Method, apparatus, and storage medium for managing permissions

Abstract

The application provides a permission management method and device, electronic equipment and a storage medium, the method comprising: receiving a request of a user accessing target information in a target file; in response to the request, searching for role permission information corresponding to the user and group permission information corresponding to the user according to user identification information; wherein the user identification information is obtained from the request; determining the access permission of the user to the target file according to the group permission information, and determining the access permission of the user to the target information according to the role permission information; if the user has the access permission to the target file and the target information, allowing the user to access the target information in the target file. The application realizes automatic completion of permission management, improves the efficiency of permission management, reduces the labor cost, and can realize permission management in multiple dimensions, simplifying the permission management mode.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a permission management method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the advent of the big data era and the development of data visualization, the amount of analyzed data in various industries is increasing, and more and more data dimensions are presented in front-end reports. Therefore, data security becomes the primary consideration. The front-end BI (Business Intelligence) visualization report is increasing, and the number of users viewing the report is also increasing.

[0003] In order to ensure the security of data, different data access permissions need to be allocated to different users, such as users in different industries and different trades, that is, only users in the access permission range can view the data. Therefore, how to manage user permissions to protect data security is a problem to be solved in the field.

[0004] In the prior art, the management personnel manually allocates corresponding access permissions to each user in the system; however, the number of users is usually large, and manually allocating access permissions to each user by the administrator not only has low management efficiency, but also requires a large amount of manpower and resources. SUMMARY

[0005] The present application provides a permission management method and device, electronic equipment and storage medium, to solve the problem of manually allocating access permissions to each user in the prior art, low management efficiency, and the need for a large amount of manpower and resources, and to achieve quick and convenient management of permissions.

[0006] The present application provides a permission management method, comprising:

[0007] receiving a request of a user to access target information in a target file;

[0008] In response to the request, according to the user identification information, the role permission information corresponding to the user and the group permission information corresponding to the user are found; wherein the user identification information is obtained from the request;

[0009] According to the group permission information, the access permission of the user to the target file is determined, and according to the role permission information, the access permission of the user to the target information is determined;

[0010] If the user has the access permission to the target file and the target information, the user is allowed to access the target information in the target file.

[0011] The permission management method provided by the present application further comprises:

[0012] receiving a request of a user applying for opening a target permission;

[0013] in response to the request of the user applying for opening the target permission, searching for the user according to user identification information in a historical user list;

[0014] in a case of searching for the user, assigning a role to the user according to the target permission and a role list corresponding to the historical user list, and / or assigning a group to the user according to the target permission and a group list corresponding to the historical user list.

[0015] According to the permission management method provided by the application, the role is assigned to the user according to the target permission and the role list corresponding to the historical user list, which comprises:

[0016] searching for a role with information access permission in the target permission in the role list;

[0017] in a case of searching for the role with the information access permission, assigning the role with the information access permission to the user;

[0018] in a case of not searching for the role with the information access permission, adding the role with the information access permission, and assigning the added role to the user.

[0019] According to the permission management method provided by the application, the role is assigned to the user according to the target permission and the role list corresponding to the historical user list, which comprises:

[0020] searching for a group with file access permission in the target permission in the group list;

[0021] in a case of searching for the group with the file access permission, assigning the group with the file access permission to the user;

[0022] in a case of not searching for the group with the file access permission, adding the group with the file access permission, and assigning the added group to the user.

[0023] According to the permission management method provided by the application, the role is assigned to the user according to the target permission and the role list corresponding to the historical user list, which comprises:

[0024] in a case of not searching for the user, assigning a role and / or a group to the user according to user personal information in the request of the user applying for opening the target permission.

[0025] According to the permission management method provided by the application, the role is assigned to the user according to the target permission and the role list corresponding to the historical user list, which comprises:

[0026] According to the user identification information, role identification information corresponding to the user is found;

[0027] According to the role identification information, the role permission information is found;

[0028] According to the user identification information, grouping identification information corresponding to the user is found;

[0029] According to the grouping identification information, the grouping permission information is found.

[0030] According to the permission management method provided by the application, the method further comprises:

[0031] When the update instruction is received, the grouping permission information and / or the role permission information are updated according to the update instruction, and the update result is sent to the terminal;

[0032] The update comprises adding, deleting or modifying.

[0033] The application further provides a permission management device, comprising:

[0034] A receiving module is configured to receive a request of a user for accessing target information in a target file;

[0035] A finding module is configured to find, in response to the request, role permission information corresponding to the user and grouping permission information corresponding to the user according to user identification information, wherein the user identification information is obtained by parsing the request;

[0036] A determining module is configured to determine, according to the grouping permission information, an access permission of the user to the target file, and determine, according to the role permission information, an access permission of the user to the target information;

[0037] An authorization module is configured to allow the user to access the target information in the target file if the user has the access permission to the target file and the target information.

[0038] The application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the permission management method according to any of the above when executing the program.

[0039] The application further provides a non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program is executable on a processor to implement the steps of the permission management method according to any of the above.

[0040] The application further provides a computer program product comprising a computer program, wherein the computer program is executable on a processor to implement the steps of the permission management method according to any of the above.

[0041] The application provides a permission management method, device, electronic equipment and storage medium, which automatically acquires role permission information corresponding to a user and group permission information corresponding to the user according to user identification information, combines the role permission information corresponding to the user and the group permission information corresponding to the user, and automatically determines whether the user has permission to access target files and target information, so that the user is allowed to access target information in the target files in the case that the user has permission to access the target files and the target information. The whole permission management process is automatically completed by the server, which greatly improves the efficiency of permission management and reduces the labor cost. In addition, the association between the user identification information and the role permission information and the group permission information is established, so that multi-dimensional permission management can be realized and the permission management mode is simplified. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0043] Figure 1 is one of the flowcharts of the permission management method provided by the application;

[0044] Figure 2 is a structural diagram of the permission management timing in the permission management method provided by the application;

[0045] Figure 3 is another flowchart of the permission management method provided by the application;

[0046] Figure 4 is a structural diagram of the association between the user, the role and the group in the permission management method provided by the application;

[0047] Figure 5 is a structural diagram of the permission management device provided by the application;

[0048] Figure 6 is a structural diagram of the electronic equipment provided by the application. DETAILED DESCRIPTION

[0049] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the protection scope of the present application.

[0050] The Internet of Things big data era has come, and BI visualization has become the mainstream trend of data analysis in the big data era. The risk of data leakage also increases, and data security is particularly important. Therefore, a permission management method is urgently needed to safely manage and control line-level data and to divide and control data of different dimensions.

[0051] The method provided by the prior art is to configure the permission for each user separately. When the number of users is large, the permission management is cumbersome and time-consuming. The present embodiment manages the permission from the bottom of the database in the form of an external permission table, that is, the association between the user and the grouping permission information and the user and the role permission information is established, so that the allocation between the user, the role and the grouping is clear at a glance, and the permission information can be flexibly queried and modified from multiple angles. On the one hand, the data access permission can be better controlled to protect data security, and on the other hand, the operation and maintenance cost can be greatly saved, the management efficiency can be improved, and the user experience can be improved.

[0052] The present application will be described below in combination with Figure 1 The permission management method of the present application is described, which comprises the following steps: step 101, receiving a request of a user to access target information in a target file;

[0053] In the present embodiment, the execution subject is a server.

[0054] The server can support multiple users to simultaneously send the request to access the target information in the target file, and the server can receive and respond to each access request sent by each user.

[0055] The target file includes but is not limited to video, document, device information and form, etc., which is not specifically limited in the present embodiment.

[0056] The target information is the sub-file information under the target file. For example, the target file is a form, and the target information is a specific row or column in the form.

[0057] Optionally, when the user needs to access the target information in the target file, the client sends a request to access the target information in the target file to the server;

[0058] The server end receives the request of the user to access the target information in the target file sent by the client in real time.

[0059] Step 102: In response to the request, retrieve the user's corresponding role permission information and the user's corresponding group permission information based on the user identification information; wherein, the user identification information is obtained by parsing from the request;

[0060] The user's role can be divided according to job level and / or job type. This embodiment does not make specific limitations on this. For example, the user's role may include president level, manager level, team leader level and ordinary employee level.

[0061] Different roles have different access permissions to the target information in the target file, and different groups have different access permissions to the target file.

[0062] User identification information can be a user's number or ID (Identity Document), etc., and this embodiment does not specifically limit it. Each user has unique user identification information.

[0063] like Figure 2 As shown, before searching for the user's corresponding role permission information and the user's corresponding group permission information,

[0064] First, create a new group in the application security section of the BI Server (Business Intelligence Server) console and set the group's permission information;

[0065] Create application roles using the management tool Enterprise Manager, and then synchronize the created application roles to the database.

[0066] Then, a connection pool is established in the database, variables are created and a new initialization block is created. Users and roles in the database are added to the corresponding variables through the connection pool, and the role and permission information of the application is established through the data filter.

[0067] The database stores user lists, role lists, group lists, as well as user-role mappings and user-group mappings.

[0068] By performing the above operations, different permission information can be set for different users, different roles, and different groups, so that users in different groups and different roles have different access permissions.

[0069] Upon receiving an access request, the system retrieves the user's identification information and searches for the user's corresponding role and permission information, as well as the user's corresponding group permission information, in a pre-built database.

[0070] In step 103, the access right of the user to the target file is determined according to the group permission information, and the access right of the user to the target information is determined according to the role permission information.

[0071] Optionally, the access right of the target file is searched in the group permission information, and in the case that the access right of the target file is searched, it is determined that the user has the access right to the target file.

[0072] In the case that the access right of the target file is not searched, it is determined that the user does not have the access right to the target file.

[0073] The access right of the target data is searched in the role permission information, and in the case that the access right of the target data is searched, it is determined that the user has the access right to the target data.

[0074] In the case that the access right of the target data is not searched, it is determined that the user does not have the access right to the target data.

[0075] According to the role permission information and the group permission information corresponding to the user, it is determined whether the user has the access right to the target file and the target information.

[0076] In step 104, if the user has the access right to the target file and the target information, the user is allowed to access the target information in the target file.

[0077] Optionally, after it is determined whether the user has the access right to the target file and the target information, if it is learned that the user has the access right to the target file and the target information, the user is allowed to access the target information in the target file.

[0078] In the case that it is determined that the user has the access right to the target file but does not have the access right to the target information, the user is only allowed to view the attribute information of the target file, such as the name and the identification information of the file, but is not allowed to view the specific content data in the target file.

[0079] In the case that it is determined that the user does not have the access right to the target file, the user is not allowed to view the target file.

[0080] It should be noted that in the case that the user is not allowed to access the target file or the target data, prompt information is sent to the user through the client, so that the user inputs correct access instructions or opens new access right, which is not limited in the embodiment.

[0081] The permission management in the embodiment can be implemented on a platform such as Oracle BIEE (Oracle Business Intelligence Enterprise Edition, a new business intelligence platform of Oracle) to assign different data access permissions to different users, thereby ensuring safe control of data.

[0082] The embodiment automatically determines whether the user has the permission to access the target file and the target information by automatically searching for the role permission information corresponding to the user and the grouping permission information corresponding to the user according to the user identification information, and combining the role permission information corresponding to the user and the grouping permission information corresponding to the user, and allows the user to access the target information in the target file in the case that the user has the permission to access the target file and the target information. The entire permission management process is automatically completed by the server, greatly improving the efficiency of permission management and reducing labor costs. Moreover, by establishing the association between the user identification information and the role permission information and the grouping permission information, multi-dimensional permission management can be achieved, and the permission management mode is simplified.

[0083] On the basis of the above-mentioned embodiments, the embodiment further includes: receiving a request of the user to apply for opening the target permission; in response to the request of the user to apply for opening the target permission, searching for the user in the historical user list according to the user identification information; in the case that the user is found, assigning a role to the user according to the target permission and the role list corresponding to the historical user list, and / or assigning a group to the user according to the target permission and the group list corresponding to the historical user list.

[0084] Optionally, in the case that the user needs to open the target permission, the terminal sends a request of applying for opening the target permission to the server;

[0085] When the server receives the request of the user to apply for opening the target permission, the server searches for the user in the historical user list of the database according to the user identification information, and determines whether the user exists in the historical user list. In the case that the user is found in the historical user list, the server searches for the role corresponding to the target permission in the role list corresponding to the historical user list, and searches for the group corresponding to the target permission in the group list corresponding to the historical user list;

[0086] assigning the corresponding role and / or group to the user according to the group corresponding to the target permission and / or the group;

[0087] In the case that the user is not found in the historical user list, the user is synchronized to the historical user list, and a new group and / or role with the target permission is created for the user. Then, the corresponding role and / or group is assigned to the user.

[0088] This embodiment can automatically assign the corresponding role and group to the user when the user requests to activate the target permission, so that the user has the target permission, avoiding the inefficiency of manual management and the problem of errors in manually adding permission information, thus improving the efficiency and accuracy of management.

[0089] Based on the above embodiments, in this implementation, roles are assigned to users according to the target permissions and the role list corresponding to the historical user list, including: searching the role list for a role with the information access permission in the target permissions; if a role with the information access permission is found, assigning the user the role with the information access permission; if no role with the information access permission is found, adding a new role with the information access permission and assigning the new role to the user.

[0090] The target permissions include file access permissions and / or information access permissions;

[0091] like Figure 3 As shown, the steps for assigning roles to users based on target permissions include: searching for roles with information access permissions in the role list corresponding to the historical user list built in the database; directly assigning the found role to the user if an information access permission is found; and creating a new role with information access permission before assigning the new role to the user if no such role is found.

[0092] This embodiment can automatically find the corresponding role based on the information access permissions in the target permissions sent by the user, and assign the found role to the user so that the user has the information access permissions. It is simple to operate and has high management efficiency.

[0093] Based on the above embodiments, this embodiment assigns groups to users according to the target permissions and the group list corresponding to the historical user list, including: searching the group list for a group with file access permissions in the target permissions; if a group with file access permissions is found, assigning the user a group with file access permissions; if no group with file access permissions is found, adding a new group with file access permissions and assigning the new group to the user.

[0094] like Figure 3As shown, the step of assigning a role to the user according to the target permission includes: searching for a group with file access permission in the target permission in the group list corresponding to the historical user list of the database construction; directly assigning the searched group to the user when the group with file access permission is found; when the group with file access permission is not found, first creating a group with file access permission, and then assigning the created group to the user.

[0095] According to the file access permission in the target permission sent by the user, the corresponding group can be automatically searched and assigned to the user in the embodiment, so that the user has information access permission, the operation is simple, and the management efficiency is high.

[0096] On the basis of the above-mentioned embodiments, the embodiment further includes: in the case where the user is not found, assigning a role and / or a group to the user according to user personal information in the request of the user to apply for opening the target permission.

[0097] The user personal information includes but is not limited to the name, working state, post, department, company name and the like of the user, which is not specifically limited in the embodiment.

[0098] Optionally, in the case where the user is not found in the historical user list of the database according to the user identification information, the user is determined to be a new user; the role and the group of the user can be determined according to the user personal information, and the determined role and group are assigned to the user.

[0099] In addition, the assignment result can be synchronized to the user-group mapping relationship and the user-role mapping relationship, so that the user can view and / or update the user-group mapping relationship and the user-role mapping relationship in real time.

[0100] In the embodiment, even if there is a new user, the role and the group can be automatically assigned to the new user, so that the user is assigned the corresponding group and role, the operation is simple, and the management efficiency is high.

[0101] On the basis of the above-mentioned embodiments, the step of searching for role permission information and group permission information corresponding to the user according to the user identification information in the embodiment includes: searching for role identification information corresponding to the user according to the user identification information; searching for the role permission information according to the role identification information; searching for group identification information corresponding to the user according to the user identification information; and searching for the group permission information according to the group identification information.

[0102] As shown, Figure 4 The user list, the user-role mapping relationship and the user-group mapping relationship are associated through the user identification information;

[0103] The role list, the role permission information, and the user-role mapping relationship are associated through role identification information. The role identification information can be a number or an ID, and the embodiment is not limited in this regard. Each role has unique role identification information.

[0104] The group list, the user-group mapping relationship, and the group permission information are associated through group identification information. The group identification information can be a number or an ID, and the embodiment is not limited in this regard. Each group has unique group identification information.

[0105] It should be noted that the user identification information, the role identification information, and the group identification information can be of the same type or of different types, and the embodiment is not limited in this regard. For example, the user identification information is a user ID, the role identification information is a role ID, and the group identification information is a group ID.

[0106] Optionally, the step of finding the role permission information corresponding to the user and the group permission information corresponding to the user according to the user identification information includes,

[0107] finding the role identification information corresponding to the user in the user-role mapping relationship in the database according to the user identification information;

[0108] Then, the role permission information is found in the role list according to the role identification information corresponding to the user.

[0109] The group identification information corresponding to the user is found in the user-group mapping relationship in the database according to the user identification information.

[0110] Then, the group permission information is found in the group list according to the group identification information corresponding to the user.

[0111] In the prior art, the permission management is performed manually, and when the number of users is large, the information of the users needs to be checked one by one. This not only has low management efficiency, but also requires a large amount of manpower and material resources, and errors are likely to occur in the checking process.

[0112] The embodiment can quickly and accurately obtain the role permission information corresponding to the user and the group permission information corresponding to the user according to the mapping relationship between the users and the groups and the users and the roles in the database, and then determine the access permission of the user.

[0113] On the basis of the above embodiments, the embodiment further includes: when an update instruction is received, updating the group permission information and / or the role permission information according to the update instruction, and sending the update result to the terminal. The update includes adding, deleting, or modifying.

[0114] The updating includes but is not limited to adding, deleting or modifying, and the embodiment is not limited specifically in this aspect.

[0115] Optionally, when the administrator needs to update the group permission information and / or the role permission information, the client can send an update instruction to the server;

[0116] The form of the sending instruction includes but is not limited to voice, text and physical keys, and the embodiment is not limited specifically in this aspect.

[0117] When the service receives the update instruction, in the case that the update instruction is used to update the permission information of the to-be-updated role, the service finds the to-be-updated role in the update instruction in the role list according to the permission information of the to-be-updated role in the update instruction; in the case that the to-be-updated role is found, the service updates the role permission information found according to the permission information of the to-be-updated role in the instruction.

[0118] If the to-be-updated role is not found, the service adds the to-be-updated role and the corresponding permission information in the update instruction to the role list to expand the role list.

[0119] Or, in the case that the update instruction is used to update the permission information of the to-be-updated group, the service finds the to-be-updated group in the update instruction in the group list according to the permission information of the to-be-updated group in the update instruction; in the case that the to-be-updated group is found, the service updates the group permission information found according to the permission information of the to-be-updated group in the instruction.

[0120] If the to-be-updated group is not found, the service adds the to-be-updated group and the corresponding permission information in the update instruction to the group list to expand the group list.

[0121] Or, in the case that the update instruction is used to update the permission information of the to-be-updated role and the to-be-updated group, the service finds the to-be-updated group in the update instruction in the group list according to the permission information of the to-be-updated group in the update instruction; the service finds the to-be-updated role in the update instruction in the role list according to the permission information of the to-be-updated role in the update instruction, in the case that both the to-be-updated group and the to-be-updated role are found, the service updates the group permission information found according to the permission information of the to-be-updated group in the instruction, and updates the role permission information found according to the permission information of the to-be-updated role in the instruction.

[0122] In the case that any of the permission information of the to-be-updated role and the to-be-updated group is not found, the service updates the found permission information and expands the not-found permission information.

[0123] Then, when receiving a request of a user accessing target information in a target file, the role permission information corresponding to the user and the group permission information corresponding to the user can be found in the updated role list and group list according to the user identification information, so as to assign corresponding access permission to the user.

[0124] The user-role mapping relationship and the user-group mapping relationship can also be updated according to actual needs, and the specific updating manner is similar to the above updating manner.

[0125] In addition, when receiving a query instruction, one or more of the group permission information, the role permission information, the user-role mapping relationship, and the user-group mapping relationship can be queried according to the query instruction, and the query result can be sent to the terminal.

[0126] In the embodiment, the group permission information and / or the role permission information can be updated after receiving the update instruction, that is, the permission information of the users of the same group and the permission information of the users of the same role can be batch updated, which is convenient and flexible to operate, can better meet the different needs of users, and has strong scalability; greatly saves the cost of manual permission management, and simplifies the permission management mechanism.

[0127] In the embodiment, the user, the role, and the group are managed respectively through the external permission table, which is well-organized and convenient for the permission management personnel to batch query, add, modify, and delete user permissions, greatly saves the cost of manual management, optimizes the management mechanism; and the data access permission is managed through the external permission table, so that the user can only be shown the data within the permission range when accessing the data, and the data security is improved.

[0128] The permission management device provided by the application is described below, and the permission management device described below can be correspondingly referred to the permission management method described above.

[0129] As shown in Figure 5 The embodiment provides a permission management device, which comprises a receiving module 501, a finding module 502, a determining module 503, and an authorization module 504, wherein:

[0130] The receiving module 501 is used for receiving a request of a user accessing target information in a target file.

[0131] In the embodiment, the execution subject is a server.

[0132] The server can support multiple users to simultaneously send a request of accessing target information in a target file, and the server can receive and respond to each access request sent by each user.

[0133] The target file includes, but is not limited to, videos, documents, device information, and forms, etc., and this embodiment does not specifically limit them.

[0134] Target information refers to information about subfiles within the target file. For example, if the target file is a form, the target information would be specific rows or columns within that form.

[0135] Optionally, when a user needs to access target information in the target file, the client sends a request to the server to access the target information in the target file.

[0136] The server receives requests from clients in real time to access target information in the target file.

[0137] The lookup module 502 is used to respond to the request and look up the user's corresponding role permission information and the user's corresponding group permission information based on the user identification information; wherein, the user identification information is obtained by parsing from the request;

[0138] The user's role can be divided according to job level and / or job type. This embodiment does not make specific limitations on this. For example, the user's role may include president level, manager level, team leader level and ordinary employee level.

[0139] Different roles have different access permissions to the target information in the target file, and different groups have different access permissions to the target file.

[0140] User identification information can be a user's number or ID, etc., and this embodiment does not specifically limit it. Each user has unique user identification information.

[0141] like Figure 2 As shown, before searching for the user's corresponding role permission information and the user's corresponding group permission information,

[0142] First, create a new group in the Application Security domain through the BI Server console and set the group's permission information;

[0143] Create application roles using the management tool Enterprise Manager, and then synchronize the created application roles to the database.

[0144] Then, a connection pool is established in the database, variables are created and a new initialization block is created. Users and roles in the database are added to the corresponding variables through the connection pool, and the role and permission information of the application is established through the data filter.

[0145] The database stores user lists, role lists, group lists, as well as user-role mappings and user-group mappings.

[0146] By the above operation, different permission information can be set for different users, different roles and different groups, so that users of different groups and different roles have different access permissions.

[0147] Upon receiving the access request, the user identification information is acquired, the role permission information corresponding to the user and the group permission information corresponding to the user are found in the pre-constructed database.

[0148] The determining module 503 is configured to determine the access permission of the user to the target file according to the group permission information, and determine the access permission of the user to the target information according to the role permission information.

[0149] Optionally, the access permission of the target file is found in the group permission information, and in a case where the access permission of the target file is found, it is determined that the user has the access permission to the target file.

[0150] In a case where the access permission of the target file is not found, it is determined that the user does not have the access permission to the target file.

[0151] The access permission of the target data is found in the role permission information, and in a case where the access permission of the target data is found, it is determined that the user has the access permission to the target data.

[0152] In a case where the access permission of the target data is not found, it is determined that the user does not have the access permission to the target data.

[0153] According to the role permission information and the group permission information corresponding to the user, it can be determined whether the user has the access permission to the target file and the target information.

[0154] The authorization module 504 is configured to allow the user to access the target information in the target file if the user has the access permission to the target file and the target information.

[0155] Optionally, after it is determined whether the user has the access permission to the target file and the target information, if it is learned that the user has the access permission to the target file and the target information, the user is allowed to access the target information in the target file.

[0156] In a case where it is determined that the user has the access permission to the target file but does not have the access permission to the target information, the user is only allowed to view the attribute information of the target file, such as the name, the identification information of the file, and is not allowed to view the specific content data in the target file.

[0157] In a case where it is determined that the user does not have the access permission to the target file, the user is not allowed to view the target file.

[0158] It should be noted that in the case where the user is not allowed to access the target file or the target data, the client sends a prompt to the user for inputting a correct access instruction or opening a new access permission, and the embodiment is not limited in this regard.

[0159] The permission management in the embodiment can be implemented on an Oracle BIEE platform or the like to assign different data access permissions to different users, thereby ensuring safe control of the data.

[0160] The embodiment automatically determines whether the user has the permission to access the target file and the target information by automatically searching for the role permission information corresponding to the user and the grouping permission information corresponding to the user according to the user identification information and combining the role permission information corresponding to the user and the grouping permission information corresponding to the user, and allows the user to access the target information in the target file in the case where the user has the permission to access the target file and the target information. The entire permission management process is automatically completed by the server, greatly improving the efficiency of the permission management and reducing the labor cost. Moreover, the association between the user identification information and the role permission information and the grouping permission information can be established to implement the permission management in multiple dimensions and simplify the permission management mode.

[0161] On the basis of the above embodiment, the embodiment further includes an allocation module configured to receive a request of a user for opening a target permission, search for the user in a historical user list according to the user identification information in response to the request of the user for opening the target permission, assign a role to the user according to the target permission and a role list corresponding to the historical user list, and / or assign a grouping to the user according to the target permission and a grouping list corresponding to the historical user list in the case where the user is found.

[0162] On the basis of the above embodiment, the allocation module in the embodiment is specifically configured to search for a role having an information access permission in the target permission in the role list, assign the role having the information access permission to the user in the case where the role having the information access permission is found, and add a role having the information access permission and then assign the added role to the user in the case where the role having the information access permission is not found.

[0163] On the basis of the above embodiment, the allocation module in the embodiment is further configured to search for a grouping having a file access permission in the target permission in the grouping list, assign the grouping having the file access permission to the user in the case where the grouping having the file access permission is found, and add a grouping having the file access permission and then assign the added grouping to the user in the case where the grouping having the file access permission is not found.

[0164] Based on the above embodiments, the allocation module in this embodiment is further configured to: assign roles and / or groups to the user based on the user's personal information in the user's request to activate the target permissions, when no user is found.

[0165] Based on the above embodiments, the search module in this embodiment is specifically used for: searching for the role identifier information corresponding to the user based on the user identifier information; searching for the role permission information based on the role identifier information; searching for the group identifier information corresponding to the user based on the user identifier information; and searching for the group permission information based on the group identifier information.

[0166] Based on the above embodiments, this embodiment also includes an update module, used to: update the group permission information and / or the role permission information according to the update instruction when an update instruction is received, and send the update result to the terminal; wherein, the update includes adding, deleting or modifying.

[0167] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include a processor 601, a communications interface 602, a memory 603, and a communication bus 604, wherein the processor 601, communications interface 602, and memory 603 communicate with each other via the communication bus 604. The processor 601 can invoke logical instructions in the memory 603 to execute a permission management method, which includes: receiving a user's request to access target information in a target file; responding to the request, searching for the user's corresponding role permission information and the user's corresponding group permission information based on user identification information; wherein the user identification information is parsed from the request; determining the user's access permissions to the target file based on the group permission information, and determining the user's access permissions to the target information based on the role permission information; if the user has the permission to access the target file and the target information, then allowing the user to access the target information in the target file.

[0168] Further, the logic instructions in the memory 603 described above can be implemented in the form of software functional units and sold or used as standalone products, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or partially contribute to the prior art, or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0169] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the permission management method provided by the above-mentioned methods. The method comprises: receiving a request of a user accessing target information in a target file; in response to the request, searching for role permission information corresponding to the user and group permission information corresponding to the user according to user identification information; wherein the user identification information is obtained by parsing the request; determining the access permission of the user to the target file according to the group permission information, and determining the access permission of the user to the target information according to the role permission information; and if the user has the access permission to the target file and the target information, allowing the user to access the target information in the target file.

[0170] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the permission management method provided by the above-mentioned methods. The method comprises: receiving a request of a user accessing target information in a target file; in response to the request, searching for role permission information corresponding to the user and group permission information corresponding to the user according to user identification information; wherein the user identification information is obtained by parsing the request; determining the access permission of the user to the target file according to the group permission information, and determining the access permission of the user to the target information according to the role permission information; and if the user has the access permission to the target file and the target information, allowing the user to access the target information in the target file.

[0171] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0172] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0173] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for managing access permissions, characterized in that, include: Receive user requests to access target information in the target file; Target information refers to the information about subfiles under the target file; In response to the request, the user's corresponding role permission information and corresponding group permission information are retrieved based on the user identification information; wherein, the user identification information is obtained by parsing from the request; Based on the group permission information, determine the user's access permissions to the target file, and based on the role permission information, determine the user's access permissions to the target information; If a user has permission to access the target file and the target information, then the user is allowed to access the target information in the target file. If it is determined that the user has access rights to the target file but not to the target information, then the user is only allowed to view the attribute information of the target file. If it is determined that a user does not have access rights to the target file, the user shall not be allowed to view the target file.

2. The access control method according to claim 1, characterized in that, Also includes: Receive user requests to grant the target permissions; In response to a user's request to grant the target permissions, search for the user in the historical user list based on the user's identification information; If a user is found, a role is assigned to the user based on the target permissions and the role list corresponding to the historical user list, and / or a group is assigned to the user based on the group list corresponding to the target permissions and the historical user list.

3. The access control method according to claim 2, characterized in that, Assign roles to users based on the target permissions and the role list corresponding to the historical user list, including: Search the role list for a role that has the information access permissions specified in the target permissions; If a role with the aforementioned information access rights is found, the user is assigned that role. If no role with the required information access permissions is found, a new role with such permissions will be created and assigned to the user.

4. The access control method according to claim 2, characterized in that, Assigning users to groups based on the target permissions and the group list corresponding to the historical user list, including: Locate the group in the group list that has the file access permissions specified in the target permissions; If a group with the specified file access permissions is found, the user is assigned to that group. If no group with the specified file access permissions is found, a new group with the specified file access permissions is created and assigned to the user.

5. The access control method according to claim 2, characterized in that, Also includes: If the user cannot be found, assign roles and / or groups to the user based on the user's personal information in the user's request to grant the target permissions.

6. The access control method according to any one of claims 1-5, characterized in that, The step of searching for the user's corresponding role permission information and the user's corresponding group permission information based on the user identifier information includes: Based on the user identification information, find the user's corresponding role identification information; Based on the role identifier information, retrieve the role permission information; Based on the user identification information, find the group identification information corresponding to the user; Based on the group identifier information, locate the group permission information.

7. The access control method according to any one of claims 1-5, characterized in that, Also includes: Upon receiving an update instruction, the group permission information and / or the role permission information are updated according to the update instruction, and the update result is sent to the terminal. The update includes adding, deleting, or modifying.

8. A permission management device, characterized in that, include: The receiving module is used to receive user requests to access target information in the target file. Target information refers to the information about subfiles under the target file; The lookup module is used to respond to the request and, based on the user identification information, look up the user's corresponding role permission information and the user's corresponding group permission information; wherein, the user identification information is obtained by parsing from the request; The determination module is used to determine the user's access permissions to the target file based on the group permission information, and to determine the user's access permissions to the target information based on the role permission information; The authorization module is configured to allow a user to access the target information in the target file if the user has permission to access both the target file and the target information; if the user has permission to access the target file but not the target information, the user is only allowed to view the attribute information of the target file; if the user does not have permission to access the target file, the user is not allowed to view the target file.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the permission management method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the access control method as described in any one of claims 1 to 7.

Images