Access control authentication method and device

Abstract

This specification provides one or more embodiments of a permission authentication method and apparatus, applied to a multi-level resource permission management system. At least one level of the multi-level resources has permission points, which define permission types for the corresponding resource and user groups granted the corresponding permissions. The method includes: in response to a need to authenticate whether a target user has target permissions for a target resource, obtaining a current-level permission set and an ancestor permission set; determining whether the inheritance relationship between the target resource and each permission point in the ancestor permission set is broken, and filtering out permission points whose inheritance relationship is not broken based on the determination result; and authenticating whether the target user has target permissions for the target resource based on the current-level permission set and the filtered permission points.

Description

Technical Field

[0001] This specification relates to the field of access control through one or more embodiments, and more particularly to an access authentication method and apparatus. Background Technology

[0002] In a storage system, it is necessary to verify whether a user has the necessary permissions to perform a specific operation on a given resource. Permission authentication is a crucial step in storage system security. If the accuracy of permission authentication cannot be guaranteed, the security of the storage system cannot be ensured.

[0003] In existing technologies, access control for multi-level resources can be achieved using ACLs (Access Control Lists). In a multi-level resource access control system, the permissions of a parent resource are inherited by its child resources by default. However, when the inheritance of permissions on a parent resource is broken, the permissions of the child resources may be affected during the permission authentication process. How to quickly identify a user's permissions for a child resource or its sub-level resources after the inheritance relationship is broken is a problem that those skilled in the art need to solve. Summary of the Invention

[0004] In view of this, one or more embodiments of this specification provide an authorization authentication method and apparatus.

[0005] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions:

[0006] According to a first aspect of one or more embodiments of this specification, a permission authentication method is proposed, applied to a multi-level resource permission management system, wherein at least one level of the multi-level resources has permission points, the permission points being used to define permission types for the corresponding resource and user groups granted the corresponding permissions, the method comprising:

[0007] In response to the need to identify whether a target user has the target permission for the target resource, the current level permission set and the ancestor permission set are obtained. The current level permission set is the set of permission points on which the user has been granted the corresponding permission on the target resource, and the ancestor permission set is the set of permission points on which the user has been granted the corresponding permission on all ancestor resources of the target resource.

[0008] Determine whether the inheritance relationship of the target resource to each permission point in the ancestor permission set has been broken, and filter out the permission points whose inheritance relationship has not been broken according to the determination result;

[0009] Based on the set of permissions at this level and the filtered permission points, determine whether the target user has the target permission for the target resource.

[0010] According to a second aspect of one or more embodiments of this specification, a permission authentication device is provided for use in a multi-level resource permission management system, wherein at least one level of the multi-level resources has permission points, the permission points being used to define permission types for the corresponding resource and user groups granted the corresponding permissions, the device comprising:

[0011] The acquisition unit is used to acquire the current level permission set and the ancestor permission set in response to the need to identify whether the target user has the target permission for the target resource. The current level permission set is the set of permission points on which the user has been granted the corresponding permission on the target resource, and the ancestor permission set is the set of permission points on which the user has been granted the corresponding permission on all ancestor resources of the target resource.

[0012] The judgment unit is used to determine whether the inheritance relationship of the target resource to each permission point in the ancestor permission set has been interrupted, and to filter out the corresponding permission points whose inheritance relationship has not been interrupted based on the judgment result.

[0013] The identification unit is used to identify whether the target user has target permissions for the target resource based on the current level permission set and the filtered permission points.

[0014] According to a third aspect of one or more embodiments of this specification, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps of the method described in the first aspect.

[0015] According to a fourth aspect of one or more embodiments of this specification, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, performs the steps of the method described in the first aspect.

[0016] The technical solution provided in this specification achieves rapid identification of user permissions for target resources in a multi-level resource permission management system by obtaining the set of permission points on the target resource for which the user has been granted corresponding permissions, and by determining whether the target resource has obtained permission points from ancestor resources. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 This is a schematic diagram of an authorization authentication device architecture provided in an exemplary embodiment of this specification;

[0019] Figure 2 This is a flowchart illustrating an exemplary embodiment of an authorization authentication method provided in this specification.

[0020] Figure 3 This is a schematic diagram of a permission model for a permission authentication method provided in an exemplary embodiment of this specification;

[0021] Figure 4 This is a schematic diagram illustrating the permission point setting of an exemplary embodiment of the permission authentication method provided in this specification;

[0022] Figure 5 This is a schematic diagram of the structure of a computer device provided in an exemplary embodiment of this specification;

[0023] Figure 6 This is a schematic diagram of an authorization authentication device provided in an exemplary embodiment of this specification. Detailed Implementation

[0024] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0025] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0026] When managing permissions for resources with multiple levels, the Access Control List (ACL) model is often used for access control. In a multi-level resource access control system, when a resource's directory format is / a / b / c / *, the permission points granted to the parent resource / a / * can be inherited by the child resources / a / b / *. Simultaneously, the permission points granted to resource / a / b / *, as well as the permission points inherited from resource / a / *, can also be inherited by its child resources / a / b / c / *. In a multi-level resource access control system using this model, it's unnecessary to set permissions for all resources. Setting permission points on the parent resource allows all child resources to inherit the permissions corresponding to those points. This access control method eliminates the need to traverse and set permission points for all lower-level resources, effectively reducing the time required for permission setup. However, when a parent resource does not want its permissions to be inherited by its child resource, the inheritance relationship needs to be broken by setting a permission break flag. After the inheritance relationship is broken, the permissions on the child resource need to be re-identified.

[0027] To address the aforementioned problems, this specification provides an authorization authentication method through its embodiments. For example... Figure 1 The diagram shown is a schematic representation of an access control device architecture as illustrated in this specification. Figure 1 As shown, it may include server 11, network 12, and authentication terminals 13, 14, and 15.

[0028] Server 11 can be a physical server containing a single host, or it can be a virtual server hosted in a host cluster. During operation, server 11 can be configured with a multi-level resource permission management system. At least one level of the multi-level resources has permission points. These permission points are used to define the permission types for the corresponding resources and the user groups granted the corresponding permissions. This multi-level resource permission management system can be implemented in software and / or hardware to provide permission authentication services.

[0029] Authentication terminals 13, 14, and 15 refer to electronic devices that the target user can use to initiate permission authentication requests regarding the existence of target permissions for the target resource. For example, authentication terminal 13 is a mobile phone, authentication terminal 14 is a laptop computer, and authentication terminal 15 is a desktop computer. In practice, the target user can obviously also use electronic devices such as tablets, PDAs (Personal Digital Assistants), etc., and one or more embodiments in this specification do not limit this.

[0030] The network 12, which facilitates the interaction between the server 11 and the authentication terminal 13 or 14, can include various types of wired or wireless networks.

[0031] The following is combined Figure 2 This document describes the authorization authentication method used in this instruction manual. Specifically, Figure 2 This is a schematic diagram of an authorization authentication method provided in an exemplary embodiment. For example... Figure 2 As shown, this method is applied to a multi-level resource permission management system, where at least one level of the multi-level resources has permission points. These permission points define the permission types for the corresponding resources and the user groups granted the corresponding permissions. The method may include the following steps:

[0032] S201, in response to the need to identify whether the target user has the target permission for the target resource, obtain the current permission set and the ancestor permission set, wherein the current permission set is the set of permission points on which the user has been granted the corresponding permission on the target resource, and the ancestor permission set is the set of permission points on which the target user has been granted the corresponding permission on all ancestor resources of the target resource.

[0033] The process of permission authentication is the process of determining what permissions a target user has on a target resource. In the multi-level resource permission management system, the permission points for a resource are defined as follows: Figure 3 The model shown is configured as follows. Assume that for resource X, the following settings are applied: Figure 3 The three permission points shown are Policy 1, Policy 2, and Policy 3. Policy 1 corresponds to User Group 1, and the users in User Group 1 have User IDs Uid1, Uid2, and Uid3. Policy 2 corresponds to User Group 2, and the users in User Group 2 have User IDs Uid2 and Uid4. Policy 3 directly corresponds to User Uid1. Based on the above permission settings for resource X, it can be seen that at the current level of resource X, users in User Group 1 (including users with User IDs Uid1, Uid2, and Uid3) are granted permission 1 corresponding to Policy 1; users in User Group 2 (including users with User IDs Uid2 and Uid3) are granted permission 2 corresponding to Policy 2; and the user with User ID Uid1 is granted permission 3 corresponding to Policy 3.

[0034] Assuming the target user's user ID is Uid1 and the target resource is resource X, then for resource X at its current level, it is necessary to obtain the set of permissions for that current level resource. Also, assuming resource X is located in a resource permission management system with three levels, the directory corresponding to resource X can be represented as / Z / Y / X, its parent resource is resource Y, and its corresponding directory is represented as / Z / Y / *, and the parent resource of resource Y is resource Z, with its corresponding directory being / Z / *.

[0035] Resource Y is granted permission point Policy 4, corresponding to Group 1, and Policy 5, corresponding to Group 2. Policy 4 is also equipped with a permission interruption flag, which applies only to Policy 4 and does not affect the inheritance relationship of other permission points. When a permission point is set on a resource at a certain level, and a permission interruption flag is also set on that permission point, although that resource level has the corresponding permissions at that level, when a child resource of that resource level is granted a permission point, the child resource cannot inherit the permission point with the permission interruption flag from the resource level. That is, the inheritance relationship from that resource level to its child resources is interrupted for the permission point with the interruption flag. If the child resources of that resource level do not have any permission settings, the inheritance relationship from that resource level to its child resources cannot be interrupted, and the child resources can inherit the permission point with the permission interruption flag from the resource level. The permission interruption flag cannot be set independently.

[0036] On resource Z, permission points Policy 1, corresponding to Group 1, and Policy 2, corresponding to Group 2, are granted.

[0037] In an exemplary embodiment of this specification, the acquisition of the local permission set can be performed as follows: acquiring all permission points for which the target user has been granted corresponding permissions in the multi-level resources; filtering out the permission points set on the target resource from all acquired permission points, and adding them to the local permission set.

[0038] For example, firstly, obtain all permission points for the corresponding permissions granted to the target user Uid1 in the multi-level resources. These permission points include those directly granted to the user and those granted to the user group to which the user belongs. For the target user Uid1, the directly granted permission point is Policy 3; and since user Uid1 is in user group Group 1, the user group to which user Uid1 belongs is granted permission points including Policy 1 and Policy 4. Therefore, all permission points for the corresponding permissions granted to the target user Uid1 in the multi-level resources are Policy 1, Policy 3, and Policy 4. Then, filter out the permission points set on the target resource X from all permission points. In Policy 1, Policy 3, and Policy 4, the permission points set on the target resource X are Policy 1 and Policy 3. Therefore, the local permission set of the target user Uid1 is {Policy 1, Policy 3}, which means that on resource X, the target user (Uid1) has permission 1 and permission 3 on the target resource X.

[0039] Since {Policy 1, Policy 3} is the set of permission points for the corresponding permissions granted to the target user (Uid1) on the target resource X, the target user Uid1 must have permission 1 and permission 3 on the target resource X.

[0040] Since the target resource may also inherit other permissions for the target user (Uid1) from its parent resource, or even the parent resource of its parent resource, it cannot be assumed that the target user (Uid1) only has permissions 1 and 3 on the target resource X. It is also necessary to determine whether it has inherited other permission points.

[0041] At this point, since the permission points of a parent resource can be inherited by its child resources, and the permission points inherited by a parent resource can also be inherited by its child resources, to know the permissions that user Uid1 has for resource X, it is also necessary to obtain the permission points on the ancestor resources of resource X, namely resources Y and Z, to see if the permission points on these resources can be inherited by resource X.

[0042] In an exemplary embodiment of this specification, the ancestor permission set of a target user can be obtained by the following method: determining all ancestor resources of the target resource; generating the ancestor permission set based on the permission points on which the user is granted corresponding permissions on the ancestor resources.

[0043] For example, for target resource X, all ancestor resources of resource X can be found by using the directory / Z / Y / X of resource X, which are resource Y and resource Z. At each ancestor resource level, the ancestor permission set is generated based on the permission points for which the target user has been granted corresponding permissions. For resource Y, since target user Uid1 is in Group 1, permission point Policy 4 is granted to target user Uid1 on resource Y; for resource Z, since target user Uid1 is in Group 1, permission point Policy 1 is granted to target user Uid1 on resource Z. Based on the above permission settings, for target user Uid1, its ancestor permission set is {Policy 1, Policy 4}.

[0044] As can be seen in the above embodiments, the permission points in the ancestor permission set may include permission points that exist in the current level permission set. However, since the permission points that exist in the current level permission set are permission points that the target user must have on the target resource, there is no need for repeated judgment. Therefore, in an exemplary embodiment of this specification, before proceeding to the next step of judging whether the inheritance relationship of the target resource to each permission point in the ancestor permission set is interrupted, the permission points that are already present in the current level permission set can be removed from the ancestor permission set. This saves the repeated judgment of some permissions that the target user must have on the target resource. For example, for the target user Uid1, its current level permission set is {Policy 1, Policy 3}, and its ancestor permission set is {Policy 1, Policy 4}. For Policy 1 in the ancestor permission set, since it appears in the current level permission set, its corresponding permission 1 is something that the target user Uid1 must have on the target resource X. Therefore, removing Policy 1 from the ancestor permission set and only checking whether the inheritance relationship between the target resource in the ancestor permission set and Policy 4 is broken does not affect the permission authentication result.

[0045] During the removal process, if all resources in the ancestor permission set are removed, it proves that there are no other permission points in the ancestor permission set besides those in the current level permission set. This proves that no other permission points in the ancestor resources can be inherited by the current level resource through inheritance. Therefore, the permissions corresponding to the permission points in the current level permission set represent all the permissions the target user has on the target resource. Thus, based on the current level permission set, it can be determined whether the target user has the target permission for the target resource.

[0046] S202, determine whether the inheritance relationship of the target resource to each permission point in the ancestor permission set has been interrupted, and filter out the permission points whose inheritance relationship has not been interrupted according to the determination result.

[0047] The permissions of the permission points in the current level permission set are permissions that the target user must possess. However, for permission points in the ancestor permission set, it is necessary to check one by one whether their inheritance has been interrupted. If the inheritance of a permission point in a certain ancestor permission set is interrupted, it may result in the target user not having the corresponding permissions for that permission point for the target resource.

[0048] For example, for user Uid1, there are two permission points, Policy 1 and Policy 4, in its ancestor resource permission set.

[0049] In an exemplary embodiment of this specification, when determining whether the inheritance relationship of each permission point in the ancestor permission set is interrupted, the determination can be made step by step from high to low according to the order of arrangement in the target resource's directory. For Policy 4, it is set on resource Y, which is the parent resource of the target resource X. However, since Policy 4 also has a permission interruption flag set on resource Y, and since its child resource X has been granted permission points Policy 1, Policy 2, and Policy 3, the inheritance relationship of Policy 4 from resource Y to resource Z is interrupted, and Policy 4 cannot be inherited by resource X. For Policy 1, it is set on resource Z. Since it does not have a permission interruption flag set, it can be inherited by resource Y and then by the target resource X through resource Y. The inheritance relationship of the target resource X to the permission point Policy 1 in the ancestor permission set is not interrupted, and the target resource X can inherit Policy 1.

[0050] Of course, if the permission points contained in the current level permission set in the ancestor permission set are removed, then the ancestor resource permission set will only include Policy 4. In this case, only Policy 4 needs to be judged.

[0051] In another exemplary embodiment of this specification, a simplified method is provided for determining whether the inheritance relationship of the target resource to each permission point in the ancestor permission set has been broken. For multi-level systems with complex permission settings, the simplified algorithm can reduce computation and improve the efficiency of permission authentication. The simplified determination method may include the following steps:

[0052] For each type of permission point in the ancestor permission set, the permission point closest to the target resource in each type of permission point is selected; wherein, the inheritance relationship corresponding to the remaining permission points is broken.

[0053] If any of the selected permission points has a permission interruption flag on its corresponding resource, and the child resources of that resource also have permission points, then the inheritance relationship corresponding to any of the permission points is determined to be interrupted.

[0054] If the resource corresponding to any selected permission point does not have a permission interruption flag set, or if the resource corresponding to any selected permission point has a permission interruption flag set but the child resources of that resource do not have permission points set, it is determined that the inheritance relationship corresponding to any permission point has not been interrupted.

[0055] To explain the simplified judgment method in more detail, this application provides the following exemplary embodiment:

[0056] Assuming Figure 4 The diagram shows the permission point settings for the target resource / A / B / C / D / E / F and its ancestor resources. Now, permission authentication is performed in response to the requirement to verify whether target user Uid1 has target permission 1 (granted by the corresponding permission point Policy 1) on target resource / A / B / C / D / E / F.

[0057] For target user Uid1, obtain all permission points for which the target user Uid1 has been granted corresponding permissions in the multi-level resources, including: Policy 5, Policy 4, Policy 1, and Policy 3; filter out the permission points Policy 1 and Policy 3 set on the target resource from all the obtained permission points, and add them to the permission set of this level, so that the permission set of this level is {Policy 1, Policy 3}.

[0058] Identify all ancestor resources of the target resource / A / B / C / D / E / F: / A / B / C / D / E / *, / A / B / C / D / *, / A / B / C / *, / A / B / *, / A / *; The permission points on which the target user Uid1 is granted corresponding permissions on the ancestor resources include: Policy 5 granted on resource / A / B / *, Policy 4 granted on resources / A / B / C / * and / A / B / C / D / *, and generate the ancestor permission set as {Policy 5, Policy 4}.

[0059] In an exemplary embodiment of this application, one method for determining whether the inheritance relationship of each permission point in the ancestor permission set has been interrupted is to determine it level by level according to the resource directory.

[0060] For example, for Policy 4 in the ancestor permission set, the permission point is determined level by level from the parent to the child resource to determine whether it can be inherited by the child resource. First, the highest-level resource / A / B / C / * where Policy 4 is set is found. For Policy 4 set on resource / A / B / C / *, since no permission interruption flag is set, the child resource / A / B / C / D / * can inherit the permission point. At this time, resource / A / B / C / D / * has two resource points: the directly granted permission point Policy 4 and the Policy 4 inherited from resource / A / B / C / *. Since a permission interruption flag for Policy 4 is set on resource / A / B / C / D / *, and no permission point is set on its child resource / A / B / C / D / E / *, Policy 4 can be inherited by resource / A / B / C / D / E / *. On resource / A / B / C / D / E / *, since no permission interruption flag is set, Policy 4 can be inherited by the target resource / A / B / C / D / E / F.

[0061] For Policy 5 in the ancestor permission set, first find the highest-level resource / A / B / * where Policy 5 is set. Since there is no permission interruption flag set, it can be inherited by resource / A / B / C / *. There is also no permission interruption flag on resource / A / B / C / *, so Policy 5 can continue to be inherited by resource / A / B / C / D / *, and so on. Finally, it is determined that Policy 5 can be inherited by the target resource / A / B / C / D / E / F.

[0062] A simplified judgment method is now used to determine whether the inheritance relationship from each permission point in the latest permission set to the target resource has been interrupted.

[0063] For permission point Policy 5, since it is set at the resource / A / B / * level, the permission point closest to the target resource is Policy 5 at the resource / A / B / * level. Since the resource corresponding to Policy 5 at the filtered resource / A / B / * level does not have a permission interruption flag set for Policy 5, it is determined that the inheritance relationship corresponding to Policy 5 has not been interrupted.

[0064] For permission point Policy 4, it is set on both resources / A / B / C / * and resources / A / B / C / D / *. Since resources / A / B / C / D / * are closer to the target resource / A / B / C / D / E / F, the permission point closest to the target resource for the corresponding resource is Policy 4 at the resource / A / B / C / * level. At this time, Policy 4 at the resource / A / B / C / * level has an interruption flag set for Policy 4; however, since no permission point is set on the child resource / A / B / C / D / * of resource / A / B / C / *, it is determined that the inheritance relationship corresponding to Policy 4 is not broken.

[0065] Suppose that a permission point is set on resource / A / B / C / D / *, and there are no specific restrictions on the type of the permission point. In this case, because Policy 4 on its parent resource / A / B / C / * has an interrupt flag for Policy 4, the child resource / A / B / C / D / * cannot inherit and obtain the permission point Policy 4.

[0066] As can be seen, the improved judgment method omits the judgment of permission point inheritance of intermediate-level resources, and simplifies the permission identification process by using permission interruption markers and the properties of permission points. In cases where the permission settings of a multi-level permission management system are relatively complex, the result of permission identification can be obtained more quickly.

[0067] After determining whether the inheritance relationship of each permission point in the ancestor permission set has been broken by using the above method, subsequent steps can be performed.

[0068] S203, based on the current level permission set and the filtered permission points, identify whether the target user has the target permission for the target resource.

[0069] After the preceding steps are completed, the permissions corresponding to the permission points in the current-level permission set are the permissions that the target user must have on the target resource. The filtered permission points are the permission points that the target resource can inherit from the ancestor permission set. At this point, it can be determined whether the target user has the target permission on the target resource simply by checking whether the current-level permission set and the filtered permission points have the permission points corresponding to the target permission.

[0070] In an exemplary embodiment of this specification, as Figure 4As shown, if the target user Uid1's current-level permission set is {Policy1, Policy 3}, the filtered permission points include Policy 4 and Policy 5. In this case, to determine whether the target user Uid1 has a request for target permission 1 (granted by the corresponding permission point Policy 1) for target resources / A / B / C / D / E / F, a judgment needs to be made based on the current-level permission set and the filtered permission points. Specifically, when determining whether the target user Uid1 has target permission 1 for target resources / A / B / C / D / E / F, it is necessary to determine whether the target user's current-level permission set and the filtered permission points contain the permission point Policy 1 corresponding to target permission 1. In this embodiment, since the target user's current-level permission set includes Policy 1, the target user Uid1 has target permission 1 for target resources / A / B / C / D / E / F.

[0071] Figure 5 This is a schematic diagram of the structure of a computer device according to an exemplary embodiment of this specification. Please refer to... Figure 5 At the hardware level, the device includes a processor 502, an internal bus 504, a network interface 506, memory 508, and non-volatile memory 510. It may also include other hardware required for various functions. The processor 502 reads the corresponding computer program from the non-volatile memory 510 into the memory 508 and then runs it, forming an authentication device at the logical level. Of course, besides the software implementation, one or more embodiments in this specification do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution entity of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0072] Corresponding to the embodiments of the above methods, this specification also provides an authorization authentication device.

[0073] Please refer to Figure 6 A permission authentication device is applied to a multi-level resource permission management system, wherein at least one level of the multi-level resources has permission points, and the permission points are used to define the permission types for the corresponding resources and the user groups granted the corresponding permissions. The device may include:

[0074] The acquisition unit 610 is used to acquire a current-level permission set and an ancestor permission set in response to the need to identify whether the target user has the target permission for the target resource. The current-level permission set is the set of permission points on which the user has been granted the corresponding permission on the target resource, and the ancestor permission set is the set of permission points on which the user has been granted the corresponding permission on all ancestor resources of the target resource.

[0075] The judgment unit 620 is used to judge whether the inheritance relationship of the target resource to each permission point in the ancestor permission set has been interrupted, and to filter out the permission points whose inheritance relationship has not been interrupted according to the judgment result.

[0076] The identification unit 630 is used to identify whether the target user has target permissions for the target resource based on the current level permission set and the filtered permission points.

[0077] Optionally, the acquisition unit 610 may be specifically used for:

[0078] Obtain all permission points for the target user that have been granted corresponding permissions in the multi-level resources;

[0079] Filter out the permission points set on the target resource from all the obtained permission points, and add them to the current level permission set.

[0080] Optionally, the acquisition unit 610 may be specifically used for:

[0081] Identify all ancestor resources of the target resource;

[0082] The user's inherited permission set is generated based on all the permission points that the user has been authorized to inherit on the ancestor resource.

[0083] Optionally, the authorization authentication device may further include:

[0084] The filtering unit 640 is used to remove permission points contained in the current level permission set from the ancestor permission set.

[0085] Optionally, if all permission points in the ancestor permission set are removed, the target user may be identified as having target permission for the target resource based on the current level permission set.

[0086] Optionally, the determination unit 620 may be specifically used for:

[0087] For each type of permission point in the ancestor permission set, the permission point closest to the target resource in each type of permission point is selected; wherein, the inheritance relationship corresponding to the remaining permission points is broken.

[0088] If any selected permission point has a permission interruption flag, and the child resources of that resource have permission points, then the inheritance relationship corresponding to any permission point is determined to be interrupted.

[0089] If no permission interruption flag is set at any of the selected permission points, or if a permission interruption flag is set on the resource corresponding to any of the selected permission points but no permission points are set on the child resources of that resource, it is determined that the inheritance relationship corresponding to any of the permission points has not been interrupted.

[0090] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0091] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0092] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0093] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0094] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0095] In one or more embodiments of this specification, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0096] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” used in one or more embodiments of this specification and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0097] It should be understood that although the terms first, second, third, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of one or more embodiments of this specification, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."

[0098] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit the scope of one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this specification should be included within the protection scope of one or more embodiments of this specification.

Claims

1. A method for authentication of permissions, characterized in that, An application to a multi-level resource access control system, wherein at least one level of the multi-level resources has access points, the access points being used to define the access types for the corresponding resources and the user groups granted the corresponding accesses, the method comprising: In response to the need to identify whether a target user has the target permission for the target resource, a current-level permission set and an ancestor permission set are obtained. The current-level permission set is the set of permission points on which the target user has been granted the corresponding permission on the target resource, and the ancestor permission set is the set of permission points on which the target user has been granted the corresponding permission on all ancestor resources of the target resource. Determining whether the inheritance relationship between the target resource and each permission point in the ancestor permission set is interrupted; wherein, determining whether the inheritance relationship between the target resource and each permission point in the ancestor permission set is interrupted includes: for each type of permission point in the ancestor permission set, filtering out the permission point of each type of permission point that is closest to the target resource; if any of the filtered permission points has a permission interruption flag and the child resources of that resource have permission points, determining that the inheritance relationship corresponding to that permission point is interrupted; if any of the filtered permission points does not have a permission interruption flag, or if the resource corresponding to any of the filtered permission points has a permission interruption flag but the child resources of that resource do not have permission points, determining that the inheritance relationship corresponding to that permission point is not interrupted; Based on the judgment results, select the corresponding permission points whose inheritance relationship has not been interrupted; Based on the set of permissions at this level and the filtered permission points, determine whether the target user has the target permission for the target resource.

2. The method as described in claim 1, characterized in that, The acquisition of the current level's permission set includes: Obtain all permission points for the target user that have been granted corresponding permissions in the multi-level resources; Filter out the permission points set on the target resource from all the obtained permission points, and add them to the current level permission set.

3. The method as described in claim 2, characterized in that, The permission points for granting corresponding permissions to the target user include: permission points for directly granting corresponding permissions to the target user and permission points for the user group to which the target user belongs to be authorized.

4. The method as described in claim 1, characterized in that, Retrieve the ancestor permission set, including: Identify all ancestor resources of the target resource; The ancestor permission set is generated based on the permission points on which the target user has been granted corresponding permissions on the ancestor resource.

5. The method as described in claim 1, characterized in that, Also includes: Remove the permission points contained in the current level permission set from the ancestor permission set.

6. The method as described in claim 5, characterized in that, If all permission points in the ancestor permission set are removed, the target user is identified as having target permission for the target resource based on the current level permission set.

7. An access control device, characterized in that, An apparatus for use in a multi-level resource access control system, wherein at least one level of the multi-level resources has access points, the access points being used to define the access types for the corresponding resources and the user groups granted the corresponding accesses, the apparatus comprising: The acquisition unit is used to acquire the current level permission set and the ancestor permission set in response to the need to identify whether the target user has the target permission for the target resource. The current level permission set is the set of permission points on which the user has been granted the corresponding permission on the target resource, and the ancestor permission set is the set of permission points on which the user has been granted the corresponding permission on all ancestor resources of the target resource. The judgment unit is used to determine whether the inheritance relationship of the target resource to each permission point in the ancestor permission set is interrupted, and to filter out the corresponding permission points whose inheritance relationship is not interrupted based on the judgment result; wherein, determining whether the inheritance relationship of the target resource to each permission point in the ancestor permission set is interrupted includes: for each type of permission point in the ancestor permission set, filtering out the permission point of each type of permission point that is closest to the target resource; if any of the filtered permission points has a permission interruption flag and the child resources of the resource have permission points, it is determined that the inheritance relationship corresponding to the permission point is interrupted; if any of the filtered permission points does not have a permission interruption flag, or if the resource corresponding to any of the filtered permission points has a permission interruption flag but the child resources of the resource do not have permission points, it is determined that the inheritance relationship corresponding to the permission point is not interrupted; The identification unit is used to identify whether the target user has target permissions for the target resource based on the current level permission set and the filtered permission points.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the steps of the method according to any one of claims 1-6.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1-6.

Images