displaying them. This implementation can select and combine multiple different authority dimensions and authority items, and use ES technology to achieve efficient retrieval and access to content that meets user authority features, thereby achieving personalization and diversification of content retrieval.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a content authority management method and device. Background Art

[0002] In a CMS (Content Management System), content is an important data asset of the system, and fine-grained access control of content has always been a difficult problem for the system. When publishing content, this content can be an article, a file, or a video. Sometimes the publisher hopes to precisely control access to the content to individuals, organizations, departments, groups, ranks, and positions.

[0003] There are currently two main methods. One is to add publishing department and viewable department fields to the database table. In subsequent queries, the conditional statement after the where condition needs to be dynamically spliced ​​to add conditions for querying by department. The other method supports a combination of different permission options and stores the permission part in a separate or multiple sub-tables. When querying content that meets the user's permissions, the content and permission tables need to be associated for query.

[0004] In the process of implementing the present invention, the inventors found that the prior art has at least the following problems: Method 1 can only realize simple department-level authority control, with relatively simple functions, and is only applicable to simple scenarios; Method 2 requires multiple tables to be associated with queries when the authority settings are complex, and sometimes multiple times or multiple statements are required to return the query results, and the query statements are complex and time-consuming. The authority control of this solution is tightly coupled with the system, making it difficult to expand and the query efficiency is low. When the amount of data is too large or the user access frequency is too high, its performance often cannot meet the requirements. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a content authority management method and device, which can at least solve the problem of authority control of content publishing in the existing content management system.

[0006] To achieve the above object, according to one aspect of an embodiment of the present invention, a content rights management method is provided, comprising:

[0007] Analyze content publishing requirements, determine content types, and obtain content models corresponding to the content types and permission dimensions corresponding to the content models;

[0008] In response to a content publishing operation, receiving content filled in the content model and permission items selected in at least one permission dimension, building an association relationship between the content and the permission items and storing the association relationship in an ES index;

[0009] Receive a query instruction, obtain the user authority feature in the query instruction, search for content corresponding to the user authority feature in the ES index and display it; wherein the user authority feature includes at least one authority item.

[0010] Optionally, the acquiring the content model corresponding to the content type and the permission dimension corresponding to the content model includes:

[0011] When there are multiple content models, receiving a content model selected by a user from the content models;

[0012] Determine the permission dimension corresponding to the one content model, and receive a user's selection operation on at least one permission dimension.

[0013] Optionally, the constructing the association relationship between the content and the permission item and storing it in an ES index includes:

[0014] Construct permission pairs based on the selected permission items and the permission dimensions where each permission item is located;

[0015] The permission pairs of the at least one permission dimension are combined to generate a permission scheme, and then an association relationship between the content and the permission scheme is constructed and stored in the ES index.

[0016] Optionally, the permission scheme is stored as an attribute of the content using the Nested type.

[0017] Optionally, receiving a query instruction, obtaining a user authority feature in the query instruction, searching for content corresponding to the user authority feature in an ES index and displaying the content includes:

[0018] After detecting the user access operation, basic information of the user is obtained based on the user identifier; wherein the basic information of the user includes at least one permission item;

[0019] A user permission feature is generated based on the at least one permission item, and the content corresponding to the user permission feature is searched and displayed in the ES index using the Nested query method.

[0020] To achieve the above object, according to another aspect of an embodiment of the present invention, a content rights management device is provided, comprising:

[0021] An analysis module, used to analyze content publishing requirements, determine content types, and obtain content models corresponding to the content types and permission dimensions corresponding to the content models;

[0022] A publishing module, configured to respond to a content publishing operation, receive content filled in the content model and permission items selected in at least one permission dimension, construct an association relationship between the content and the permission items, and store the association relationship in an ES index;

[0023] The search module is used to receive a query instruction, obtain the user authority feature in the query instruction, search for content corresponding to the user authority feature in the ES index and display it; wherein the user authority feature includes at least one authority item.

[0024] Optionally, the analysis module is used to: when there are multiple content models, receive a content model selected by a user from the content models;

[0025] Determine the permission dimension corresponding to the one content model, and receive a user's selection operation on at least one permission dimension.

[0026] Optionally, the publishing module is used to:

[0027] Construct permission pairs based on the selected permission items and the permission dimensions where each permission item is located;

[0028] The permission pairs of the at least one permission dimension are combined to generate a permission scheme, and then an association relationship between the content and the permission scheme is constructed and stored in the ES index.

[0029] Optionally, the permission scheme is stored as an attribute of the content using the Nested type.

[0030] Optionally, the search module is used to:

[0031] After detecting the user access operation, basic information of the user is obtained based on the user identifier; wherein the basic information of the user includes at least one permission item;

[0032] A user permission feature is generated based on the at least one permission item, and the content corresponding to the user permission feature is searched and displayed in the ES index using the Nested query method.

[0033] To achieve the above objective, according to another aspect of an embodiment of the present invention, a content rights management electronic device is provided.

[0034] The electronic device of the embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-mentioned content permission management methods.

[0035] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, any of the above-mentioned content authority management methods is implemented.

[0036] According to the solution provided by the present invention, one embodiment of the above invention has the following advantages or beneficial effects: multiple permission dimensions can be set according to individuals, departments, ranks, positions, workplaces, etc., and flexible settings can be made according to content permission requirements when publishing content to avoid cross-level access to content, and it has good scalability and flexibility.

[0037] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0039] Figure 1 is a main flow chart of a content authority management method according to an embodiment of the present invention;

[0040] Figure 2 It is a schematic diagram of the interface of content model and permission dimension;

[0041] Figure 3 It is a schematic diagram of the relationship between content and permission scheme;

[0042] Figure 4 It is a schematic diagram of the content index structure;

[0043] Figure 5 It is a schematic diagram of content query;

[0044] Figure 6 is a schematic diagram of main modules of a content rights management device according to an embodiment of the present invention;

[0045] Figure 7 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0046] Figure 8 It is a schematic diagram of the structure of a computer system of a mobile device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0048] See also Figure 1 , which shows a main flow chart of a content rights management method provided by an embodiment of the present invention, comprising the following steps:

[0049] S101: Analyze content publishing requirements, determine content types, and obtain content models corresponding to the content types and permission dimensions corresponding to the content models;

[0050] S102: In response to a content publishing operation, receiving content filled in the content model and permission items selected in at least one permission dimension, building an association relationship between the content and the permission items and storing the association relationship in an ES index;

[0051] S103: receiving a query instruction, obtaining a user authority feature in the query instruction, searching for content corresponding to the user authority feature in the ES index and displaying the content; wherein the user authority feature includes at least one authority item.

[0052] In the above implementation, for step S101, the CMS content management system is a software system located between the Web front end (Web server) and the back-end office system or process (content creation, editing). Content creators, editors, and publishers use the content management system to submit, modify, approve, and publish content, including but not limited to files, tables, pictures, data in databases, and even videos, and all other information that can be published to the Internet, Intranet, and Extranet websites.

[0053] Analyze content publishing requirements, determine content types, and obtain the corresponding content model for publishing content. In actual operations, product managers usually analyze the requirements raised by business departments / personnel, such as the need to publish a news announcement and publish different content according to different departments.

[0054] Usually, one content type corresponds to only one content model, but if there are multiple content models, it is equivalent to having multiple types of content that can be published. Different menus or button labels can be set for different content models. For example, the content management interface has company news release, notice announcement release, and personnel appointment release. Users can select the content model they want to publish by clicking on the menu. The number of content fields in the published interface that jumps out is different, and the permission requirements may also be different.

[0055] Different content has different permission requirements, and you can set permission dimensions corresponding to each content model. Depending on the content publishing system, you can either set a permission dimension that completely matches the content model, or set a general permission dimension. On the basis of determining the content model, obtain the corresponding permission dimension, such as by department, by person, by workplace, by rank, by system, etc.

[0056] Here is an example:

[0057]

[0058] For step S102, a content authority management block is established in the existing CMS. The above steps are only to analyze the corresponding relationship between content publishing requirements-content model-authority dimensions, but this relationship needs to be configured in the content authority management block for publishing.

[0059] A "Content Release" button / option is set in the interface. In response to the user's selection of the button / option, different content filling interfaces and permission display interfaces are displayed according to the content model and permission dimensions. Figure 2 As shown, the publisher fills in the business content in the content filling interface according to actual needs, and selects one or more permission items from the permission display interface to build and store the association relationship between the content and the permission items. The relationship can be described as content-permission scheme-permission pair {permission dimension-permission item}.

[0060] Although the permission schemes corresponding to different contents may be the same, this solution chooses to store the content and permission schemes together to avoid confusion in permission schemes. Even if the permission schemes are the same, multiple copies will be stored to achieve a one-to-one correspondence between the two. One content corresponds to one permission scheme, and one permission scheme corresponds to one or more permission pairs. Each permission pair consists of a permission dimension and a permission item. In this way, the relationship between content and permission schemes is constructed, presenting a hierarchical structure, which is easy to expand and structured maintenance. See Figure 3 shown.

[0061] Establish a data storage system to save the content published by users, the selected permission schemes and the generated associations into the Elastic Search (ES) index table. Since one content corresponds to one permission scheme, and one permission scheme contains different permission pairs, a typical one-to-many data relationship structure, there are currently two main types of storage and indexing of such associations in ES: Nested and Parent / Child, as shown below:

[0062]

[0063] According to the characteristics of this solution, the relationship between content and permission scheme does not change much, and it is more of a query scenario. Therefore, it is more suitable to use Nested type storage in ES, that is, the content and permission scheme are stored together, and the permission scheme as a whole is stored using Nested type as an attribute of the content. A permission scheme can contain multiple permission pairs, each permission pair is a value pair, including two attributes: permission dimension and permission option. When querying, the Nested query method is used. According to the permission dimension and permission item, the query conditions are generated to accurately match the corresponding content. Therefore, these two attributes use the keyword type in the ES index, that is, they need to be accurately matched.

[0064] For step S103, a user content access system is established, and the administrator sets which content the user can view according to the security rules or security policies set by the system to implement content authority management. When a user logs into the system, he can access and can only access the content he is authorized to view.

[0065] When a user accesses a site, the system can build user permission features based on the user's basic information, including the user's department, system, workplace, rank, account, etc. When querying later, you can generate query conditions (such as DSL statements) based on the user's permission features, and use Nested's query method to retrieve content that meets the query conditions in the ES index to achieve fine-grained access to content. For details, see Figure 4 The content index structure and Figure 5 The query diagram is shown.

[0066] In addition, ES can ensure efficient retrieval. The efficiency of existing databases will decrease after a certain amount of retrieval. When there is a lot of content, multiple tables need to be associated for query. ES data stores content, permission schemes, and the relationship between the two together, and can be retrieved efficiently using indexes.

[0067] The embodiment of the present invention proposes a fine-grained content permission control method based on ES, which can set multiple permission dimensions according to individuals, departments, ranks, positions, workplaces, etc., and flexibly set them according to content permission requirements when publishing content to avoid cross-level access to content, and has good scalability and flexibility.

[0068] See also Figure 6 , shows a schematic diagram of main modules of a content rights management device 600 provided by an embodiment of the present invention, including:

[0069] Analysis module 601, used to analyze content publishing requirements, determine content types, and obtain content models corresponding to the content types and permission dimensions corresponding to the content models;

[0070] A publishing module 602 is used to respond to a content publishing operation, receive content filled in the content model and permission items selected in at least one permission dimension, build an association relationship between the content and the permission items, and store the association relationship in an ES index;

[0071] The search module 603 is used to receive a query instruction, obtain the user authority feature in the query instruction, search for content corresponding to the user authority feature in the ES index and display it; wherein the user authority feature includes at least one authority item.

[0072] In the implementation device of the present invention, the analysis module 601 is used to:

[0073] When there are multiple content models, receiving a content model selected by a user from the content models;

[0074] Determine the permission dimension corresponding to the one content model, and receive a user's selection operation on at least one permission dimension.

[0075] In the implementation device of the present invention, the publishing module 602 is used to:

[0076] Construct permission pairs based on the selected permission items and the permission dimensions where each permission item is located;

[0077] The permission pairs of the at least one permission dimension are combined to generate a permission scheme, and then an association relationship between the content and the permission scheme is constructed and stored in the ES index.

[0078] In the implementation device of the present invention, the permission scheme is stored as an attribute of the content using the Nested type.

[0079] In the implementation device of the present invention, the search module 603 is used to:

[0080] After detecting the user access operation, basic information of the user is obtained based on the user identifier; wherein the basic information of the user includes at least one permission item;

[0081] A user permission feature is generated based on the at least one permission item, and the content corresponding to the user permission feature is searched and displayed in the ES index using the Nested query method.

[0082] In addition, the specific implementation content of the device described in the embodiment of the present invention has been described in detail in the method described above, so the repeated content will not be described again here.

[0083] Figure 7 An exemplary system architecture 700 is shown in which embodiments of the present invention may be applied.

[0084] like Figure 7 As shown, system architecture 700 may include terminal devices 701, 702, 703, network 704 and server 705 (just an example). Network 704 is used to provide a medium for communication links between terminal devices 701, 702, 703 and server 705. Network 704 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0085] The user can use the terminal devices 701, 702, 703 to interact with the server 705 through the network 704 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 701, 702, 703.

[0086] The terminal devices 701, 702, and 703 may be various electronic devices having display screens and supporting web browsing, and the server 705 may be a server providing various services.

[0087] It should be noted that the method provided in the embodiment of the present invention is generally executed by the server 705 , and accordingly, the device is generally set in the server 705 .

[0088] It should be understood that Figure 7 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0089] Reference below Figure 8 , which shows a schematic diagram of the structure of a computer system 800 of a terminal device suitable for implementing an embodiment of the present invention. Figure 8 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0090] like Figure 8As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the system 800 are also stored. The CPU 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0091] The following components are connected to the I / O interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage section 808 as needed.

[0092] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the central processing unit (CPU) 801, the above-mentioned functions defined in the system of the present invention are executed.

[0093] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0094] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0095] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be set in a processor. For example, they may be described as: a processor includes an analysis module, a publishing module, and a search module. The names of these modules do not, in some cases, constitute limitations on the modules themselves. For example, the search module may also be described as a "content search module".

[0096] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes:

[0097] Analyze content publishing requirements, determine content types, and obtain content models corresponding to the content types and permission dimensions corresponding to the content models;

[0098] In response to a content publishing operation, receiving content filled in the content model and permission items selected in at least one permission dimension, building an association relationship between the content and the permission items and storing the association relationship in an ES index;

[0099] Receive a query instruction, obtain the user authority feature in the query instruction, search for content corresponding to the user authority feature in the ES index and display it; wherein the user authority feature includes at least one authority item.

[0100] According to the technical solution of the embodiment of the present invention, multiple different permission dimensions and permission items can be selected and combined, and ES technology can be used to achieve efficient retrieval and access to content that meets user permission characteristics, thereby achieving personalization and diversification of content retrieval.

[0101] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A content rights management method, characterized in that: include: Analyze content publishing requirements, determine content types, and obtain content models corresponding to the content types and permission dimensions corresponding to the content models; In response to a content publishing operation, receiving content filled in the content model and permission items selected in at least one permission dimension, building an association relationship between the content and the permission items and storing them in an ES index, including: building a permission pair based on the selected permission items and the permission dimensions where each permission item is located; combining the permission pairs of at least one permission dimension to generate a permission scheme, and then building an association relationship between the content and the permission scheme and storing them in an ES index; wherein the permission scheme is stored as an attribute of the content using a Nested type; Receive a query instruction, obtain the user authority feature in the query instruction, search for content corresponding to the user authority feature in the ES index and display it; wherein the user authority feature includes at least one authority item.

2. The method according to claim 1, characterized in that The acquiring the content model corresponding to the content type and the permission dimension corresponding to the content model includes: When there are multiple content models, receiving a content model selected by a user from the content models; Determine the permission dimension corresponding to the one content model, and receive a user's selection operation on at least one permission dimension.

3. The method according to claim 1, characterized in that: The receiving of the query instruction, obtaining the user authority feature in the query instruction, searching for content corresponding to the user authority feature in the ES index and displaying the content, includes: After detecting the user access operation, basic information of the user is obtained based on the user identifier; wherein the basic information of the user includes at least one permission item; A user permission feature is generated based on the at least one permission item, and the content corresponding to the user permission feature is searched and displayed in the ES index using the Nested query method.

4. A content rights management device, characterized in that: include: An analysis module, used to analyze content publishing requirements, determine content types, and obtain content models corresponding to the content types and permission dimensions corresponding to the content models; A publishing module, for responding to a content publishing operation, receiving content filled in the content model and permission items selected in at least one permission dimension, constructing an association relationship between the content and the permission items and storing the association relationship in an ES index, including: constructing permission pairs based on the selected permission items and the permission dimensions where the permission items are located; combining permission pairs of at least one permission dimension to generate a permission scheme, and then constructing an association relationship between the content and the permission scheme and storing the association relationship in an ES index; wherein the permission scheme is stored as an attribute of the content using a Nested type; The search module is used to receive a query instruction, obtain the user authority feature in the query instruction, search for content corresponding to the user authority feature in the ES index and display it; wherein the user authority feature includes at least one authority item.

5. The device according to claim 4, characterized in that The search module is used to: After detecting the user access operation, basic information of the user is obtained based on the user identifier; wherein the basic information of the user includes at least one permission item; A user permission feature is generated based on the at least one permission item, and the content corresponding to the user permission feature is searched and displayed in the ES index using the Nested query method.

6. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 3.

7. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images