Method, device, electronic device and storage medium for permission configuration and verification

Abstract

This disclosure relates to a method, apparatus, electronic device, and storage medium for permission configuration and verification, applicable to cloud services and access control technologies. The method includes: receiving a configuration request for permission configuration of a target version of software; obtaining description information of the functional permissions of the target version of software, wherein the description information describes whether access to one or more functions of the target version of software is open or prohibited for the target user; encoding the functional permissions of the target version of software according to the description information to obtain an encoding relationship and a binary permission code sequence; the encoding relationship characterizes the correspondence between functional permissions and the positions of permission codes in the binary sequence to be encoded; and performing a base conversion on the permission code sequence to obtain a binary number sequence. k A string sequence in base k, where k ≥ 4 and k is an integer; and storing permission configuration information in the database, which includes: encoding relationship and string sequence.

Description

Technical Field

[0001] This disclosure relates to the fields of cloud services and access control technology, and in particular to a method, apparatus, electronic device and storage medium for access configuration and verification. Background Technology

[0002] Software as a Service (SaaS) is a type of cloud computing service that allows users to access and use applications on various types of client devices through browsers or application programming interfaces (APIs) without having to maintain the applications or purchase and maintain the underlying infrastructure that supports them.

[0003] Typically, SaaS services often employ a multi-version software sales model or a multi-version software plus feature package sales model, leading to high-concurrency access demands across multiple versions. In multi-version, high-concurrency scenarios, when authenticating the visibility of front-end pages or the accessibility of back-end API interfaces, permission management can be achieved by assigning permission codes to each version or by using bitwise operations. However, these permission management methods have the following technical problems: the number of permissions is associated with each version, resulting in large storage and maintenance space requirements when the number of permissions is too high, and low authentication efficiency; furthermore, the number of permissions is also limited by the number of bits in the computer, which may lead to insufficient permissions in some scenarios, and operations on permission values ​​located in higher bits are less efficient, resulting in large storage and maintenance space requirements. Summary of the Invention

[0004] To solve the above-mentioned technical problems, or at least partially solve them, embodiments of this disclosure provide a method, apparatus, electronic device, and storage medium for permission configuration and verification.

[0005] Firstly, embodiments of this disclosure provide a method for configuring permissions. The method includes: receiving a configuration request to configure permissions for a target version of software; obtaining descriptive information about the functional permissions of the target version of software, wherein the descriptive information describes whether access to one or more functions of the target version of software is open or prohibited for a target user; encoding the functional permissions of the target version of software according to the descriptive information to obtain an encoding relationship and a binary permission code sequence; the encoding relationship characterizing the correspondence between the functional permissions and the positions of the permission codes in the binary sequence to be encoded; and performing a base conversion on the permission code sequence to obtain a 2... kA string sequence in base k, where k ≥ 4 and k is an integer; and storing permission configuration information in the database, wherein the permission configuration information includes the above encoding relationship and the above string sequence.

[0006] According to embodiments of this disclosure, based on the above-described information, the functional permissions of the target version software are encoded to obtain an encoding relationship and a binary permission code sequence, including: assigning a corresponding permission code position in the binary sequence to be encoded to each functional permission of the target version software to obtain an encoding relationship; determining the binary value of the permission code position corresponding to each functional permission of the target version software based on the above-described information and the above-described encoding relationship; and arranging the above-described binary values ​​in sequence according to the corresponding permission code positions to obtain a binary permission code sequence.

[0007] According to an embodiment of this disclosure, the above-described permission code sequence is converted to a different number system to obtain 2. k The string sequence in binary includes: grouping the above permission code sequence according to the number of digits from low to high, with each group containing k permission code bits, and padding with zeros if the highest bit is less than k permission code bits; converting the binary sequence to be encoded corresponding to each group of k permission code bits into 2. k The permission code character in the base; the above 2 k The permission code characters in the base are arranged in order to obtain 2. k A sequence of strings in a number system.

[0008] According to an embodiment of this disclosure, storing permission configuration information in a database includes: associating the encoding relationship and the string sequence with the identity identifier of the target user; and storing the encoding relationship and the string sequence associated with the identity identifier in a database.

[0009] According to embodiments of this disclosure, the above-described permission configuration method further includes: receiving an update request to update permission configuration information, wherein the update request carries an update instruction for a specific permission; determining, based on the above-described encoding relationship, whether the permission code sequence contains a target permission code position corresponding to the specific permission; if the target permission code position exists in the permission code sequence, updating the binary value at the target permission code position according to the update instruction to obtain an updated permission code sequence; and performing a base conversion on the updated permission code sequence to obtain an updated 2D binary code. k A sequence of strings in a number system; combine the above encoding relationships with the updated 2 k The sequence of strings in a binary system is stored in the database as the updated permission configuration information.

[0010] According to embodiments of this disclosure, the above-mentioned permission configuration method further includes: when there is no target permission code position in the above-mentioned permission code sequence, adding a permission code position based on the above-mentioned permission code sequence, and assigning a corresponding specific permission code position to the above-mentioned specific permission in the newly added permission code position to obtain an updated encoding relationship; assigning values ​​to the values ​​at the above-mentioned specific permission code positions according to the above-mentioned update instruction to obtain an updated permission code sequence; and performing a base conversion on the updated permission code sequence to obtain an updated 2 k A sequence of strings in a binary system; the updated encoding relationship and the updated binary representation. k The sequence of strings in a binary system is stored in the database as the updated permission configuration information.

[0011] Secondly, embodiments of this disclosure provide a method for permission verification. The method includes: receiving an authentication request to verify the permissions of an access object to a target version of software, the authentication request carrying information including: the access object's identity information and an operation instruction to be verified; verifying the access object's identity based on the access object's identity information; and, if the access object's identity verification is successful, determining whether the access object has permission to execute the operation instruction based on pre-configured permission configuration information, thereby obtaining an authentication result; wherein the pre-configured permission configuration information is configured using the permission configuration method described above.

[0012] According to embodiments of this disclosure, the above-mentioned determination of whether the access object has permission to execute the above-mentioned operation instruction based on pre-configured permission configuration information, and obtaining an authentication result, includes: determining the position of the permission code to be verified corresponding to the above-mentioned operation instruction based on the above-mentioned encoding relationship in the permission configuration information; dividing the ordinal of the position of the permission code to be verified by k, and using the integer quotient as the ordinal of the target position corresponding to the position of the permission code to be verified in the above-mentioned string sequence, and using the remainder as the ordinal of the k-bit binary standard permission code corresponding to the value 1 and the ordinal of the comparison position; obtaining the permission code character at the target position in the above-mentioned string sequence according to the ordinal of the target position, and performing a base conversion on the permission code character to obtain a k-bit binary permission code for verification; performing a bitwise AND operation between the permission code for verification and the standard permission code to obtain the bitwise operation result corresponding to the ordinal of the comparison position; and generating an authentication result based on the bitwise operation result.

[0013] Thirdly, embodiments of this disclosure provide an apparatus for permission configuration. The apparatus includes: a configuration request receiving module, an information acquisition module, an encoding module, a number system conversion module, and a storage module. The configuration request receiving module receives a configuration request for configuring permissions on a target version of software. The information acquisition module acquires descriptive information about the functional permissions of the target version of software, which describes whether access to one or more functions of the target version of software is open or prohibited for a target user. The encoding module encodes the functional permissions of the target version of software according to the descriptive information, obtaining an encoding relationship and a binary permission code sequence. The encoding relationship characterizes the correspondence between the functional permissions and the positions of the permission codes in the binary sequence to be encoded. The number system conversion module performs a number system conversion on the permission code sequence to obtain 2... k A string sequence in base k, where k ≥ 4 and k is an integer. The aforementioned storage module is used to store permission configuration information in the database. This permission configuration information includes the aforementioned encoding relationship and the aforementioned string sequence.

[0014] Fourthly, embodiments of this disclosure provide an apparatus for permission verification. The apparatus includes an authentication request receiving module, an authentication module, and a permission verification module. The authentication request receiving module receives an authentication request for permission verification of an access object to a target version of the software. The authentication request carries information including the access object's identity information and the operation instruction to be verified. The authentication module authenticates the access object based on its identity information. If the access object's authentication is successful, the permission verification module determines whether the access object has permission to execute the operation instruction based on pre-configured permission configuration information, thus obtaining an authentication result. The pre-configured permission configuration information is configured using the permission configuration method described above or using the permission configuration apparatus described above.

[0015] Fifthly, embodiments of this disclosure provide an electronic device. The electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, communication interface, and memory communicate with each other via the communication bus; the memory stores computer programs; and the processor, when executing the program stored in the memory, implements the permission configuration method or permission verification method as described above.

[0016] Sixthly, embodiments of this disclosure provide a computer-readable storage medium. The computer-readable storage medium stores a computer program that, when executed by a processor, implements the permission configuration method or permission verification method as described above.

[0017] The technical solutions provided in the embodiments of this disclosure have at least some or all of the following advantages:

[0018] (1) After converting the binary permission code sequence obtained after encoding, we get 2 k A sequence of strings in base 16 (hexadecimal, base 32, and above) is used, and the string sequence and its encoding relationship are stored in the database as at least part of the permission configuration information. On the one hand, the corresponding string stored in the database is in string form. k The permission codes, being 255 bits long (or customizable to a longer length) in the database, can correspond to at least 255×k permission codes. This satisfies the permission settings requirements of high-concurrency, multi-version access scenarios, without limiting the number of permissions corresponding to each encoding bit. The permission code sequence can be expanded according to permission requirements, exhibiting scalability and wide applicability. Furthermore, since the 255 bits of string format stored in the database... k The use of a binary access code also effectively saves storage space;

[0019] (2) Furthermore, by storing the corresponding encoding relationship between the functional permissions obtained during encoding and the position of the permission code in the binary sequence to be encoded, and the string sequence in the database, during permission verification, the permission code characters in the string sequence can be quickly located and efficiently authenticated through the encoding relationship and number system conversion, thereby improving the response speed in high-concurrency and multi-version access scenarios. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0021] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0022] Figure 1 The system architecture of the permission configuration method and apparatus, and the permission verification method and apparatus applicable to embodiments of this disclosure is schematically illustrated.

[0023] Figure 2 A flowchart illustrating a method for configuring permissions according to an embodiment of the present disclosure is shown schematically.

[0024] Figure 3 A detailed implementation flowchart of operation S203 according to an embodiment of the present disclosure is illustrated schematically;

[0025] Figure 4 A schematic diagram illustrating an implementation scenario of operation S203 according to an embodiment of the present disclosure is shown.

[0026] Figure 5 A detailed implementation flowchart of operation S204 according to an embodiment of the present disclosure is illustrated schematically;

[0027] Figure 6 A schematic diagram illustrating an implementation scenario of operation S204 according to an embodiment of the present disclosure is shown.

[0028] Figure 7 A detailed implementation flowchart of operation S205 according to an embodiment of the present disclosure is illustrated schematically;

[0029] Figure 8 A flowchart illustrating a method for configuring permissions according to another embodiment of this disclosure is shown schematically;

[0030] Figure 9 A detailed implementation flowchart of operation S801 according to an embodiment of the present disclosure is illustrated schematically;

[0031] Figure 10 A schematic diagram illustrating an implementation scenario of operation S801 according to an embodiment of the present disclosure is shown.

[0032] Figure 11 A flowchart illustrating a method for authorization verification according to an embodiment of this disclosure is shown schematically.

[0033] Figure 12 A schematic block diagram of a device for configuring permissions according to an embodiment of the present disclosure is shown.

[0034] Figure 13 A schematic block diagram of a permission verification apparatus according to embodiments of the present disclosure is shown; and

[0035] Figure 14 A schematic block diagram of an electronic device provided in an embodiment of the present disclosure is shown. Detailed Implementation

[0036] In SaaS services provided by cloud platforms, the high concurrency of access from multiple software versions makes ensuring security and system reliability crucial. The permission system is the core platform supporting the normal and secure operation of multi-version software services, and the authentication mechanism is its core element. The efficiency and scalability of the permission system, and the speed and efficiency of the authentication mechanism, are key indicators of a SaaS system's reliable operation.

[0037] In some systems, system permissions are controlled through a set of permission codes. Each function is assigned a permission code to control whether it is displayed. For example, the customer service robot software has versions V1 and V2, corresponding to the following functions: {"Professional Version": ["Response Scenario Configuration", "Special Scenario", "Full-Chain Order Tracking"], "Basic Version": ["Basic Response"]}. Software version V1 has 3 function permissions (values ​​are for illustrative purposes only): Response Scenario Configuration, Special Scenario, and Full-Chain Order Tracking. Each of these permissions is assigned a corresponding permission code, described as Permission Code 1, Permission Code 2, and Permission Code 3. Specific permission code values ​​are not provided in the examples. Software version V2 has 1 function permission: Basic Response. The permission code for this Basic Response permission is Permission Code 4.

[0038] In this approach, permissions are configured in the form of permission codes for each version. Each time a user logs into the system, the latest set of permission codes is retrieved. The frontend then uses this set of permission codes and conditional statements (such as if-else statements) to determine which page to display. Similarly, the backend API caches user permission codes during resource authentication and uses contain statements (such as contain statements) to determine if the request has the required permission. However, as the number of versions increases and the number of permissions within each version grows exponentially, a large number of permission codes can lead to difficulties in maintaining the frontend pages and low performance of backend requests under high concurrency scenarios.

[0039] In some methods, permission management is achieved through bitwise operations, with each binary bit representing whether a user possesses a certain permission. Taking add, view, and modify permissions as examples, each permission is assigned a corresponding binary permission code. For instance, add permission is set to binary code 001, view permission to binary code 010, and modify permission to binary code 100. The user's initial permission, authority, is set to 0, i.e., authority = 0 (the initial permission is assigned a value of 0). When assigning permission 'a' to the current permission, it is first determined whether the user already has this permission. If not, the value corresponding to 'a' is added to the initial permission 'authority' to obtain the user's current permission. During permission verification, a logical AND (&) is used for authentication. Two binary numbers of the same length are bitwise ANDed; the result is 1 only if both corresponding bits are 1, otherwise it is 0. Therefore, the condition (authority&b) == b can be used to determine whether the user possesses permission b.

[0040] However, in this bitwise operation method, for N permissions, the corresponding value is set in the nth bit, while the other bits are 0. For example, the permission value for the first permission (e.g., view permission) is: ... 001, the permission value for the second permission (e.g., add permission) is: ... 0010, the permission value for the third permission (e.g., modify permission) is: ... 0100, the permission value for the fourth permission is: ... 01000; and so on. For a 32-bit computer, a total of 1 (in the 32nd bit) 00...00 can be set. This leads to two problems: (a) the number of permissions is limited by the number of bits in the computer; (b) when performing operations on permission values ​​located in the higher bits, the operation efficiency is low, and the storage and maintenance space occupied is large.

[0041] In view of the above, embodiments of this disclosure provide a method, apparatus, electronic device, and storage medium for permission configuration and verification.

[0042] The above-mentioned permission configuration method includes: receiving a configuration request for configuring permissions on a target version of software; obtaining description information of the functional permissions of the target version of software, wherein the description information describes whether access to one or more functions of the target version of software is open or prohibited for the target user; encoding the functional permissions of the target version of software according to the description information to obtain an encoding relationship and a binary permission code sequence; the encoding relationship is used to characterize the correspondence between the functional permissions and the positions of the permission codes in the binary sequence to be encoded; and performing a base conversion on the permission code sequence to obtain 2 k A string sequence in base k, where k ≥ 4 and k is an integer; and storing permission configuration information in the database, wherein the permission configuration information includes the above encoding relationship and the above string sequence.

[0043] The aforementioned permission verification method includes: receiving an authentication request to verify the permissions of an access object to the target version of the software, wherein the authentication request carries information including: the access object's identity information and the operation instruction to be verified; verifying the access object's identity based on the access object's identity information; and, if the access object's identity verification is successful, determining whether the access object has the permission to execute the aforementioned operation instruction based on pre-configured permission configuration information, thereby obtaining an authentication result. The pre-configured permission configuration information is configured using the permission configuration method described above.

[0044] The above method can meet the permission settings in high-concurrency and multi-version access scenarios, does not limit the number of permissions corresponding to each encoding bit, and can expand the permission code sequence according to permission requirements, which has scalability and wide applicability; it can also effectively save storage space; during permission verification, the permission code characters in the string sequence can be quickly located and efficiently authenticated through encoding relationship and number system conversion, thereby improving the response speed in high-concurrency and multi-version access scenarios.

[0045] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0046] Figure 1 The system architecture of the permission configuration method and apparatus, and the permission verification method and apparatus applicable to embodiments of this disclosure is illustrated schematically.

[0047] Reference Figure 1 As shown, the system architecture 100 of the permission configuration method and apparatus and the permission verification method and apparatus applicable to the embodiments of this disclosure can be a conventional browser / server architecture or an architecture in a cloud environment.

[0048] exist Figure 1 Taking a cloud environment architecture as an example, the aforementioned system architecture 100 includes: a terminal device 110, a cloud platform 120 for providing cloud services, and a service cluster 130. In a cloud environment, the cloud platform 120 can be understood as the server side in a B / S architecture, or the cloud platform 120 and service cluster 130 as a whole can be understood as the server side in a B / S architecture.

[0049] The aforementioned cloud environment refers to an internet or big data environment that can provide computing power, storage capacity, or virtual machine services to users or various application systems on demand from a dynamically virtualized resource pool.

[0050] The aforementioned terminal device 110 and cloud platform 120 interact with each other via a network, and the cloud platform 120 and service cluster 130 interact with each other via a network. A network is a medium used to provide communication links and can include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0051] In the terminology of this disclosure, the aforementioned cloud platform 120 refers to a cloud computing platform that provides computing and / or storage services based on the underlying infrastructure and network. The term "cloud platform" is a broad concept encompassing both cloud architecture platforms and cloud service platforms. More specifically, the hardware and software system environment that supports the operation and implementation of cloud services is called the cloud architecture platform; while the application service platform that implements data processing logic, supports client applications, and provides services to the outside world is called the cloud service platform.

[0052] The aforementioned cloud platform 120, as a service-providing software / system (including hardware and software systems), can provide services for software developers to create applications, i.e., provide Platform as a Service (PaaS); it can also provide services for users, such as enterprise users or consumer users (B-end users or C-end users), to use applications, i.e., provide Software as a Service (SaaS). The services provided by the cloud platform can be understood in relation to the functions of traditional application servers. SaaS is a software delivery model in which software can be used simply by connecting to the network, without the need for traditional installation steps.

[0053] The aforementioned terminal equipment 110 includes, but is not limited to, the following: Figure 1 Examples include laptops 111, tablets 112, smartphones 113, and smartwatches 114.

[0054] In a conventional B / S architecture, the terminal device 110 is equipped with various communication client applications. The cloud platform 120 provides service support to these client applications by calling resources in the service cluster 130, or the conventional server provides service support to these client applications.

[0055] The aforementioned client applications can be communication client applications supported by various cloud services, including but not limited to: shopping applications, financial applications, web browser applications, search applications, image processing applications, short video applications, instant messaging tools, address books, email clients, social platform software, office automation systems (OA systems), etc. (for example only).

[0056] In the cloud service architecture, the aforementioned terminal device 110 can access various SaaS software packaged in the cloud platform 120 via the network, and the cloud platform 120 provides service support to the SaaS software displayed on the terminal device 110 by calling resources in the service cluster 130.

[0057] For example, terminal device 110 may have a client application corresponding to the services provided by cloud platform 120. This could be the service interface of cloud platform 120 displayed on the terminal device as a cloud drive, which may contain application programming interfaces (APIs) for multiple software programs. Alternatively, terminal device 110 may have a client interface corresponding to the services provided by cloud platform 120, such as a browser interface, allowing users to access cloud-based applications by logging in. In other words, the aforementioned client application or client interface provides a user interface for cloud-based operations.

[0058] In scenarios where cloud platform 120 provides SaaS services, users can access the target SaaS system through the API interface of the SaaS system on the terminal device or through the browser access interface.

[0059] For example, cloud services support SaaS systems including but not limited to: customer service robot systems / software, enterprise resource planning (ERP) systems, customer relationship management (CRM) systems, office automation (OA) systems, enterprise human resource management (EHR) systems, supply chain management (SCM) systems, etc.

[0060] The aforementioned service cluster 130 can be a distributed service cluster. Here, we take the example of a distributed service cluster consisting of two spatially independent service clusters 131 and 132.

[0061] Service cluster 131 and service cluster 132 each include multiple service nodes, for example in Figure 1 Taking service cluster 131, which includes service nodes 1311, 1312, 1313, and 1314, as an example, and service cluster 132, which includes service nodes 1321, 1322, and 1323, as another example, each of these service nodes 1311, 1312, 1313, 1314, 1321, 1322, and 1323 has its own corresponding service that it can provide. For example, these services can be various types such as computing services, storage services, API interface services (e.g., Kubernetes API interface services), traffic auditing services, and database query services.

[0062] For example, user A (e.g., merchant) accesses cloud platform 120 through a cloud-based interface on terminal device 110, and purchases / rents services for one or more versions of customer service robot software as needed on cloud platform 120. The customer service robot software provided by cloud platform 120 generates corresponding API interfaces or access URLs, enabling user A to access and use the customer service robot software on terminal device 120 based on the aforementioned API interfaces or access URLs.

[0063] Reference Figure 1 As shown, user 101 can be a person capable of configuring software permissions (front-end and / or back-end software function permissions) of cloud platform 120, such as a permission administrator or developer. User 101 interacts with cloud platform 120 (specifically, an electronic device with cloud platform 120 installed) to configure permissions for the customer service robot software (SaaS system, or, in the embodiment, an example of a target version of software) provided by cloud platform 120. This corresponds to cloud platform 120 executing the permission configuration method provided in this disclosure embodiment. Specifically, this can be executed by an electronic device with the software / system corresponding to cloud platform 120 installed. The electronic device can be a networked terminal device with computing capabilities, or it can be a virtual host or cloud server, etc. Accordingly, the permission configuration device provided in this disclosure embodiment can be an electronic device with cloud platform installed.

[0064] Reference Figure 1 As shown, user 102 is a user of the SaaS service, such as an enterprise user or a consumer user. In one implementation scenario, when user 102 accesses / uses the software service provided by the cloud platform 120 via the network using terminal device 110, the terminal device 110 initiates an authentication request to the cloud platform 120 regarding the visibility of the front-end page, and the cloud platform 120 executes the permission verification method provided in this embodiment of the disclosure; or in another implementation scenario, when user 102 accesses / uses the software service provided by the cloud platform 120 via the network using terminal device 110, the backend service cluster 130 initiates an authentication request to the cloud platform 120 regarding the accessibility of the API interface, and the cloud platform 120 executes the permission verification method provided in this embodiment of the disclosure.

[0065] In other implementation scenarios, the above-mentioned permission verification method can also be executed by the terminal device 110 or the service node in the service cluster 130. During the execution process, it is necessary to call the permission configuration information pre-configured by the cloud platform; or the permission configuration information pre-configured by the cloud platform 120 is pre-stored in the service node of the terminal device 110 or the service cluster 130.

[0066] Correspondingly, the permission verification device provided in this embodiment can be an electronic device with a cloud platform installed, or it can be a terminal device or each service node in a service cluster.

[0067] It should be understood that Figure 1 The number of terminal devices, service clusters, and service nodes shown is merely illustrative. Depending on implementation needs, there can be any number of terminal devices, service clusters, and service nodes.

[0068] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0069] The first exemplary embodiment of this disclosure provides a method for configuring permissions.

[0070] Figure 2 A flowchart illustrating a method for configuring permissions according to an embodiment of the present disclosure is shown schematically.

[0071] Reference Figure 2 As shown, the permission configuration method provided in this embodiment includes the following operations: S201, S202, S203, S204 and S205.

[0072] Referring to the above combination Figure 1 As shown in the system architecture 100, operations S201 to S205 can be performed by an electronic device with the cloud platform 120 installed, or by an electronic device that manages and controls the permissions of the application software.

[0073] In operation S201, a configuration request is received to configure permissions for the target version of the software.

[0074] Reference Figure 1 As shown, user 101 (e.g., an access control administrator) initiates a request to configure permissions for the target version of the software on the user interface of an electronic device on which the cloud platform 120 is installed, or on the user interface of an electronic device that manages and controls the permissions of the application software, and the configuration request is received on the aforementioned electronic device.

[0075] User 101 can be a person who can configure the software permissions (front-end and / or back-end software function permissions) of the cloud platform 120, such as a permission administrator or a developer.

[0076] The target version of software here can be multiple software programs, each with one or more versions; or it can be one or more versions of a single software program.

[0077] For example, the target version of the software may be various versions of customer service robot software that the cloud platform can provide to software service users, or multiple versions of customer service robot software packages, or multiple versions of customer service robot software packages with superimposed functions, etc.

[0078] In operation S202, obtain description information of the functional permissions of the target version software. The description information is used to describe whether access to one or more functions of the target version software is open or prohibited for the target user.

[0079] Upon receiving the above configuration request, obtain the description information of the functional permissions corresponding to the target version of the software.

[0080] The aforementioned functional permissions can refer to user functional permissions corresponding to one or more functions of the target version of the software, including but not limited to: front-end page visibility permissions and back-end API interface access permissions. For example, for the front-end, functional permissions include but are not limited to: login permissions, route access permissions, and page content loading permissions. For the back-end, functional permissions include but are not limited to: microservice API interface access permissions, functional permissions of the service cluster corresponding to the API interface, and functional permissions including but not limited to: viewing, adding, modifying, and deleting.

[0081] The target users mentioned above can be users of application software, such as service users of SaaS services. They can also be user groups (a group of people, a type of people), with the same user group having the same functional permission descriptions. Furthermore, the target users can be individual users, either one person or multiple different people, each with their own corresponding functional permission descriptions.

[0082] In operation S203, based on the above description information, the functional permissions of the target version software are encoded to obtain the encoding relationship and binary permission code sequence;

[0083] The above encoding relationship is used to characterize the correspondence between the above functional permissions and the position of the permission code in the binary sequence to be encoded.

[0084] In the binary permission code sequence obtained after encoding the above function permissions, one binary bit corresponds to one function permission.

[0085] In operation S204, the above permission code sequence is converted to a different number system, resulting in 2. k A sequence of strings in base k, where k ≥ 4 and k is an integer.

[0086] The hexadecimal permission code characters 0 to 15 correspond to the following characters respectively: 0123456789abcdef.

[0087] The characters corresponding to the 32-bit permission codes 0-31 are as follows:

[0088] 0123456789abcdefghijklmnopqrstuv.

[0089] The characters corresponding to the 64-bit permission codes 0-63 are as follows:

[0090] ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+ / .

[0091] In existing high-concurrency scenarios, when k=4, a hexadecimal string sequence can meet the configuration requirements of various functions in most scenarios. When k=5 or greater, it can meet the configuration requirements of more functions for more versions. Therefore, the permission code characters corresponding to higher bases for k>6 are not provided in the example. When there is a practical need for higher bases, characters and numbers 0~2 in higher bases can be customized. k-1 The correspondence between them.

[0092] In operation S205, the permission configuration information is stored in the database. The permission configuration information includes the above-mentioned encoding relationship and the above-mentioned string sequence.

[0093] The aforementioned database is either a database owned by the cloud platform 120 itself, or a database independent of the cloud platform 120, which the cloud platform 120 can access via the network and has write permissions to. The aforementioned database can be a relational database (DB), such as a MySQL database.

[0094] Based on the above operations S201 to S205, after performing a radix conversion on the encoded binary permission code sequence, we obtain 2. k A sequence of strings in base 16 (hexadecimal, base 32, and above) is used, and the string sequence and its encoding relationship are stored in the database as at least part of the permission configuration information. On the one hand, the corresponding string stored in the database is in string form. k The permission codes, being 255 bits long (or customizable to a longer length) in the database, can correspond to at least 255×k permission codes. This satisfies the permission settings requirements of high-concurrency, multi-version access scenarios, without limiting the number of permissions corresponding to each encoding bit. The permission code sequence can be expanded according to permission requirements, exhibiting scalability and wide applicability. Furthermore, since the 255 bits of string format stored in the database... kThe use of binary permission codes also effectively saves storage space. Furthermore, by storing the encoding relationship between the functional permissions obtained during encoding and the corresponding permission code positions in the binary sequence to be encoded, along with the string sequence, in the database, efficient authentication is facilitated during subsequent permission verification, improving response speed in high-concurrency, multi-version access scenarios.

[0095] Figure 3 A detailed implementation flowchart of operation S203 according to an embodiment of the present disclosure is illustrated schematically. Figure 4 A schematic diagram illustrating an implementation scenario of operation S203 according to an embodiment of the present disclosure is shown.

[0096] According to embodiments of this disclosure, referring to Figure 3 As shown, in the above operation S203, the function permissions of the target version software are encoded according to the above description information to obtain the encoding relationship and binary permission code sequence, including the following operations: S301, S302 and S303.

[0097] In operation S301, the corresponding permission code position in the binary sequence to be encoded is assigned to each function permission of the target version software to obtain the encoding relationship.

[0098] In an exemplary scenario, the target software version is OA System V3.0. This OA System V3.0 currently has 16 functional permissions (the actual number of permissions may be more), described as follows: Functional Permission X1 (e.g., permission to display the basic front-end page after login), Functional Permission X2 (e.g., permission to display the personalized front-end page after login), Functional Permission X3 (e.g., permission to display the front-end administrator page after login), Functional Permission X4 (e.g., permission to display personalized functional plugins on the basic front-end page after login), Functional Permission X5 (e.g., permission to call API interface 1), Functional Permission X6 (e.g., permission to access service resource R11 corresponding to API interface 1), Functional Permission X7 (e.g., permission to access service resource R12 corresponding to API interface 1), Functional Permission X8 (e.g., permission to access service resource R13 corresponding to API interface 1), Functional Permission X9 (e.g., permission to access service resource R14 corresponding to API interface 1), Functional Permission X... 10 (For example, permission to access service resource R15 corresponding to API interface 1), Function permission X 11 (For example, permission to call API interface 2), Function permission X 12 (For example, permission to access service resource R21 corresponding to API interface 2), Function permission X 13 (For example, permission to access service resource R22 corresponding to API interface 2), Function permission X14 (For example, permission to access service resource R23 corresponding to API interface 2), Function permission X 15 (For example, permission to access service resource R24 corresponding to API interface 2), Function permission X 16 (For example, permission to access service resource R31 corresponding to API interface 3).

[0099] Reference Figure 4 As shown, the corresponding permission code positions in the binary encoding sequence assigned to each function permission are as follows: X1 → bit 0, X2 → bit 1, X3 → bit 2, X4 → bit 3, X5 → bit 4, X6 → bit 5, X7 → bit 6, X8 → bit 7, X9 → bit 8, X... 10 → 9th position, X 11 → 10th position, X 12 → 12th position, X 13 →11th position, X 14 →13th position, X 15 →14th position, X 16 →15th.

[0100] It should be noted that the permission code positions are allocated starting from 0, serving as the address storage for the permission code, adapting to the address encoding method of existing computers. The above correspondence is only an example; in practice, the correspondence does not necessarily have to be sequential, but can be random or staggered, for example, X in the example. 12 → 12th position, X 13 →The 11th position, or correspondence according to a preset rule, or allocation of the corresponding permission code position according to the order of capture function permissions, etc., as long as a corresponding relationship can be generated, are all within the protection scope of this disclosure.

[0101] In operation S302, based on the above description information and the above encoding relationship, the binary value of the permission code position corresponding to each function permission of the above target version software is determined.

[0102] For example, the descriptions of the 16 functional permissions of the aforementioned OA system V3.0 are as follows: User C (an example of a target user) has the following permissions for the 16 operations: No access permission for displaying the basic front-end page after login (description of functional permission X1); Access permission for displaying the personalized front-end page after login (description of functional permission X2); No access permission for displaying the front-end administrator page after login (description of functional permission X3); Access permission for displaying personalized functional plugins on the basic front-end page after login (description of functional permission X4); and Access permission to call AP. The permissions for API interface 1 (description of function permission X5): "Has" permission to access service resource R11 corresponding to API interface 1 (description of function permission X6); "Does not" permission to access service resource R12 corresponding to API interface 1 (description of function permission X7); "Has" permission to access service resource R13 corresponding to API interface 1 (description of function permission X8); "Has" permission to access service resource R14 corresponding to API interface 1 (description of function permission X9); "Has" permission to access service resource R15 corresponding to API interface 1 (description of function permission X...). 10 (Description information), "Does not have" permission to call API interface 2 (Functional permission X) 11 (Description information), "Does not have" permission to access service resource R21 corresponding to API interface 2 (Functional permission X) 12 (Description information), "has" permission to access service resource R22 corresponding to API interface 2 (Functional permission X) 13 (Description information), "Does not have" permission to access service resource R23 corresponding to API interface 2 (Functional permission X) 14 (Description information), "Does not have" permission to access service resource R24 corresponding to API interface 2 (Functional permission X) 15 (Description information), "has" permission to access service resource R31 corresponding to API interface 3 (Functional permission X) 16 (Description information).

[0103] Reference Figure 4As shown, based on the above description and coding relationship, the binary value of the permission code position corresponding to each function permission of the above OA system V3.0 can be determined, for example: X1 → bit 0 → binary value "0", X2 → bit 1 → binary value "1", X3 → bit 2 → binary value "0", X4 → bit 3 → binary value "1", X5 → bit 4 → binary value "1", X6 → bit 5 → binary value "1", X7 → bit 6 → binary value "0", X8 → bit 7 → binary value "1", X9 → bit 8 → binary value "1", X 10 →9th bit→Binary value "1", X 11 →10th bit→Binary value "0", X 12 →12th bit→Binary value "0", X 13 →11th bit→Binary value "1", X 14 →13th bit→Binary value "0", X 15 →14th bit→Binary value "0", X 16 →15th bit→binary value "1".

[0104] In operation S303, the above binary values ​​are arranged in order according to the corresponding permission code positions to obtain a binary permission code sequence.

[0105] Reference Figure 4 As shown, the above binary values ​​are sorted in order according to the position of the permission code as follows: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15. The corresponding binary permission code sequence is: 0 1 01 1 1 0 1 1 1 0 1 00 0 1.

[0106] Figure 5 A detailed implementation flowchart of operation S204 according to an embodiment of the present disclosure is illustrated schematically. Figure 6 A schematic diagram illustrating an implementation scenario of operation S204 according to an embodiment of the present disclosure is shown.

[0107] According to embodiments of this disclosure, referring to Figure 5 As shown, in operation S204 above, the above permission code sequence is converted to a different number system to obtain 2. k A sequence of strings in a number system, including the following operations: S501, S502, and S503.

[0108] In operation S501, the above permission code sequence is grouped in ascending order of the number of bits, with each group containing k permission code bits. If the highest bit is less than k permission code bits, it is padded with zeros.

[0109] Reference Figure 6As shown, taking k=4 as an example, the binary permission code sequence is converted into a hexadecimal string sequence. The permission code sequence is then grouped according to the number of digits from low to high. Figure 6 The vertical lines in the middle indicate the groups. The 16 binary permission codes can be divided into 4 groups: 0101 (bits 0-3); 1101 (bits 4-7); 1101 (bits 8-11); 0001 (bits 12-15).

[0110] In the current example scenario, there is no situation where the highest bit has less than 4 permission code bits. In other scenarios, if there are fewer than k permission code bits in the highest bit, zeros will be used to pad the remaining bits.

[0111] In operation S502, the binary sequence to be encoded corresponding to each group of k permission code bits is converted into 2. k Permission code characters in a number system.

[0112] Reference Figure 6 As shown, each group is converted to a different base to obtain a hexadecimal permission code character corresponding to each of the four binary numbers. For example, the hexadecimal permission code character corresponding to 0101 (bits 0-3) is 5; the hexadecimal permission code character corresponding to 1101 (bits 4-7) is d (corresponding to the value 13 in decimal); the hexadecimal value corresponding to 1101 (bits 8-11) is d; and the hexadecimal permission code character corresponding to 0001 (bits 12-15) is 1.

[0113] During the number system conversion process, the process and results of the conversion can be cached, for example, in Redis (an open-source key-value cache).

[0114] In operation S503, the above 2 k The permission code characters in the base are arranged in order to obtain 2. k A sequence of strings in a number system.

[0115] Reference Figure 6 As shown, the corresponding hexadecimal permission code characters of each group are arranged according to the string sequence numbers 0, 1, 2, and 3 as follows: 5d d 1.

[0116] Figure 7 A detailed implementation flowchart of operation S205 according to an embodiment of the present disclosure is illustrated schematically.

[0117] According to embodiments of this disclosure, after obtaining the string sequence, the obtained string sequence and its encoding relationship are stored in the database as at least a portion of the permission configuration information. For example, the permission configuration information further includes: the identity identifier of the target user, or the permission configuration information is associated with the identity identifier of the target user.

[0118] After being stored in the database, the permission configuration information of each user can be distinguished based on the identity of each user. Therefore, when authenticating each user, the permission configuration information of each user is called from the database to perform permission verification.

[0119] Reference Figure 7 As shown, in the above operation S205, the permission configuration information is stored in the database, including the following operations: S701 and S702.

[0120] In operation S701, the above-mentioned encoding relationship and the above-mentioned string sequence are associated with the identity identifier of the target user.

[0121] In operation S702, the above-mentioned encoding relationship associated with the above-mentioned identity and the above-mentioned string sequence are stored in the database.

[0122] Based on the above operations S701 to S702, the string sequence and encoding relationship are associated with the identity identifier of the target user. The permission configuration information corresponding to different users is easy to distinguish when stored and retrieved, realizing personalized permission configuration for multiple users and multiple versions.

[0123] Figure 8 A flowchart illustrating a method for configuring permissions according to another embodiment of this disclosure is shown schematically.

[0124] Based on the foregoing embodiments, the permission configuration method provided in this disclosure, in addition to the aforementioned operations S201 to S205, also includes the following operation S801: updating permission configuration information. Operation S801 is executed after operations S201 to S205. For simplicity, in... Figure 8 Only operations S205 and S801 are shown in the diagram.

[0125] Figure 9 A detailed implementation flowchart of operation S801 according to an embodiment of the present disclosure is illustrated schematically. Figure 10 A schematic diagram illustrating an implementation scenario of operation S801 according to an embodiment of the present disclosure is shown.

[0126] Reference Figure 9As shown, the above operation S801 updates the permission configuration information, including the following operations: S901, S902, S903a, S904a, and S905a. Further, the following operations can be included: S903b, S904b, S905b, and S906b.

[0127] In operation S901, an update request is received to update the permission configuration information. The update request carries an update instruction for a specific permission.

[0128] The aforementioned specific permissions can be functional permissions that already exist in the target version of the software, or newly added functional permissions that were not originally present in the target version of the software. (See reference...) Figure 10 As shown, the update instructions for specific permissions include: adding specific permissions, deleting specific permissions, and modifying specific permissions. Modifying specific permissions can be done by changing the value of a function permission or by changing the correspondence between a function permission and the permission code position, that is, by modifying the encoding relationship. For example, the description information corresponding to adding a specific permission is: having access permission to the newly added function permission.

[0129] In operation S902, based on the above encoding relationship, it is determined whether the above permission code sequence has a target permission code position corresponding to the above specific permission.

[0130] In one implementation scenario, when the update instruction is "delete a specific permission" or "modify a specific permission," and the specific permission to be deleted or modified is an existing permission, it can be determined that there exists a target permission code position corresponding to the specific permission in the above permission code sequence, as shown below. Figure 10 The data flow corresponding to the long dashed line is shown. In another implementation scenario, when the update instruction is to add a specific permission, the specific permission to be added is not an existing permission, but there is a permission code position in the permission code sequence that has not yet been assigned a corresponding functional permission. That is, there is an empty position in the binary encoding sequence that has not yet been encoded. In this case, the empty position can be used as the target permission code position of the specific permission to be added. That is, the result determined in operation S902 is: there is a target permission code position corresponding to the specific permission to be added. Refer to Figure 10 The short dashed line corresponds to the "Yes" branch in the data stream. In both of the above implementation scenarios, subsequent operations S903a to S905a are executed.

[0131] In another implementation scenario, when the update instruction is "add a specific permission," and the specific permission to be added is neither an existing permission nor in the encoding relationship, it can be determined that there is no target permission code position corresponding to the specific permission in the above permission code sequence. (Refer to...) Figure 10The short dashed line corresponds to the "No" branch in the data stream. In this implementation scenario, subsequent operations S903b to S906b are executed.

[0132] In operation S903a, if a target permission code position exists in the above permission code sequence, the binary value at the target permission code position is updated according to the above update instruction to obtain the updated permission code sequence.

[0133] In this embodiment, the update instruction includes: deleting a specific permission or modifying a specific permission. When the update instruction is to delete a specific permission, the binary value at the target permission code position corresponding to the specific permission is deleted (one method of update); alternatively, the binary value at the target permission code position is initialized (e.g., initialized to 0), and the corresponding functional permission is assigned a null value (another method of update). When a new permission code is added later, the new permission code can be filled into the null value position.

[0134] When the update instruction is to modify specific permissions, the binary value at the target permission code location is changed, or the encoding relationship between the target permission code location and the function permission is changed.

[0135] In operation S904a, the updated permission code sequence is converted to a different base to obtain the updated 2. k A sequence of strings in a number system.

[0136] In operation S905a, the above encoding relationship and the updated 2 k The sequence of strings in a binary system is stored in the database as the updated permission configuration information.

[0137] According to embodiments of this disclosure, the update process of the aforementioned permission configuration information can be saved as a log. When the database has sufficient capacity, both the permission configuration information before and after the update can be stored. When needed, the corresponding permission configuration information can be retrieved. For example, when a query request for historical permission configuration information is received, the permission configuration information before the update can be retrieved to respond to the query request. During permission verification, if the updated permission configuration information has already taken effect, the updated permission configuration information is retrieved to perform permission verification.

[0138] In operation S903b, if the target permission code position does not exist in the above permission code sequence, a new permission code position is added based on the above permission code sequence, and a corresponding specific permission code position is assigned to the above specific permission in the newly added permission code position to obtain the updated encoding relationship.

[0139] In operation S904b, according to the above update instruction, the value at the specific permission code position is assigned to obtain the updated permission code sequence.

[0140] For example, refer to Figure 10 As shown, if the target permission code position does not exist in the permission code sequence, a 4-bit permission code position is added to the above permission code sequence, and a corresponding specific permission code position is assigned to the newly added specific permission. The value of the corresponding specific permission code position is then updated to 1. Figure 10 The example update corresponds to permission code 1.

[0141] In operation S905b, the updated permission code sequence is converted to a different base to obtain the updated 2. k A sequence of strings in a number system.

[0142] In operating S906b, the updated encoding relationship and the updated 2 k The sequence of strings in a binary system is stored in the database as the updated permission configuration information. (See reference...) Figure 10 As shown, a relational database (DB) is used as an example of a database.

[0143] A second exemplary embodiment of this disclosure provides a method for authorization verification.

[0144] Figure 11 A flowchart illustrating a method for authorization verification according to an embodiment of this disclosure is shown schematically.

[0145] Reference Figure 11 As shown, the permission verification method provided in this embodiment includes the following operations: S1101, S1102, and S1103. Operations S1101 to S1103 are performed by an electronic device with permission verification requirements, which may pre-store permission configuration information obtained from the first embodiment.

[0146] Reference Figure 1As indicated by the single-dash and double-dash arrows, operations S1101 to S1103 can be executed by the cloud platform 120, or by the service nodes in the terminal device 110 or service cluster 130. During execution, the terminal device 110 or service nodes in the service cluster 130 need to call the permission configuration information pre-configured by the cloud platform 120; or the permission configuration information pre-stored by the cloud platform 120 is stored in the service nodes of the terminal device 110 or service cluster 130. For specific implementation scenarios, please refer to the description of system architecture 100. After the permission verification is passed, the access page visibility control (front end) of the application (e.g., the application corresponding to the SaaS software service) on the terminal device is implemented, and the operation service support for the application is provided by calling the service resources corresponding to the API interface (back end).

[0147] In operation S1101, an authentication request is received to verify the access rights of the target version of the software. The authentication request carries the following information: the identity information of the access object and the operation instructions to be verified.

[0148] The aforementioned access target refers to the user corresponding to the cloud platform's login account, who requests access to the target version of the software.

[0149] The aforementioned operation commands can be user-initiated commands to log in and access the target version of the software, or various operation commands during the use of the target version of the software, including but not limited to: editing, viewing, querying, modifying, deleting, API interface calls, etc. These operation commands may involve front-end authentication (authentication for page display) and / or back-end authentication (authentication for resource calls).

[0150] In operation S1102, the identity information of the accessed object is used to authenticate the accessed object.

[0151] In one embodiment, authentication is successful if the accessed object belongs to one of the target users.

[0152] In operation S1103, if the authentication of the access object is successful, it is determined whether the access object has the permission to execute the above operation command based on the pre-configured permission configuration information, and the authentication result is obtained. The pre-configured permission configuration information is configured using the permission configuration method described above.

[0153] According to the embodiments of this disclosure, in the above operation S1103, it is determined whether the above access object has permission to implement the above operation instruction based on the pre-configured permission configuration information, and the authentication result is obtained, including the following sub-operations: S1103a, S1103b, S1103c, S1103d and S1103e.

[0154] In operation S1103a, the position of the permission code to be verified corresponding to the above operation instruction is determined according to the above encoding relationship in the above permission configuration information.

[0155] In operation S1103b, the ordinal number of the above-mentioned permission code position to be verified is divided by k, and the integer quotient is used as the ordinal number of the target position corresponding to the above-mentioned permission code position in the above-mentioned string sequence. The remainder is used as the ordinal number of the value 1 in the constructed k-bit binary standard permission code and the ordinal number of the comparison position.

[0156] In operation S1103c, based on the ordinal number of the target position, the permission code character at the target position is obtained from the string sequence, and the permission code character is converted to a base to obtain a k-bit binary permission code for verification.

[0157] In operation S1103d, the above-mentioned permission code used for verification is bitwise ANDed with the above-mentioned standard permission code to obtain the bitwise operation result corresponding to the ordinal number of the comparison position;

[0158] In operation S1103e, the authentication result is generated based on the bitwise operation results mentioned above.

[0159] Based on the above operations S1101 to S1103, by storing the encoding relationship between the function permissions obtained during encoding and the corresponding position of the permission code in the binary sequence to be encoded, and the string sequence in the database, during permission verification, the permission code characters in the string sequence can be quickly located and efficiently authenticated through the encoding relationship and number system conversion, thereby improving the response speed in high-concurrency and multi-version access scenarios.

[0160] The implementation process of operations S1101 to S1103 will be described below with reference to a specific embodiment.

[0161] Continuing with the example of configuring the OA system V3.0 described in the first embodiment above, in this embodiment, the authentication request in operation S1101 is for permission verification of the OA system V3.0 (target version software). The identity information of the access object is: User C, and the operation instruction to be verified is: access service resources R21 and R22 corresponding to API interface 2.

[0162] In operation S1102, based on the identity information of the access object: user C, the access object is authenticated, and the authentication result is successful.

[0163] Next, in operation S1103, based on the pre-configured permission information, it is determined whether the user C has permission to execute the above operation instruction: to access the service resources R21 and R22 corresponding to API interface 2.

[0164] Specifically, based on the encoding relationship in the pre-configured permission configuration information, the position of the permission code to be verified corresponding to the above operation instruction (corresponding to operation S1103a) is determined. As can be seen from the aforementioned embodiment, the functional permission corresponding to accessing the service resource R21 corresponding to API interface 2 is X. 12 According to the encoding relationship, "X" 12 →The 12th position can determine X 12 The corresponding position of the permission code to be verified is the 12th digit; similarly, it can be determined that the functional permission for accessing service resource R22 corresponding to API interface 2 is X. 13 And according to "X" 13 →The 11th bit indicates that the corresponding permission code to be verified is located at the 11th bit.

[0165] Then, divide the ordinal numbers of the above-mentioned permission code positions to be verified, 12 and 11, by 4 respectively (taking k=4 as an example), and the resulting integer quotients 3 and 2 are used as the ordinal numbers of the target positions of the above-mentioned permission code positions 12 and 11 in the above string sequence, respectively. The remainders 0 and 3 are used as the ordinal numbers of the corresponding values ​​of 1 in the constructed 4-bit binary standard permission code and the ordinal numbers of the comparison positions (corresponding to operation S1103b).

[0166] That is, (a) corresponds to the operation instruction to access the service resource R21 corresponding to API interface 2. The position of the permission code to be verified is: the 12th bit; the ordinal number of the target position in the string is 3; the constructed 4-bit binary standard permission codes are: 1××× (the 0th bit is assigned the value 1) (the position corresponding to × can be assigned the value 0 or 1. Since only the result of the 0th bit is used as the result of the bitwise AND operation, the other bits can be assigned any value).

[0167] (b) The operation instruction corresponding to accessing the service resource R22 of API interface 2 is located at the 11th bit of the permission code to be verified. The ordinal number of the target position in the string is 2. The constructed 4-bit binary standard permission codes are: ×××1 (the 3rd bit is assigned the value 1) (the position corresponding to × can be assigned the value 0 or 1. Since only the result of the 2nd bit is used as the result of the bitwise AND operation, the other bits can be assigned any value).

[0168] Based on the ordinal number of the target position, and the sequence number of the string sequence being 0, 1, 2, 3 respectively, arranged as 5d d 1, it can be seen that (a) corresponds to the operation instruction for accessing the service resource R21 corresponding to API interface 2. In the string sequence 5d d 1, the permission code character at the 3rd position (target position) can be obtained as 1. The permission code character 1 is converted to obtain a 4-bit binary permission code for verification as 0001; (b) corresponds to the operation instruction for accessing the service resource R22 corresponding to API interface 2. In the string sequence 5d d 1, the permission code character at the 2nd position (target position) can be obtained as d. The permission code character d is converted to obtain a 4-bit binary permission code for verification as 1101 (corresponding to operation S1103c).

[0169] Then, (a) the operation instruction corresponding to accessing the service resource R21 corresponding to API interface 2, performs a bitwise AND operation between the above-mentioned permission code "0001" used for verification and the above-mentioned standard permission code "1×××". In fact, based on the remainder, it is only necessary to calculate the ordinal number corresponding to the remainder, which is described here as the ordinal number of the comparison position, corresponding to the 0th bit. The bitwise operation result corresponding to the ordinal number of the comparison position is 0 (corresponding to operation S1103d). Based on the above bitwise operation result of 0, the authentication result can be obtained as: "Does not have" permission to access the service resource R21 corresponding to API interface 2 (corresponding to operation S1103e).

[0170] (b) For the operation instruction corresponding to accessing the service resource R22 corresponding to API interface 2, perform a bitwise AND operation between the above-mentioned authentication permission code "1101" and the above-mentioned standard permission code "×××1". In fact, based on the remainder, only the ordinal number corresponding to the remainder needs to be calculated, which is described here as the ordinal number of the comparison position, corresponding to the 3rd bit. The bitwise operation result corresponding to the ordinal number of the comparison position is 1 (corresponding to operation S1103d). Based on the above bitwise operation result of 1, the authentication result can be obtained as: "has" permission to access the service resource R22 corresponding to API interface 2 (corresponding to operation S1103e).

[0171] Therefore, since the pre-configured permission configuration information stores encoding relationships and string sequences, during permission verification, the permission code characters in the string sequence can be quickly located through encoding relationships and number system conversion, and converted into a k-bit binary sequence for bitwise authentication with the constructed k-bit binary standard permission code. During calculation, only the bits corresponding to the remainders in the k-bit binary sequence need to be considered, resulting in high calculation efficiency and high accuracy. This helps to achieve high-efficiency and high-accuracy authentication and improves the response speed in high-concurrency and multi-version access scenarios.

[0172] A third exemplary embodiment of this disclosure provides an apparatus for configuring permissions.

[0173] Figure 12 A schematic block diagram of a device for configuring permissions according to an embodiment of the present disclosure is shown.

[0174] Reference Figure 12 As shown, the permission configuration device 1200 provided in this embodiment includes: a configuration request receiving module 1201, an information acquisition module 1202, an encoding module 1203, a number system conversion module 1204, and a storage module 1205.

[0175] The configuration request receiving module 1201 is used to receive configuration requests for permission configuration of the target version of the software.

[0176] The information acquisition module 1202 is used to acquire description information of the functional permissions of the target version software. The description information is used to describe whether one or more functions of the target version software are open or closed to the target user.

[0177] The encoding module 1203 is used to encode the functional permissions of the target version software according to the above-described information, to obtain the encoding relationship and the binary permission code sequence. The encoding module 1203 includes functional modules or sub-modules for implementing the operations S301 to S303.

[0178] The above encoding relationship is used to characterize the correspondence between the above functional permissions and the position of the permission code in the binary sequence to be encoded.

[0179] The aforementioned number system conversion module 1204 is used to perform number system conversion on the aforementioned permission code sequence to obtain 2 k The number system is a string sequence in a base, where k ≥ 4 and k is an integer. The base conversion module 1204 includes functional modules or sub-modules for implementing the above operations S501 to S503.

[0180] The aforementioned storage module 1205 is used to store permission configuration information in a database. The permission configuration information includes the aforementioned encoding relationship and the aforementioned string sequence. The storage module 1205 includes functional modules or sub-modules for implementing the aforementioned operations S701 to S702.

[0181] According to embodiments of this disclosure, the above-mentioned permission configuration device 1200, in addition to including the above-mentioned configuration request receiving module 1201, information acquisition module 1202, encoding module 1203, number system conversion module 1204 and storage module 1205, also includes: an update request receiving module, a determination module and an encoding update module.

[0182] The update request receiving module is used to receive update requests that update permission configuration information. The update request carries an update instruction for a specific permission.

[0183] Update commands for specific permissions include: adding specific permissions, deleting specific permissions, and modifying specific permissions.

[0184] The aforementioned determining module is used to determine, based on the aforementioned encoding relationship, whether the aforementioned permission code sequence has a target permission code position corresponding to the aforementioned specific permission.

[0185] The above-mentioned encoding update module is used to update the binary value at the target permission code position according to the above-mentioned update instruction when the target permission code position exists in the above-mentioned permission code sequence, so as to obtain the updated permission code sequence.

[0186] The aforementioned number system conversion module is also used to convert the updated permission code sequence into a different number system to obtain the updated 2. k A sequence of strings in a number system.

[0187] The aforementioned storage module is also used to store the above-mentioned encoding relationship and the updated 2 k The sequence of strings in a binary system is stored in the database as the updated permission configuration information.

[0188] According to embodiments of this disclosure, the encoding update module is further configured to, when the target permission code position does not exist in the permission code sequence, add a permission code position based on the permission code sequence, and assign a corresponding specific permission code position to the specific permission in the newly added permission code position to obtain an updated encoding relationship; and assign values ​​to the values ​​at the specific permission code positions according to the update instruction to obtain an updated permission code sequence. The base conversion module is further configured to perform base conversion on the updated permission code sequence to obtain an updated 2... k The storage module described above is also used to store the updated encoding relationship and the updated binary string sequence. k The sequence of strings in a binary system is stored in the database as the updated permission configuration information.

[0189] The aforementioned device 1200 can be an electronic device that manages and controls the permissions of application software, such as an electronic device with a cloud platform installed. The aforementioned electronic device can be a networked terminal device with computing capabilities, or it can be a virtual host or cloud server, etc.

[0190] A fourth exemplary embodiment of this disclosure provides an apparatus for authorization verification.

[0191] Figure 13 A schematic block diagram of a permission verification apparatus according to an embodiment of the present disclosure is shown.

[0192] Reference Figure 13 As shown, the permission verification device 1300 provided in this embodiment includes: an authentication request receiving module 1301, an authentication module 1302, and a permission verification module 1303.

[0193] The authentication request receiving module 1301 is used to receive authentication requests for accessing objects of the target version of the software to verify their permissions. The authentication request carries information including: the identity information of the access object and the operation instructions to be verified.

[0194] The aforementioned authentication module 1302 is used to authenticate the aforementioned access object based on the identity information of the access object.

[0195] The aforementioned permission verification module 1303 is used to determine, based on pre-configured permission configuration information, whether the access object has permission to execute the aforementioned operation command after the access object's authentication has passed, and to obtain an authentication result. The aforementioned pre-configured permission configuration information is configured using the permission configuration method described above or using the permission configuration device described above.

[0196] The aforementioned permission verification module 1303 includes functional modules or sub-modules for implementing the aforementioned operations S1201 to S1205.

[0197] The aforementioned permission verification device 1300 can be an electronic device that manages and controls the permissions of application software, such as an electronic device with a cloud platform installed, or a service node in a terminal device or service cluster. The device 1300 stores pre-configured permission configuration information. When the device 1300 is an electronic device corresponding to a cloud platform, the pre-configured permission configuration information can be configured in the device 1300. When the device 1300 is a terminal device or a service node in a service cluster, the pre-configured permission configuration information can be configured in an electronic device with a cloud platform installed and then stored / synchronized to the device 1300.

[0198] The aforementioned functional modules can be implemented in a single functional module or broken down into multiple sub-modules. At least one of the aforementioned functional modules can be partially implemented as hardware circuitry, such as a Field-Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a System-on-a-Chip, a System-on-a-Substrate, a System-on-Package, an Application-Specific Integrated Circuit (ASIC), or implemented in hardware or firmware through any other reasonable means of integrating or packaging the circuitry. Alternatively, it can be implemented in software, hardware, or firmware, or in a suitable combination of any of these methods. Alternatively, at least one of the aforementioned functional modules can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0199] The fifth exemplary embodiment of this disclosure provides an electronic device.

[0200] Figure 14 A schematic block diagram of an electronic device provided in an embodiment of the present disclosure is shown.

[0201] Reference Figure 14 As shown, the electronic device 1400 provided in this embodiment includes a processor 1401, a communication interface 1402, a memory 1403, and a communication bus 1404. The processor 1401, the communication interface 1402, and the memory 1403 communicate with each other through the communication bus 1404. The memory 1403 is used to store computer programs. When the processor 1401 executes the program stored in the memory, it implements the permission configuration method or permission verification method as described above.

[0202] A sixth exemplary embodiment of this disclosure also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program that, when executed by a processor, implements the permission configuration method or permission verification method as described above.

[0203] The computer-readable storage medium may be included in the device / apparatus described in the above embodiments; or it may exist independently and not assembled into the device / apparatus. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0204] According to embodiments of this disclosure, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0205] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0206] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method of configuring permissions, the method comprising: The method comprises: receiving a configuration request for configuring permissions of target version software; obtaining description information of function permissions of the target version software, the description information being used to describe that one or more functions of the target version software are in an open state or a prohibited state for a target user; encoding the function permissions of the target version software according to the description information to obtain an encoding relationship and a binary permission code sequence; the encoding relationship is used to represent a corresponding relationship between the function permissions and permission code positions in a binary to-be-encoded sequence; converting the sequence of permission codes into a base-k string sequence, k > 4 and k is an integer k converting the sequence of permission codes into a base-k string sequence, k > 4 and k is an integer storing permission configuration information to a database, the permission configuration information comprising the encoding relationship and the string sequence. The encoding the function permissions of the target version software according to the description information to obtain an encoding relationship and a binary permission code sequence comprises:

2. The method of claim 1, wherein, allocating a corresponding permission code position in a binary to-be-encoded sequence to each function permission of the target version software to obtain an encoding relationship; determining a binary value of the permission code position corresponding to each function permission of the target version software according to the description information and the encoding relationship; and sequentially arranging the binary value according to the corresponding permission code position to obtain a binary permission code sequence. The permission code sequence is grouped according to the order from low to high in terms of bit number, each group containing k permission code bits, and zero is used to supplement the highest bit if the highest bit is less than k permission code bits.

3. The method of claim 1, wherein, The binary conversion of the permission code sequence obtains a 2 k string sequence in base The storing the permission configuration information to the database comprises: The binary sequence to be encoded corresponding to each group of k right code bits is converted into a right code character in base 2 k binary. The 2 k binary permission code characters are arranged in sequence to obtain a 2 k binary string sequence.

4. The method of claim 1, wherein, associating the encoding relationship and the string sequence with an identity of the target user; storing the encoding relationship and the string sequence associated with the identity to the database. The method further comprises:

5. The method according to any one of claims 1-4, characterized in that, receiving an update request for updating the permission configuration information, the update request carrying an update instruction for a specific permission; determining whether there is a target permission code position corresponding to the specific permission in the permission code sequence according to the encoding relationship; in a case where there is a target permission code position in the permission code sequence, updating a binary value at the target permission code position according to the update instruction to obtain an updated permission code sequence; The method further comprises: The updated permission code sequence is converted into a binary string sequence k sequence in binary. storing the encoded relationship and the updated 2 k string sequence in binary as the updated rights configuration information to the database.

6. The method of claim 5, wherein, in a case where there is no target permission code position in the permission code sequence, adding a permission code position on the basis of the permission code sequence, and allocating a specific permission code position corresponding to the specific permission in the added permission code position to obtain an updated encoding relationship; assigning a value to the specific permission code position according to the update instruction to obtain an updated permission code sequence. The method comprises: The updated permission code sequence is converted into a binary string sequence k sequence in binary. The updated encoding relationship and the updated 2 k string sequence in the binary as the updated permission configuration information to the database.

7. A method of rights verification, characterized by, receiving an authentication request for performing permission verification on an access object of target version software, the authentication request carrying information including identity information of the access object and an operation instruction to be verified; performing identity authentication on the access object according to the identity information of the access object. ​ In a case that the identity authentication of the access object is passed, it is determined according to the pre-configured permission configuration information whether the access object has the permission to implement the operation instruction, and an authentication result is obtained; wherein the pre-configured permission configuration information is configured by the method in any one of claims 1-6.

8. The method of claim 7, wherein, The determining whether the access object has the permission to implement the operation instruction according to the pre-configured permission configuration information to obtain the authentication result comprises: determining the to-be-verified permission code position corresponding to the operation instruction according to the encoding relationship in the permission configuration information; dividing the ordinal number of the to-be-verified permission code position by k to obtain an integer quotient as the ordinal number of the target position corresponding to the to-be-verified permission code position in the string sequence, and a remainder as the ordinal number and the comparison position of the value 1 in the k-bit binary standard permission code; obtaining the permission code character at the target position in the string sequence according to the ordinal number of the target position, and performing a base conversion on the permission code character to obtain a k-bit binary permission code for verification; performing a bitwise AND operation on the permission code for verification and the standard permission code to obtain a bit operation result corresponding to the ordinal number of the comparison position; generating an authentication result according to the bit operation result.

9. An apparatus for configuring rights, the apparatus comprising: It comprises: a configuration request receiving module configured to receive a configuration request for performing permission configuration on a target version software; an information obtaining module configured to obtain description information of function permissions of the target version software, the description information being used to describe that access of one or more functions of the target version software to a target user is in an open state or an inhibited state; an encoding module configured to encode the function permissions of the target version software according to the description information to obtain an encoding relationship and a binary permission code sequence; the encoding relationship being used to represent a corresponding relationship between the function permissions and permission code positions in a binary to-be-encoded sequence; a binary conversion module, configured to perform binary conversion on the sequence of permission codes to obtain a sequence of strings in base k, k≥4 and k is an integer; k a binary conversion module, configured to perform binary conversion on the sequence of permission codes to obtain a sequence of strings in base k, k≥4 and k is an integer; and a storage module configured to store permission configuration information to a database, the permission configuration information comprising the encoding relationship and the string sequence.

10. An apparatus for rights verification, the apparatus comprising: It comprises: an authentication request receiving module configured to receive an authentication request for performing permission verification on an access object of a target version software, the authentication request carrying information including identity information of the access object and a to-be-verified operation instruction; an identity authentication module configured to perform identity authentication on the access object according to the identity information of the access object; a permission verification module configured to, in a case that the identity authentication of the access object is passed, determine whether the access object has the permission to implement the operation instruction according to pre-configured permission configuration information to obtain an authentication result; wherein the pre-configured permission configuration information is configured by the method in any one of claims 1-6 or configured by the device in claim 9.

11. An electronic device, comprising: It comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete communication with each other through the communication bus; the memory is used to store a computer program. A processor for implementing the method of any of claims 1-8 when executing a program stored on a memory.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program, which when executed by a processor implements the method of any of claims 1-8.

Images