Permission Management Method and Device, Electronic Device, Computer Readable Medium

Abstract

Embodiments of the present application disclose a permission management method, apparatus, electronic device, and computer-readable medium. The method includes: classifying the obtained service permission information to obtain multiple service permission sets, where one service permission set corresponds to one type, and each service permission set includes multiple service permission information. Then, target service permission information is respectively obtained from the multiple service permission sets to obtain multiple target service permission information. After that, the multiple target service permission information is combined to obtain a target permission set matching the service group, and permission management is performed on the service parties included in the service group based on the target permission set. The technical solution of the embodiments of the present application improves the accuracy of permission management and greatly optimizes the permission management solution.

Description

Technical Field

[0001] The present application relates to the field of computer communication technologies, and more particularly, to a method and apparatus for privilege management, an electronic device, and a computer-readable medium. Background Art

[0002] Currently, privilege management involves multiple application scenarios. For example, in the application scenario of an operator designing related product services, the common practice is to manually configure the privileges of each business party (which can also be referred to as a user) one by one. Since there are many types of privileges and there may be an association relationship between different types of privileges, when configuring the privileges of a user, the phenomena of missing configuration or over-configuration often occur, resulting in many problems in privilege management.

[0003] Therefore, how to improve the accuracy of privilege management is an urgent problem to be solved. Summary of the Invention

[0004] To solve the above technical problems, embodiments of the present application provide a method and apparatus for privilege management, an electronic device, and a computer-readable medium, thereby at least to some extent improving the accuracy of privilege management.

[0005] According to one aspect of the embodiments of the present application, there is provided a method for privilege management, the method including: classifying the obtained service privilege information to obtain a plurality of service privilege sets; wherein, one service privilege set corresponds to one type, and each service privilege set includes a plurality of service privilege information; respectively obtaining target service privilege information from the plurality of service privilege sets to obtain a plurality of target service privilege information; combining the plurality of target service privilege information to obtain a target privilege set matching the service group; and performing privilege management on the business parties included in the service group based on the target privilege set.

[0006] According to one aspect of the embodiments of the present application, there is provided a privilege management apparatus, the apparatus including: a classification module configured to classify the obtained service privilege information to obtain a plurality of service privilege sets; wherein, one service privilege set corresponds to one type, and each service privilege set includes a plurality of service privilege information; an obtaining module configured to respectively obtain target service privilege information from the plurality of service privilege sets to obtain a plurality of target service privilege information; a combining module configured to combine the plurality of target service privilege information to obtain a target privilege set matching the service group; and a management module configured to perform privilege management on the business parties included in the service group based on the target privilege set.

[0007] In one embodiment of the present application, based on the foregoing solution, the combination module includes: an acquisition unit configured to respectively acquire the coding identifiers of the multiple target service permission information based on a preset service permission information coding identifier mapping relationship table; a combination unit configured to combine the coding identifiers of the multiple target service permission information to obtain the target permission set matching the service group.

[0008] In one embodiment of the present application, based on the foregoing solution, the acquisition unit is specifically configured to: respectively set coding identifiers for the multiple service permission information included in the multiple service permission sets to generate a preset service permission information coding identifier mapping relationship table; and respectively acquire the coding identifiers of the multiple target service permission information from the preset service permission information coding identifier mapping relationship table.

[0009] In one embodiment of the present application, based on the foregoing solution, the combination unit is specifically configured to: combine the coding identifiers of the multiple target service permission information based on the association relationship between the target service permission information to obtain multiple target permission subsets; wherein each target permission subset includes the coding identifiers of different types of service permission information; and perform a merging process on the multiple target permission subsets to obtain the target permission set matching the service group.

[0010] In one embodiment of the present application, based on the foregoing solution, the combination unit is further specifically configured to: respectively verify the multiple target permission subsets based on a received verification instruction; and if all the multiple target permission subsets pass the verification, perform a merging process on the multiple target permission subsets to obtain the target permission set matching the service group.

[0011] In one embodiment of the present application, based on the foregoing solution, the classification module is specifically configured to: classify the acquired service permission information to obtain a service permission set of menu type, a service permission set of data type, and a permission set of operation type.

[0012] In one embodiment of the present application, based on the foregoing solution, the acquisition module is specifically configured to: respectively acquire target service permission information from the service permission set of menu type, the service permission set of data type, and the permission set of operation type to obtain the multiple target service permission information.

[0013] In one embodiment of the present application, based on the foregoing solution, the apparatus further includes: a determination module configured to determine the role information of the service party, where the role information represents the classification information of service parties with the same permissions; and an addition module configured to add the service party to a service group matching the role information of the service party.

[0014] According to one aspect of the embodiments of the present application, an electronic device is provided, including: one or more processors; a storage device for storing one or more programs, which, when executed by the one or more processors, cause the electronic device to implement the permission management method as described above.

[0015] According to one aspect of the embodiments of the present application, a computer-readable medium is provided, on which a computer program is stored, and when the computer program is executed by a processor of a computer, the permission management method as described above is implemented.

[0016] According to one aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which, when executed by a processor of a computer, implement the permission management method as described above.

[0017] In the technical solution provided by the embodiments of the present application, by classifying service permission information and obtaining multiple target service permission information based on multiple classified service permission sets, and then combining the multiple target service permission information to obtain a target permission set. The obtained target permission set includes various types of service permission information, the granularity division of service permissions is finer, and it is not easy to have the phenomenon of missing or over-assigning; thus, based on this target permission set, the granularity of permission management for the service parties included in the service group is also finer. Compared with the manual one-by-one configuration method in the related art, the accuracy of permission management is higher, and at the same time, the workload of the relevant staff responsible for permission management is reduced, saving human resources.

[0018] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. Brief Description of the Drawings

[0019] The drawings here are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with the present application, and are used together with the specification to explain the principles of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and those of ordinary skill in the art can obtain other drawings based on these drawings without creative efforts. In the drawings:

[0020] Figure 1 is a schematic diagram of an exemplary implementation environment where the technical solution of the embodiments of the present application can be applied;

[0021] Figure 2 is a flowchart of the permission management method shown in an exemplary embodiment of the present application;

[0022] Figure 3 is a flowchart of the permission management method shown in an exemplary embodiment of the present application;

[0023] Figure 4 is Figure 2 The flowchart of step S203 in the illustrated embodiment in an exemplary embodiment;

[0024] Figure 5 is Figure 4 The flowchart of step S401 in the illustrated embodiment in an exemplary embodiment;

[0025] Figure 6 is Figure 4 The flowchart of step S402 in the illustrated embodiment in an exemplary embodiment;

[0026] Figure 7 is Figure 6 The flowchart of step S602 in the illustrated embodiment in an exemplary embodiment;

[0027] Figure 8 The flowchart of the permission management method shown in an exemplary embodiment of the present application;

[0028] Figure 9 The schematic diagram of the target permission set shown in an exemplary embodiment of the present application;

[0029] Figure 10 The schematic diagram of the structure of the permission management device shown in an exemplary embodiment of the present application;

[0030] Figure 11 The schematic diagram of the structure of the computer system of the electronic device suitable for implementing the embodiments of the present application. Detailed implementation manners

[0031] Here, the exemplary embodiments will be described in detail, and the examples are shown in the drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of the devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0032] The block diagrams shown in the drawings are only functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0033] The flowcharts shown in the accompanying drawings are only illustrative, not necessarily including all content and operations / steps, nor necessarily executed in the described order. For example, some operations / steps can be decomposed, while some operations / steps can be combined or partially combined. Therefore, the actual execution order may change according to the actual situation.

[0034] It should also be noted that: "a plurality of" mentioned in this application means two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally represents an "or" relationship between the associated objects before and after.

[0035] Currently, permission management involves multiple application scenarios. For example, in the application scenario of the operator designing products and services related to the 5th Generation Mobile Communication Technology (5G), the common practice is to manually configure the permissions of each business party (which can also be called users) one by one. Since there are many types of permissions, and there may be an association relationship between different types of permissions, when configuring the permissions of users, the phenomenon of missing or over-configuring often occurs, resulting in many problems in permission management and low accuracy of permission management.

[0036] Based on this, the embodiments of this application propose a permission management method, which not only improves the accuracy of permission management, but also reduces the difficulty of permission management, bringing many conveniences to the development of relevant staff.

[0037] Please refer to Figure 1 , Figure 1 is a schematic diagram of an exemplary implementation environment of this application. This implementation environment includes a terminal device 101 and a server 102, and the terminal device 101 and the server 102 communicate through a wired or wireless network.

[0038] It should be understood that Figure 1 the numbers of the terminal device 101 and the server 102 in

[0039] are only illustrative. According to actual needs, there can be any number of terminal devices 101 and servers 102.

[0040] Among them, the server 102 corresponds to the server side, which can be a server providing various services. It can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. There is no limitation here.

[0041] In some embodiments of the present application, the permission management method can be executed by the server 102. Correspondingly, the permission management device is configured in the server 102. Optionally, the server 102 can classify the obtained service permission information to obtain multiple service permission sets, where one service permission set corresponds to one type, and each service permission set includes multiple service permission information. Then, target service permission information is respectively obtained from the multiple service permission sets to obtain multiple target service permission information. Then, the multiple target service permission information is combined to obtain a target permission set matching the service group. Then, based on the target permission set, permission management is performed on the service parties included in the service group.

[0042] In some embodiments of the present application, the permission management method can be executed by the terminal device 101. Correspondingly, the permission management device is configured in the terminal device 101. Optionally, the terminal device 101 can classify the obtained service permission information to obtain multiple service permission sets, where one service permission set corresponds to one type, and each service permission set includes multiple service permission information. Then, target service permission information is respectively obtained from the multiple service permission sets to obtain multiple target service permission information. Then, the multiple target service permission information is combined to obtain a target permission set matching the service group. Then, based on the target permission set, permission management is performed on the service parties included in the service group.

[0043] The following elaborates in detail on various implementation details of the technical solutions of the embodiments of the present application:

[0044] Please refer to Figure 2 , Figure 2 which is a flowchart of the permission management method shown in an embodiment of the present application. This method can be applied to Figure 1 the implementation environment shown in Figure 1 and is executed by the server 102 or the terminal device 101 in the implementation environment shown in Figure 2 As shown, the permission management method at least includes steps S201 to S204, which are introduced in detail as follows:

[0045] Step S201: Classify the obtained business permission information to obtain multiple business permission sets. Among them, one business permission set corresponds to one type, and each business permission set includes multiple business permission information.

[0046] In the embodiments of the present application, the business permission information refers to the permission information related to the business. When a business party is assigned the permission information, it means that the business party can access the resources corresponding to the permission information. Among them, there are usually multiple business permission information involved in one business. For example, Business 1 can correspond to business permission information 1-20, and Business 2 can correspond to business permission information 21-30.

[0047] In the embodiments of the present application, the business permission set refers to a set including multiple business permission information. Among them, one business permission set corresponds to one type, that is, the multiple business permission information contained in one business permission set all belong to the same type.

[0048] For example, please refer to Table 1, which is an example of classifying the obtained business permission information. After classifying the obtained business permission information, multiple business permission sets can be obtained, and each business permission set contains multiple business permission information.

[0049] Type Business permission set Business permission information A A’ a1, a2, a3, a4, a5, a6, a7 B B’ b1, b2, b3, b4 C C’ c1, c2, c3, c4, c5, c6, c7, c8, c9, c10 …… …… ……

[0050] Table 1

[0051] In an embodiment of the present application, the process of classifying the obtained business permission information in step S201 to obtain multiple business permission sets may include the following steps, which are introduced in detail as follows:

[0052] Classify the obtained business permission information to obtain a business permission set of menu type, a business permission set of data type, and a permission set of operation type.

[0053] That is, in an alternative embodiment, the obtained business permission information is classified from three dimensions, where the three dimensions are the menu dimension, the data dimension, and the operation dimension. Correspondingly, a business permission set of menu type matching the menu dimension, a business permission set of data type matching the data dimension, and a permission set of operation type matching the operation dimension are obtained.

[0054] Among them, in an alternative embodiment, the business permission set of menu type includes, but is not limited to, the business permission information of service orchestration menu, the business permission information of resource orchestration menu, the business permission information of control orchestration menu, etc.

[0055] Among them, the set of business permissions for data types in alternative embodiments includes, but is not limited to, business permission information for business data, business permission information for network data, business permission information for resource data, etc.

[0056] Among them, the set of permissions for operation types in alternative embodiments includes, but is not limited to, business permission information for addition, business permission information for deletion, business permission information for modification, business permission information for query, business permission information for review, business permission information for packaging and release, business permission information for network retirement and deprecation, etc.

[0057] It should be noted that the foregoing examples show the business permission information involved in the application scenarios of the operator's design of 5G-related product services. In other application scenarios, the business permission information shall be subject to the specific application scenario.

[0058] Step S202: Obtain target business permission information from multiple sets of business permissions respectively to obtain multiple pieces of target business permission information.

[0059] In the embodiments of the present application, the obtained business permission information is classified to obtain multiple sets of business permissions. Then, target business permission information can be obtained from multiple sets of business permissions respectively to obtain multiple pieces of target business permission information.

[0060] In the embodiments of the present application, the target business permission information refers to the business permission information obtained from the set of business permissions, that is, the business permission information obtained from the set of business permissions is used as the target business permission information.

[0061] For example, assume that the multiple sets of business permissions obtained are A', B', and C'. Then, at this time, target business permission information a1 can be obtained from the set of business permissions A', target business permission information b1 and b2 can be obtained from the set of business permissions B', and target business permission information c1, c2, c3, and c4 can be obtained from the set of business permissions C'. At this time, the multiple pieces of business permission information a1, b1, b2, c1, c2, c3, and c4 obtained are the target business permission information.

[0062] In an embodiment of the present application, if the multiple sets of business permissions are menu-type business permission sets, data-type business permission sets, and operation-type permission sets; the process of obtaining target business permission information from multiple sets of business permissions respectively in step S202 to obtain multiple pieces of target business permission information may include the following steps, which are introduced in detail as follows:

[0063] Obtain target business permission information from the menu-type business permission set, the data-type business permission set, and the operation-type permission set respectively to obtain multiple pieces of target business permission information.

[0064] That is, in an alternative embodiment, if the multiple business permission sets obtained are business permission sets of menu type, business permission sets of data type, and permission sets of operation type, then at this time, the target business permission information can be obtained from the business permission sets of menu type, business permission sets of data type, and permission sets of operation type respectively, so as to obtain multiple pieces of target business permission information.

[0065] It should be noted that in actual applications, the process of obtaining multiple pieces of target business permission information can be flexibly adjusted according to specific application scenarios.

[0066] Step S203: Combine the multiple pieces of target business permission information to obtain a target permission set that matches the business group.

[0067] In the embodiment of the present application, the target business permission information is obtained from multiple business permission sets respectively to obtain multiple pieces of target business permission information, and then the multiple pieces of target business permission information can be combined to obtain a target permission set that matches the business group.

[0068] In the embodiment of the present application, a business group refers to a group / set including one or more business parties. Among them, the permission information of the one or more business parties included in a business group is the same, that is, they all correspond to a target permission set.

[0069] In an embodiment of the present application, please refer to Figure 3 , before the process of combining the multiple pieces of target business permission information in step S203 to obtain a target permission set that matches the business group, the method may further include the following steps, which are introduced in detail as follows:

[0070] Step S301: Determine the role information of the business party, where the role information represents the classification information of business parties with the same permissions;

[0071] Step S302: Add the business party to the business group that matches the role information of the business party.

[0072] That is, in an alternative embodiment, first, the role information of the business party is determined, where the role information represents the classification information of business parties with the same permissions, and then the business party is added to the business group that matches the role information of the business party.

[0073] Among them, in an alternative embodiment, the relationship between the business group and the role information is one-to-one, that is, one business group corresponds to one role information.

[0074] For example, as shown in Table 2, it is an example of the relationship between a business group, role information, and business parties. Among them, business group 1' corresponds to role information 1, business group 2' corresponds to role information 2, and business group 3' corresponds to role information 3. Each business group contains multiple business parties respectively. It can be understood that if a new business party 29 is added and the role information of business party 29 is determined to be 2, then at this time, business party 29 can be added to business group 2' that matches the role information 2 of business party 29 (not shown in Table 2).

[0075] Role information Business group Business party 1 1’ 11、12、13、14、15 2 2’ 21、22、23、24、25、26、27、28 3 3’ 31、32、33、34 …… …… ……

[0076] Table 2

[0077] In the embodiment of the present application, the target permission set refers to the permission set matched by the business group, that is, the obtained permission set matched by the business group is used as the target permission set.

[0078] In this way, by pre-adding business parties to the business groups that match the role information of the business parties, permission settings can be performed only on the business groups, rather than setting the same permissions for each business party separately, reducing the amount of permission setting data, saving system overhead, thus reducing the difficulty of permission management and improving the flexibility and efficiency of permission management.

[0079] In an embodiment of the present application, please refer to Figure 4 , in step S203, the process of combining multiple target business permission information to obtain the target permission set matched by the business group may include the following steps, which are introduced in detail as follows:

[0080] Step S401, based on the preset mapping relationship table of business permission information coding identifiers, obtain the coding identifiers of multiple target business permission information respectively;

[0081] Step S402, combine the coding identifiers of multiple target business permission information to obtain the target permission set matched by the business group.

[0082] That is to say, in an alternative embodiment, the coding identifiers of multiple target business permission information can be obtained respectively based on the preset mapping relationship table of business permission information coding identifiers, and then the coding identifiers of multiple target business permission information are combined to obtain the target permission set matched by the business group.

[0083] Among them, in an alternative embodiment, the preset mapping relationship table of business permission information coding identifiers is pre-generated, and the mapping relationship between business permission information and coding identifiers is included in the preset mapping relationship table of business permission information coding identifiers. For example, as shown in Table 3, it is an example of a preset mapping relationship table of business permission information coding identifiers.

[0084]

[0085]

[0086] Table 3

[0087] In this way, by combining the coding identifiers based on the target service permission information, the amount of data in the obtained target permission set will be relatively small, saving system storage resources and being more convenient for the development and management of the staff responsible for permission management.

[0088] In an embodiment of the present application, please refer to Figure 5 , the process of respectively obtaining the coding identifiers of multiple target service permission information based on the preset service permission information coding identifier mapping table in step S401 may include the following steps, which are introduced in detail as follows:

[0089] Step S501, set the coding identifiers for the multiple service permission information included in the multiple service permission sets respectively to generate a preset service permission information coding identifier mapping table;

[0090] Step S502, respectively obtain the coding identifiers of multiple target service permission information from the preset service permission information coding identifier mapping table.

[0091] That is, in an alternative embodiment, it may be to set the coding identifiers for the multiple service permission information included in the multiple service permission sets respectively to generate a preset service permission information coding identifier mapping table, and then respectively obtain the coding identifiers of multiple target service permission information from the preset service permission information coding identifier mapping table.

[0092] Among them, in an alternative embodiment, multiple service permission sets are obtained, and then the coding identifiers can be set for the multiple service permission information included in each service permission set respectively. It can be understood that the coding identifiers of different service permission sets can be the same or different, where:

[0093] Exemplarily, if the coding identifiers of different service permission sets are the same, as shown in Table 3, the coding starts from 1; in this way, the service permission information in different service permission sets starts coding from the same number, which is not easy to make mistakes.

[0094] Exemplarily, if the coding identifiers of different permission sets are different, still as shown in Table 3, but the coding identifiers corresponding to the service permission information a1 and a2 are 11 and 12 respectively, the coding identifiers corresponding to the service permission information b1, b2, and b3 are 21, 22, and 23 respectively, the coding identifiers corresponding to the service permission information c1 and c2 are 31 and 32 respectively, and the coding identifiers of other service permission information can be deduced in sequence and will not be elaborated here; in this way, the coding identifiers of the service permission information in different service permission sets are distinguished, which can be more intuitive and clear, and the service permission set to which the service permission information belongs can be determined according to the coding identifier.

[0095] For example, assume that the target service permission information is a1, b3, and c2. Therefore, by looking up the preset mapping table of service permission information coding identifiers as shown in Table 3, the coding identifier 1 corresponding to the target service permission information a1, the coding identifier 3 corresponding to the target service permission information b3, and the coding identifier 2 corresponding to the target service permission information c2 can be obtained. After that, the coding identifiers 1, 3, and 2 are combined to obtain the target permission set (1, 3, 2) matching the service group.

[0096] In this way, by pre-generating the preset mapping table of service permission information coding identifiers, the coding identifiers of multiple target service permission information can be obtained quickly and simply, which improves the rate of obtaining the coding identifiers of multiple target service permission information.

[0097] In an embodiment of the present application, please refer to Figure 6 , in step S402, the process of combining the coding identifiers of multiple target service permission information to obtain the target permission set matching the service group may include the following steps, which are introduced in detail as follows:

[0098] Step S601, based on the association relationship between the target service permission information, combine the coding identifiers of multiple target service permission information to obtain multiple target permission subsets; wherein, each target permission subset includes the coding identifiers of different types of service permission information;

[0099] Step S602, perform a merging process on multiple target permission subsets to obtain the target permission set matching the service group.

[0100] That is, in an alternative embodiment, based on the association relationship between the target service permission information, the coding identifiers of multiple target service permission information can be combined to obtain multiple target permission subsets, where each target permission subset includes the coding identifiers of different types of service permission information, and then a merging process is performed on multiple target permission subsets to obtain the target permission set matching the service group.

[0101] Among them, the association relationship between the target business permission information in the alternative embodiments refers to a possible relationship or an impossible relationship that may exist between the target business permissions. For example, the business permission information of relevant menus involves the business permission information of relevant data, which can be understood as an inclusion relationship exists between the business permission information of relevant menus and the business permission information of relevant data, that is, the business permission information of relevant menus includes the business permission information of relevant data; the business permission information of relevant data involves the business permission information of relevant operations, which can be understood as an inclusion relationship exists between the business permission information of relevant data and the business permission information of relevant operations, that is, the business permission information of relevant data includes the business permission information of relevant operations.

[0102] Among them, the target permission subset in the alternative embodiments refers to a set including the coding identifiers of different types of business permission information, which is a subset in the target permission set.

[0103] For example, assume that the target business permission information is a1, b1, c1, c2. Therefore, by looking up the preset mapping table of business permission information coding identifiers shown in Table 3, the coding identifier 1 corresponding to the target business permission information a1, the coding identifier 1 corresponding to the target business permission information b1, the coding identifier 1 corresponding to the target business permission information c1, and the coding identifier 2 corresponding to the target business permission information c2 can be obtained; at the same time, assume that the association relationship between the target business permission information a1, b1, c1, c2 is that a1 includes b1, and b1 includes c1, c2. At this time, according to this association relationship, the coding identifiers 1, 1, 1, 2 are combined to obtain the target permission subset 1(1, 1, 1) and the target permission subset 2(1, 1, 2). Then, the target permission subset 1(1, 1, 1) and the target permission subset 2(1, 1, 2) are merged to obtain the target permission sets (1, 1, 1), (1, 1, 2) matching the business group.

[0104] In this way, based on the association relationship between the target business permission information, multiple target permission subsets are obtained, and then the final target permission set is obtained according to the multiple target permission subsets, making the granularity of permission management more delicate and simple to implement.

[0105] In an embodiment of the present application, please refer to Figure 7 , the process of merging multiple target permission subsets in step S602 to obtain the target permission set matching the business group may include the following steps, which are introduced in detail as follows:

[0106] Step S701, respectively verify multiple target permission subsets based on the received verification instruction;

[0107] Step S702: If the multiple target permission subsets all pass the verification, the multiple target permission subsets are merged to obtain a target permission set that matches the business group.

[0108] That is, in an optional embodiment, a verification instruction can be received, and then multiple target permission subsets can be verified separately based on the received verification instruction, and then it is determined whether to merge the multiple target permission subsets based on the verification results to obtain a target permission set that matches the business group.

[0109] Among them, the verification instruction received in the optional embodiment can be issued by relevant staff responsible for authority management, and the verification instruction can be issued in any way, including but not limited to voice input, click operation, etc.

[0110] For example, if multiple target permission subsets are all verified, it indicates that the multiple target permission subsets are all correct. Therefore, the multiple target permission subsets can be merged to obtain a target permission set that matches the business group.

[0111] For example, if there is at least one target permission subset among multiple target permission subsets that fails to pass verification, it indicates that the target permission subset is wrong. Therefore, the wrong target permission subset can be eliminated at this time, and its corresponding correct target permission subset can be generated until all target permission subsets are correct. After that, the multiple target permission subsets can be merged to obtain a target permission set that matches the business group.

[0112] For example, let's assume that the above example is continued, and target permission subset 1 (1,1,1) and target permission subset 2 (1,1,2) are obtained. Then, based on the received verification instruction, target permission subset 1 (1,1,1) and target permission subset 2 (1,1,2) are verified. If both target permission subset 1 (1,1,1) and target permission subset 2 (1,1,2) pass the verification, target permission subset 1 (1,1,1) and target permission subset 2 (1,1,2) are merged to obtain target permission sets (1,1,1) and (1,1,2) that match the business group; if at least one of target permission subset 1 (1,1,1) and target permission subset 2 (1,1,2) fails the verification, no processing is performed at this time.

[0113] In this way, by verifying multiple target permission subsets, and only when multiple target permission subsets have passed the verification, the multiple target permission subsets are merged to obtain the final target permission set, which greatly improves the accuracy of the obtained target permission set, thereby improving the accuracy of permission management for business parties contained in the business group based on the target permission set.

[0114] Step S204, perform permission management on the business parties included in the business group based on the target permission set.

[0115] In the embodiment of the present application, multiple target business permission information is combined to obtain a target permission set matching the business group. After that, permission management can be performed on the business parties included in the business group based on the target permission set.

[0116] For example, assume that business parties 11, 12, 13, 14, and 15 are included in business group 1', and the target permission set corresponding to business group 1' is (1, 1, 1), (1, 1, 2). Therefore, permission management is performed on business parties 11, 12, 13, 14, and 15 according to the target permission sets (1, 1, 1), (1, 1, 2), that is, business parties 11, 12, 13, 14, and 15 can access the resources corresponding to the permission information (1, 1, 1), (1, 1, 2).

[0117] In the embodiment of the present application, by classifying the business permission information, multiple target business permission information is obtained based on multiple classified business permission sets, and then the multiple target business permission information is combined to obtain a target permission set. The target permission set obtained in this way includes various types of business permission information, the granularity division of business permissions is more delicate, and it is not easy to have the phenomenon of missing or over - matching; thus, the granularity of performing permission management on the business parties included in the business group based on this target permission set is also more delicate. Compared with the method of manual configuration one by one in the related art, the accuracy of permission management is higher, and at the same time, the workload of the relevant staff responsible for permission management is reduced, saving human resources.

[0118] The following details the specific application scenarios of the embodiment of the present application:

[0119] Please refer to Figure 8 , Figure 8 which is a flowchart of the permission management method shown in an embodiment of the present application.

[0120] As Figure 8 shown, the permission management method at least includes steps S801 to S806, which are introduced in detail as follows:

[0121] Step S801, classify the obtained business permission information to obtain a business permission set of menu type, a business permission set of data type, and a permission set of operation type.

[0122] Optionally, one business permission set corresponds to one type, and each business permission set includes multiple business permission information.

[0123] Optionally, the set of business permissions of the menu type includes the business permission information of the service orchestration menu, the business permission information of the resource orchestration menu, and the business permission information of the control orchestration menu.

[0124] Optionally, the set of business permissions of the data type includes the business permission information of business data, the business permission information of network data, and the business permission information of resource data.

[0125] Optionally, the set of permissions of the operation type includes the business permission information of addition, the business permission information of deletion, the business permission information of modification, the business permission information of query, the business permission information of review, the business permission information of packaging and publishing, the business permission information of retiring from the network and deprecating, etc.

[0126] Step S802, respectively obtain the target business permission information from the set of business permissions of the menu type, the set of business permissions of the data type, and the set of permissions of the operation type, to obtain multiple pieces of target business permission information.

[0127] Optionally, the business permission information of the relevant menu can be regarded as the x dimension, the business permission information of the relevant data can be regarded as the y dimension, and the business permission information of the relevant operation can be regarded as the z dimension.

[0128] Optionally, let A(x1, y1, z1), which means having the z1 operation permission (also known as function permission) information for viewing the y1 data type in the x1 menu interface. Among them, if there are n data types in the x1 interface, then y1 in A(x1, y1, z1) has n values, and there are mn operations for the nth data type. Then the number of operation permissions in the x1 menu interface is: Specifically, they are respectively:

[0129]

[0130] Among them, z is not repeated within each row and can be repeated in different rows, such as May be the same.

[0131] Step S803, respectively set the encoding identifiers for the multiple pieces of business permission information contained in the multiple business permission sets, and generate a preset business permission information encoding identifier mapping relationship table.

[0132] Optionally, for the specific implementation process of step S803, please refer to the foregoing embodiments and will not be elaborated here.

[0133] Step S804, respectively obtain the encoding identifiers of the multiple pieces of target business permission information from the preset business permission information encoding identifier mapping relationship table.

[0134] Optionally, for the specific implementation process of step S804, please refer to the foregoing embodiments and will not be elaborated here.

[0135] Step S805: Based on the association relationships among the target business permission information, combine the coding identifiers of multiple target business permission information to obtain multiple target permission subsets; wherein each target permission subset includes the coding identifiers of different types of business permission information.

[0136] For example, as shown in Table 4, under the business permission information of the service orchestration menu, there is business permission information for business data and network data. At the same time, under the business permission information of business data and network data, there is business permission information for addition, deletion, modification, query, approval, packaging and release, and network retirement and deprecation. Based on the coding identifiers of each business permission information, the permission subsets obtained for the business permission information under the service orchestration menu are as follows:

[0137] Serial number Business permission information Permission subset 1 Service orchestration menu, business data, add (1,1,1) 2 Service orchestration menu, business data, delete (1,1,2) 3 Service orchestration menu, business data, modify (1,1,3) 4 Service orchestration menu, business data, query (1,1,4) 5 Service orchestration menu, business data, audit (1,1,5) 6 Service orchestration menu, business data, package and publish (1,1,6) 7 Service orchestration menu, business data, retire and deprecate (1,1,7) 8 Service orchestration menu, network data, add (1,2,1) 9 Service orchestration menu, network data, delete (1,2,2) 10 Service orchestration menu, network data, modify (1,2,3) 11 Service orchestration menu, network data, query (1,2,4) 12 Service orchestration menu, network data, audit (1,2,5) 13 Service orchestration menu, network data, package and publish (1,2,6) 14 Service orchestration menu, network data, retire and deprecate (1,2,7)

[0138] Table 4

[0139] For another example, as shown in Table 5, under the business permission information of the resource orchestration menu, there is business permission information for business data, network data, and resource data. At the same time, under the business permission information of business data, network data, and resource data, there is business permission information for addition, deletion, modification, query, and packaging and release. Based on the coding identifiers of each business permission information, the permission subsets obtained for the business permission information under the resource orchestration menu are as follows:

[0140] Serial number Business permission information Permission subset 1 Resource orchestration menu, business data, add (2,1,1) 2 Resource orchestration menu, business data, delete (2,1,2) 3 Resource orchestration menu, business data, modify (2,1,3) 4 Resource orchestration menu, business data, query (2,1,4) 5 Resource orchestration menu, business data, package and publish (2,1,5) 6 Resource orchestration menu, network data, add (2,2,1) 7 Resource orchestration menu, network data, delete (2,2,2) 8 Resource orchestration menu, network data, modify (2,2,3) 9 Resource orchestration menu, network data, query (2,2,4) 10 Resource orchestration menu, network data, package and publish (2,2,5) 11 Resource orchestration menu, resource data, add (2,3,1) 12 Resource orchestration menu, resource data, delete (2,3,2) 13 Resource orchestration menu, resource data, modify (2,3,3) 14 Resource orchestration menu, resource data, query (2,3,4) 15 Resource orchestration menu, resource data, package and publish (2,3,5)

[0141] Table 5

[0142] It should be noted that Table 4 and Table 5 are the multiple permission subsets obtained by combining multiple business permission information in sequence. In actual applications, it is necessary to combine the multiple target business permission information obtained to obtain multiple target permission subsets; for example, assume the target business permission information is service orchestration menu, resource orchestration menu, business data, addition, deletion, modification, and query, then the obtained target permission subsets are as shown in Table 6 below:

[0143] (1,1,1) (2,1,1) (1,1,2) (2,1,2) (1,1,3) (2,1,3) (1,1,4) (2,1,4)

[0144] Table 6

[0145] Step S806: Perform a merging process on multiple target permission subsets to obtain a target permission set that matches the business group.

[0146] Optionally, a verification instruction issued by an administrator can be received, and then based on the received verification instruction, multiple target permission subsets are verified respectively. Then, according to the verification results, it is determined whether to perform a merging process on the multiple target permission subsets to obtain a target permission set that matches the business group. Among them, the obtained target permission set can be as shown in Table 6 above.

[0147] Meanwhile, please refer to Figure 9 As shown, it is an example of a target permission set. Among them, the target permission set includes multiple target permission subsets (shown as target permission subset 1, target permission subset 2, and target permission subset 3 in the figure). Each target permission subset is composed of menu permissions (i.e., business permission information of related menus), data permissions (i.e., business permission information of related data), and function permissions (i.e., business permission information of related operations).

[0148] In the embodiment of the present application, the permission settings are refined from three aspects: menu, data, and operation. This is fine-grained permission management, which greatly improves the accuracy of permission management.

[0149] Figure 10 It is a block diagram of a permission management device shown in an embodiment of the present application. As Figure 10 shown, the permission management device may include:

[0150] A classification module 1001, configured to classify the obtained business permission information to obtain multiple business permission sets. Among them, one business permission set corresponds to one type, and each business permission set includes multiple business permission information.

[0151] An acquisition module 1002, configured to respectively acquire target business permission information from multiple business permission sets to obtain multiple target business permission information.

[0152] A combination module 1003, configured to combine multiple target business permission information to obtain a target permission set that matches the business group.

[0153] A management module 1004, configured to perform permission management on the business parties included in the business group based on the target permission set. <0,

[0154] In an embodiment of the present application, the combination module 1003 includes:

[0155] An acquisition unit, configured to respectively acquire the coding identifiers of multiple target business permission information based on a preset mapping relationship table of business permission information coding identifiers.

[0156] A combination unit, configured to combine the coding identifiers of multiple target business permission information to obtain a target permission set that matches the business group.

[0157] In an embodiment of the present application, the obtaining unit is specifically configured to:

[0158] Set encoding identifiers for multiple business permission information included in multiple business permission sets respectively, and generate a preset mapping table of business permission information encoding identifiers;

[0159] Obtain the encoding identifiers of multiple target business permission information from the preset mapping table of business permission information encoding identifiers.

[0160] In an embodiment of the present application, the combining unit is specifically configured to:

[0161] Based on the association relationship between target business permission information, combine the encoding identifiers of multiple target business permission information to obtain multiple target permission subsets; wherein, each target permission subset includes encoding identifiers of different types of business permission information;

[0162] Perform a merging process on multiple target permission subsets to obtain a target permission set that matches the business group.

[0163] In an embodiment of the present application, the combining unit is further specifically configured to:

[0164] Verify multiple target permission subsets respectively based on the received verification instruction;

[0165] If multiple target permission subsets all pass the verification, perform a merging process on multiple target permission subsets to obtain a target permission set that matches the business group.

[0166] In an embodiment of the present application, the classification module 1001 is specifically configured to:

[0167] Classify the obtained business permission information to obtain a business permission set of menu type, a business permission set of data type, and a permission set of operation type.

[0168] In an embodiment of the present application, the obtaining module 1002 is specifically configured to:

[0169] Obtain target business permission information from the business permission set of menu type, the business permission set of data type, and the permission set of operation type respectively to obtain multiple target business permission information.

[0170] In an embodiment of the present application, the device further includes:

[0171] A determining module, configured to determine the role information of the business party, where the role information represents the classification information of business parties with the same permissions;

[0172] An adding module, configured to add a business party to a business group that matches the role information of the business party.

[0173] It should be noted that the permission management device provided in the above embodiment and the permission management method provided in the foregoing embodiment belong to the same concept. The specific manners in which each module and unit perform operations have been described in detail in the method embodiment, and will not be elaborated here.

[0174] An embodiment of the present application further provides an electronic device, including: one or more processors; a storage device, configured to store one or more programs, and when the one or more programs are executed by the one or more processors, enable the electronic device to implement the permission management method provided in each of the foregoing embodiments.

[0175] Figure 11 The structural schematic diagram of a computer system of an electronic device suitable for implementing the embodiments of the present application is shown.

[0176] It should be noted that Figure 11 The computer system 1100 of the shown electronic device is only an example, and should not impose any limitation on the functions and usage scope of the embodiments of the present application.

[0177] As Figure 11 shown, the computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1102 or the program loaded from the storage section 1108 into the random access memory (RAM) 1103, such as executing the method in the above embodiment. In the RAM 1103, various programs and data required for system operations are also stored. The CPU 1101, ROM 1102, and RAM 1103 are connected to each other through a bus 1104. The input / output (I / O) interface 1105 is also connected to the bus 1104.

[0178] The following components are connected to the I / O interface 1105: an input section 1106 including a keyboard, a mouse, etc.; an output section 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. The drive 1110 is also connected to the I / O interface 1105 as required. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as required so that a computer program read therefrom is installed into the storage section 1108 as required.

[0179] Specifically, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for performing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication section 1109, and / or installed from the removable medium 1111. When the computer program is executed by the central processing unit (CPU) 1101, various functions defined in the system of the present application are executed.

[0180] It should be noted that the computer-readable medium shown in the embodiments of the present application can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable storage medium can be any tangible medium that contains or stores a program, and this program can be used by or in combination with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable computer program. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, and this computer-readable medium can send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted by any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0181] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present application. Among them, each block in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, as well as the combination of blocks in the block diagram or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0182] The units involved in the embodiments described in this application can be implemented in software or in hardware, and the described units can also be provided in a processor. Among them, the names of these units do not constitute a limitation to the units themselves in some cases.

[0183] Another aspect of this application also provides a computer-readable medium, on which a computer program is stored. When the computer program is executed by a processor, the above-described privilege management method is implemented. The computer-readable medium may be included in the electronic device described in the above embodiments, or may exist alone without being assembled into the electronic device.

[0184] Another aspect of this application also provides a computer program product or a computer program. The computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable medium. The processor of the computer device reads the computer instructions from the computer-readable medium, and the processor executes the computer instructions, so that the computer device executes the privilege management method provided in the above various embodiments.

[0185] The above content is only a preferred exemplary embodiment of this application and is not used to limit the implementation of this application. Those of ordinary skill in the art can easily make corresponding adaptations or modifications according to the main concepts and spirits of this application. Therefore, the protection scope of this application should be subject to the protection scope required by the claims.

Claims

1. A permission management method, characterized in that, The method includes: Classifying the obtained business permission information to obtain multiple business permission sets; wherein, one business permission set corresponds to one type, and each business permission set includes multiple business permission information; Respectively obtaining target business permission information from the multiple business permission sets to obtain multiple target business permission information; Based on a preset mapping relationship table of business permission information coding identifiers, respectively obtaining the coding identifiers of the multiple target business permission information; Based on the association relationship between the target business permission information, combining the coding identifiers of the multiple target business permission information to obtain multiple target permission subsets; wherein, each target permission subset includes the coding identifiers of different types of business permission information; Respectively verifying the multiple target permission subsets based on the received verification instruction; If all the multiple target permission subsets pass the verification, then performing a merging process on the multiple target permission subsets to obtain a target permission set matching the business group; If at least one of the multiple target permission subsets fails to pass the verification, then removing the target permission subsets that fail to pass the verification and generating correct target permission subsets until all the target permission subsets are correct, and performing a merging process on the correct target permission subsets to obtain a target permission set matching the business group; Managing the permissions of the business parties included in the business group based on the target permission set; 2. The method according to claim 1, wherein The step of respectively obtaining the coding identifiers of the multiple target business permission information based on a preset mapping relationship table of business permission information coding identifiers includes: Respectively setting coding identifiers for the multiple business permission information included in the multiple business permission sets to generate a preset mapping relationship table of business permission information coding identifiers; Respectively obtaining the coding identifiers of the multiple target business permission information from the preset mapping relationship table of business permission information coding identifiers; 3. The method according to any one of claims 1 to 2, characterized in that, The step of classifying the obtained business permission information to obtain multiple business permission sets includes: Classifying the obtained business permission information to obtain a business permission set of menu type, a business permission set of data type, and a permission set of operation type; The step of respectively obtaining target business permission information from the multiple business permission sets to obtain multiple target business permission information includes: Respectively obtaining target business permission information from the business permission set of menu type, the business permission set of data type, and the permission set of operation type to obtain the multiple target business permission information; 4. The method according to any one of claims 1 to 2, characterized in that, Before obtaining the target permission set matching the business group, the method further includes: Determining the role information of the business party, where the role information represents the classification information of business parties with the same permissions; Adding the business party to the business group matching the role information of the business party; 5. A privilege management device, characterized in that, The device includes: A classification module configured to classify the obtained business permission information to obtain multiple business permission sets; wherein, one business permission set corresponds to one type, and each business permission set includes multiple business permission information; An acquisition module, configured to respectively acquire target business permission information from the multiple business permission sets to obtain multiple pieces of target business permission information; An acquisition unit, configured to respectively acquire the encoding identifiers of the multiple pieces of target business permission information based on a preset business permission information encoding identifier mapping relation table; A combination unit, configured to combine the encoding identifiers of the multiple pieces of target business permission information based on the association relationship between the target business permission information to obtain multiple target permission subsets; wherein, each target permission subset includes the encoding identifiers of different types of business permission information; It is further configured to respectively verify the multiple target permission subsets based on the received verification instruction; if all the multiple target permission subsets pass the verification, perform a merging process on the multiple target permission subsets to obtain a target permission set matching the business group; if at least one of the multiple target permission subsets fails to pass the verification, remove the target permission subsets that fail to pass the verification, and generate correct target permission subsets until all target permission subsets are correct, and perform a merging process on the correct target permission subsets to obtain a target permission set matching the business group; A management module, configured to perform permission management on the business parties included in the business group based on the target permission set.

6. An electronic device, characterized in that, Including: One or more processors; A storage device for storing one or more programs, which when executed by the one or more processors, cause the electronic device to implement the permission management method according to any one of claims 1 to 4.

7. A computer-readable medium having a computer program stored thereon, characterized in that, The computer program, when executed by a computer processor, implements the permission management method according to any one of claims 1 to 4.

Images