Permission Management Method, Device, Electronic Device and Medium

Abstract

An embodiment of the present application discloses a permission management method, device, electronic device, and medium. The method includes: constructing nodes according to user groups, users included in the user groups, resource groups, and resources included in the resource groups; constructing edges between the nodes according to the operation permission relationships between the user groups, the users, the resource groups, and the resources, and generating a permission graph. The above solution manages the permissions of users and user groups through the permission graph, thereby adaptively configuring different permissions for different users, and avoiding the problem that the one-to-one correspondence between users and permissions is numerous, resulting in a large and complex correspondence relationship and making it difficult to quickly sort out the permissions of users, providing a simple, efficient, and finely divisible permission management method.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of rights management, and in particular to a rights management method, apparatus, electronic device, and medium. Background Art

[0002] Whether a user can perform operations on a resource during resource processing is determined by whether the user has the authority to process the resource. Effective management of user authority over resource processing is required to ensure that resource processing is carried out legally and in an orderly manner.

[0003] The current permission management solution allows users to inherit all permissions from their user groups. While this allows for batch permission management, it makes it difficult to implement personalized permission management for each user in scenarios where users do not need to inherit all permissions from their user groups. Furthermore, the allocation of user permissions within user groups or roles is not granular enough. Furthermore, establishing a one-to-one permission association between users and resources results in multiple relationship lines between users and resources, resulting in a complex and cumbersome process and making it difficult to quickly identify and determine the permissions a user has. Summary of the Invention

[0004] The embodiments of the present application provide a permission management method, device, electronic device, and medium to perform refined management of permissions in a concise manner.

[0005] In one embodiment, the present application provides a rights management method, the method comprising:

[0006] Constructing a node according to a user group, users included in the user group, a resource group, and resources included in the resource group;

[0007] According to the operation permission relationship between the user group, the user; the resource group and the resource, edges between the nodes are constructed to generate a permission graph.

[0008] In another embodiment, the present application also provides a rights management device, which includes:

[0009] A node construction module, configured to construct a node based on a user group, the users included in the user group, and a resource group and the resources included in the resource group;

[0010] The permission graph generation module is used to construct edges between the nodes and generate a permission graph based on the operation permission relationship between the user group, the user, the resource group and the resource.

[0011] In yet another embodiment, an embodiment of the present application further provides an electronic device, including: one or more processors;

[0012] A memory for storing one or more programs;

[0013] When the one or more programs are executed by the one or more processors, the one or more processors implement the privilege management method according to any one of the embodiments of the present application.

[0014] In yet another embodiment, the embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, and when the program is executed by a processor, it implements the privilege management method according to any one of the embodiments of the present application.

[0015] In the embodiments of the present application, nodes are constructed according to user groups, users included in the user groups, resource groups, and resources included in the resource groups; according to the operation privilege relationships between the user groups, the users, the resource groups, and the resources, edges between the nodes are constructed to generate a privilege graph, so that by respectively configuring the edges between users and user groups, user groups and resource groups, and resource groups and resources, the refined configuration and management of user privileges for resources can be realized, and privileges can be refinedly configured for different users in a simple and clear manner. Description of the Drawings

[0016] Figure 1 It is a flowchart of the privilege management method provided by an embodiment of the present invention;

[0017] Figure 2 It is a schematic diagram of the privilege graph provided by an embodiment of the present invention;

[0018] Figure 3 It is a flowchart of the privilege management method provided by another embodiment of the present invention;

[0019] Figure 4 It is a first schematic diagram of operation privilege determination provided by another embodiment of the present invention;

[0020] Figure 5 It is a second schematic diagram of operation privilege determination provided by another embodiment of the present invention;

[0021] Figure 6 It is a schematic diagram of specific privilege representation provided by another embodiment of the present invention;

[0022] Figure 7 It is a schematic diagram of adding node privilege representation provided by another embodiment of the present invention;

[0023] Figure 8 It is a schematic diagram of the structure of the privilege management device provided by an embodiment of the present invention;

[0024] Figure 9 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Detailed implementation manners

[0025] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present invention, rather than limiting the present invention. In addition, it should be noted that for the convenience of description, only parts related to the present invention rather than all structures are shown in the drawings.

[0026] Figure 1 The figure is a flowchart of a permission management method provided by an embodiment of the present invention. The permission management method provided by this embodiment is applicable to the situation of managing the permissions of users and user groups. Typically, this method can be applicable to the situation of managing the permissions of users and user groups based on a graph database. Specifically, this method can be executed by a permission management device, which can be implemented in a software and / or hardware manner, and the device can be integrated in an electronic device. Refer to Figure 1 , the method of the embodiment of the present application specifically includes:

[0027] S110. Construct nodes according to user groups, users included in the user groups, resource groups, and resources included in the resource groups.

[0028] Among them, user groups can be obtained by grouping users according to actual needs and application scenarios. For example, it can be a management group in a company, including management personnel such as the chairman and manager of the company, or it can be a class group in a school, including students and teachers in the class. A user belongs to only one user group. Resources and resource groups are objects on which operations are performed. For example, they can be tables, images, files, etc. A resource belongs to only one resource group. Since a resource group is composed of resources, in fact, they all belong to the objects on which operations are performed and do not actively perform operations. Therefore, it is default that the resource group has all operation permissions for the resources it includes.

[0029] Currently, when using RBAC (Role-Based Access Control) for permission management, various permissions for system operations are not directly granted to specific users, but a role set is established between the user set and the permission set. Each role corresponds to a set of corresponding permissions. Once a user is assigned an appropriate role, the user has all the operation permissions of this role. However, for each user, different permissions cannot be configured, and refined permission division and configuration cannot be achieved. If each user corresponds to a set of permissions and each user has multiple permissions, there will be multiple relationship lines between the user and the resources, resulting in a large number of relationship lines, which are complex and cumbersome and difficult to quickly sort out and determine the permissions of the user.

[0030] In an embodiment of the present application, a concise and refined permission management method is provided. Nodes are constructed based on user groups, users included in the user groups, resource groups, and resources included in the resource groups, thereby forming four layers of nodes, including nodes at the user level, user group level, resource group level, and resource level. Each level has no hierarchy. By determining the operation permission relationships between each level, the operation permissions of users on resources can be determined. Through the connection of intermediate level nodes, namely user groups and resource groups, and the refined representation of the operation permission relationships between users and user groups, refined permission management can be achieved in a concise manner.

[0031] S120. According to the operation permission relationships between the user groups, the users, the resource groups, and the resources, construct the edges between the nodes to generate a permission graph.

[0032] Among them, the operation permission relationships include that users inherit the operation permissions of user groups, or the operation permissions of user groups on resource groups. The operation permissions include, but are not limited to, permissions for operations such as deleting structures, modifying structures, deleting data, modifying data, creating resources, and selecting resources on resource groups and resources. In an embodiment of the present application, since users belong to user groups, users can be made to inherit some of the operation permissions of the user groups on resource groups, or all of the operation permissions of the user groups on resource groups. For example, if a user group has permissions for deleting structures, deleting data, creating resources, and selecting resources on a resource group, a user can only inherit the permissions for deleting structures and deleting data of the user group on the resource group, and does not have the permissions for creating resources and selecting resources. User groups can have corresponding operation permissions on resource groups. By default, resource groups have all operation permissions on resources.

[0033] Exemplarily, connect the user node and the user group node, construct the edge between the user node and the user group node, and add the permission for the user to inherit the user group as the attribute of this edge. Connect the user group node and the resource group node, construct the edge between the user group node and the resource group node, and add the operation permission of the user group on the resource group as the attribute of this edge. Connect the resource group node and the resource node, construct the edge between the resource group node and the resource node, and add the operation permission of the resource group on the resource as the attribute of this edge. After constructing the edges between each node and marking the attributes of each edge, a permission graph is obtained, as Figure 2As shown in the figure. Among them, u1 represents user 1, u2 represents user 2, ug1 represents user group 1, tg1 represents resource group 1, t1 represents resource 1, and t2 represents resource 2. f1 is the attribute of the edge between u1 and ug1, f2 is the attribute of the edge between u2 and ug1, x1 is the attribute of the edge between ug1 and tg1, m1 is the attribute of the edge between tg1 and t1, and m2 is the attribute of the edge between tg1 and t2. Figure 2 This is just an example of a situation and does not limit the number of each node.

[0034] In the embodiments of the present application, nodes are constructed according to user groups, users included in the user groups, resource groups, and resources included in the resource groups; according to the operation permission relationships between the user groups, the users, the resource groups, and the resources, edges between the nodes are constructed to generate a permission graph, so that by respectively configuring the edges between users and user groups, user groups and resource groups, and resource groups and resources, the refined configuration and management of user permissions to resources can be realized, and permissions can be refinedly configured for different users in a simple and clear manner.

[0035] Figure 3 It is a flowchart of the permission management method provided by another embodiment of the present invention. The embodiments of the present application are further optimizations of the above embodiments. For details not described in detail in this embodiment, please refer to the above embodiments. Refer to Figure 3 , the permission management method provided by this embodiment may include:

[0036] S210. Construct nodes according to user groups, users included in the user groups, resource groups, and resources included in the resource groups.

[0037] S220. Determine the operation permissions of each node for at least one operation item.

[0038] Among them, at least one operation item may be at least one of deleting a structure, modifying a structure, deleting data, modifying data, creating a resource, and selecting a resource, etc. Determine the operation permissions of each node for at least one operation item, and thus determine the attributes of each edge in the permission graph according to the operation permissions of each node.

[0039] In the embodiments of the present application, determining the operation permissions of each node for at least one operation item includes: for at least one operation item, determining whether the user inherits the operation permissions of the user group for at least one operation item, and determining whether the user group has the operation permissions for at least one operation item for the resource group; wherein, the resource group has the operation permissions for at least one operation item for the resource.

[0040] Among them, determining whether a user inherits the operation permissions of a user group for at least one operation item can be to separately determine the operation permissions for each operation item in the at least one operation item. For the operation permissions of each operation item, the user can inherit from the user group or not. Determining whether a user group has the operation permissions for at least one operation item on a resource group can be to separately determine the operation permissions for each operation item in the at least one operation item. For each operation item, the user group can have the operation permissions for the resource group or not. The resource group and the included resources are all objects to be executed, so by default, the resource group has all the permissions for the resources.

[0041] S230. Calculate the weights of the edges between each node according to whether each node has the operation permissions for at least one operation item, and generate a permission graph.

[0042] In the embodiment of the present application, by calculating the weights of the edges between each node according to whether each node has the operation permissions for at least one operation item, it is convenient to determine the operation permissions of the user for the resources through the paths formed by the edges, and to determine the permissions of each path from the user to the resources through the weights of the edges.

[0043] In the embodiment of the present application, calculating the weights of the edges between each node according to whether each node has the operation permissions for at least one operation item includes: if a node has the operation permissions for an operation item, using a first preset value as the representation value, and if a node does not have the operation permissions for an operation item, using a second preset value as the representation value; calculating the weights of the edges between each node according to the representation value.

[0044] Exemplarily, for a user node, whether it has the operation permission for an operation item indicates whether the user node inherits the operation permission of the user group for the operation item. For a user group node, whether it has the operation permission for an operation item indicates whether the user group node has the operation permission for the operation item of the resource group node. Whether each node has the operation permission for an operation item can be represented by 0 or 1 as the representation value. If the first preset value is set to 0 and the second preset value is set to 1, then when the node has the operation permission for the operation item, 0 is used as the representation value, and when the node does not have the operation permission for the operation item, 1 is used as the representation value. It is also possible to set the first preset value to 1 and the second preset value to 0. When the operation items include six items: deleting a structure, modifying a structure, deleting data, modifying data, creating a resource, and selecting a resource, when determining whether the node has the operation permission for each operation item, a representation value is obtained for each. After judging the six operation items, six representation values are obtained, and the six representation values form the weight of the edge. The representation value of whether the node has the operation permission corresponds to the operation item. As shown in Table 1. The representation values are combined bit by bit to obtain the weight of the edge. If the determined representation value represents the operation permission of the user group for at least one operation item of the resource group, the generated weight is the weight of the edge between the user group node and the resource group node. If the determined representation value represents that the user inherits the operation permission of the user group for at least one operation item, the generated weight is the weight of the edge between the user node and the user group node.

[0045] Table 1

[0046]

[0047] In the embodiment of the present application, after obtaining the binary weight by combining 0 and 1 as the representation values, the weight can also be converted into a decimal value to facilitate subsequent calculation and comparison of the weights of the paths. For example, when a user group has the operation permissions of modifying data, creating a resource, and selecting a resource for a resource group, the weight is represented in binary as 111000 and in decimal as 56. When all operation permissions are available, the weight is represented in binary as 000000 and in decimal as 0. When no operation permission is available, the weight is represented in binary as 111111 and in decimal as 63. In the permission graph, there is no edge with a weight of 63 because when the permission value is 63, it means unreachable, and there is no connection between the two nodes, that is, there is no corresponding path.

[0048] S240. Use the sum of the weights of all the edges in the path from the user to the resource as the weight of this path.

[0049] Such as Figure 2As shown in the figure, the operation permission of user u1 for resource t1 can be determined by the path u1 - ug1 - tg1 - t1 between user u1 and resource t1. The sum of the weights of each edge in this path is used as the weight of this path, that is, fi + x1 + m1. The magnitude of the weight can reflect the magnitude of the operation permission of user u1 for resource t1. The weight calculation of other paths is the same.

[0050] In the embodiments of the present application, in order to ensure the accuracy of carry in the summation calculation, the number of bits of the binary weight can be set to twice the number of operation items. Exemplarily, when there are 6 operation items, the number of bits of the weight can be 12 bits. Taking the case where the first preset value is 0 and the second preset value is 1 as an example, when the weight is the weight of the edge between the user node and the user group node, the first 6 bits in the 12 - bit binary weight are the weights representing the numerical composition, and the last 6 bits are defaulted to 0. When the weight is the weight of the edge between the user group node and the resource group node, the first 6 bits in the 12 - bit binary weight are defaulted to 0, and the last 6 bits are the weights representing the numerical composition. When the weight is the weight of the edge between the resource group node and the resource node, all the numerical values in the 12 - bit binary weight are 0. Represented in this way, it is ensured that the binary summation result is consistent with the decimal summation result, avoiding errors caused by inconsistent carry.

[0051] S250. Determine the path representing the maximum operation permission according to the weight of the path, so as to determine the operation permission of the user for the resource through this path.

[0052] Exemplarily, if there are two or more paths from the user node to the resource node, then select the path representing the maximum operation permission, and determine the operation permission of the user for the resource through this path. Specifically, when the first preset value is 0 and the second preset value is 1, the Floyd algorithm can be used to calculate the path with the minimum weight, and this path is the path representing the maximum operation permission. Similarly, when the first preset value is 1 and the second preset value is 0, the path with the maximum weight can be calculated, and this path is the path representing the maximum operation permission.

[0053] S260. Determine the representation value indicating whether the user has operation permission for each operation item of the resource according to the weight of the path representing the maximum operation permission.

[0054] S270. Determine whether the user has operation permission for each operation item of the resource according to the representation value.

[0055] Specifically, the edges from users to user groups, from user groups to resource groups, and from resource groups to resources in the permission graph all have attributes representing operation permissions. If we want to determine whether a user has a certain operation permission for a resource, it is necessary that the weights of the edges in the path from the user node to the resource node all represent the inclusion of this operation permission. For example, if user u1 needs to delete a piece of data from resource t1, and user u1 reaches t1 through the path u1-ug1-tg1-t1, then the prerequisite for user u1 to have the permission to delete data from table t1 is that user u1 inherits the permission to delete data from user group ug1, user group ug1 has the permission to delete data from resource group tg1, and resource group tg1 has the permission to delete data from resource t1, in order to indicate that user u1 has the permission to delete data from resource t1.

[0056] If the first preset value is 0, the second preset value is 1, and the number of operation items is six, let Figure 2 in which the weight of f1 is 2112, converted to binary 100001000000, the weight of f2 is 2560, converted to binary 101000000000, the permission value of x1 is 5, converted to binary 000000000101, and both m1 and m2 are 0. The sum of the weights from u1 to t2 is 2112 + 5 = 2117. Converted to binary 100001000101. Split the sum of the weights from u1 to t2 into two hexadecimal values, which are 100001 and 000101 respectively, representing the weight f1 from u1 to ug1 and the weight x1 from ug1 to tg1. The bitwise OR of the two values can get 100101, as Figure 4 shown, corresponding to the operation items arranged in Table 1, it can be determined that the operation permissions of u1 for t2 are three operation permissions: deleting the structure, modifying data, and selecting resources. Similarly, the sum of the weights from u2 to t2 is 2560 + 5 = 2565, converted to binary 101000000101. Split the sum of the weights from u2 to t2 into two hexadecimal values, which are 101000 and 000101 respectively, representing the weight f2 from u2 to ug1 and the weight x1 from ug1 to tg1. The bitwise OR of the two values can get 101101, as Figure 5 shown, corresponding to the operation items arranged in Table 1, it can be determined that the operation permissions of u2 for t2 are two operation permissions: modifying the structure and creating resources.

[0057] The technical solution of the embodiment of the present application quantifies and represents the permission levels of nodes by calculating the weights of the edges between nodes, which is convenient for managing permissions and subsequent determination of the permissions of nodes through the weights. The path representing the maximum permission is determined through the weights of the path to determine the permission, so as to accurately determine the permissions of nodes.

[0058] In the embodiment of the present application, if there is only one path between a node and a resource, when the weight value is represented by a binary number, the number of bits of the binary number can be equal to the number of operation items. Exemplarily, when the number of operation items is 6, the number of bits of the weight value represented by a binary number can be 6 bits. For example, if the first preset value is 0 and the second preset value is 1, Figure 2 the weight value of f1 in Figure 2 is 33, which is converted to binary 100001, the permission value of x1 is 5, which is converted to binary 000101, and both m1 and m2 are 0. The weight values of u1 to ug1 are 100001, and the weight value of ug1 to tg1 is 000101. The bitwise OR of the two values can obtain 100101. Corresponding to the arranged operation items in Table 1, it can be determined that the operation permissions of u1 for t2 are three operation permissions: deleting a structure, modifying data, and selecting a resource.

[0059] In the embodiment of the present application, after generating the permission graph, the method further includes: if the specific operation permission of the user for the resource is different from the operation permission of the user for the resource represented in the permission graph, then add an edge connecting the user and the resource in the permission graph; calculate the weight value of the added edge connecting the user and the resource according to the specific operation permission of the user for the resource.

[0060] Exemplarily, after generating the permission graph, if a user needs to configure an operation permission different from the current representation in the permission graph for a specific resource, an edge directly connecting this user to this resource can be added, and the weight value is calculated according to the custom operation permission and used as the weight value of the directly connected edge. As Figure 6 shown, on the basis of the permission graph in Figure 2 an edge is added, directly connecting u1 to t1, and the weight value of the edge is ut1. There are two paths between u1 and t1, which are u1 - t1 and ut1 - ug1 - tg1 - t1 respectively, and the weight values corresponding to these two paths are ut1 and f1 + x1 + m1 respectively. The path with the largest operation permission among these two weight values is the shortest path. When it is necessary to judge the operation permission of u1 for t1, the path with the largest operation permission, that is, the shortest path, is adopted by default.

[0061] In an embodiment of the present application, after generating the permission graph, the method further includes: if there is at least one node among newly added users, user groups, resource groups, and resources, construct an edge between the newly added node and a target node in the permission graph; wherein, the target node is a node having an operation permission relationship with the newly added node; calculate the weight of the edge between the newly added node and the target node in the permission graph according to the operation permission relationship between the newly added node and the target node. If the newly added resource is created by a user in the permission graph, constructing an edge between the newly added node and a target node in the permission graph includes: constructing an edge between the newly added resource and the user who created the resource, and determining the weight of the edge between the newly added resource and the user who created the resource according to the operation permission relationship between the newly added resource and the user who created the resource.

[0062] As Figure 7 shown, if a new user u3 is added, add the u3 node, and construct an edge between u3 and the user group ug1 to which it belongs, and determine the weight f3 according to the operation permissions inherited by user u3 from user group ug1. If a new user group ug2 is added, add the ug2 node, and construct an edge between ug2 and the resource group tg1, and determine the weight x2 according to the operation permissions of user group ug2 for resource group tg1. If a new resource group tg2 is added, add the tg2 node, and construct an edge with the user group ug1 having an operation permission relationship therewith, and determine the weight x3 according to the operation permissions of user group ug1 for resource group tg2. If a new resource t3 is added and resource t3 belongs to resource group tg1, add the t3 node, and construct an edge between t3 and resource group t1. Resource group tg1 has all operation permissions for t3, and determine the weight m3. Additionally, if t3 is created by user u2, establish a direct edge between u2 and t3, and determine the weight ut2 according to the operation permissions of user u2 for t3. Since t3 is directly created by user u2, it can be defaulted that user u2 has all operation permissions for resource t3.

[0063] The above solution manages newly added users, user groups, resource groups, and resources in a concise manner, expands the available scope of permission management, and realizes refined configuration and management.

[0064] Figure 8 The following is a schematic structural diagram of a permission management device provided by an embodiment of the present invention. This device is applicable to the situation of managing the permissions of users and user groups. Typically, this method can be applicable to the situation of managing the permissions of users and user groups based on a graph database. This device can be implemented in a software and / or hardware manner, and this device can be integrated in an electronic device. Refer to Figure 8 and, specifically, this device includes:

[0065] A node construction module 310, configured to construct nodes according to user groups, users included in the user groups, resource groups, and resources included in the resource groups;

[0066] A permission graph generation module 320, configured to construct edges between the nodes according to the operation permission relationships between the user groups, the users, the resource groups, and the resources, and generate a permission graph.

[0067] In an embodiment of the present application, the permission graph generation module 320 includes:

[0068] An operation permission determination unit, configured to determine the operation permissions of each node for at least one operation item;

[0069] A weight calculation unit, configured to calculate the weights of the edges between the nodes according to whether each node has operation permissions for at least one operation item.

[0070] In an embodiment of the present application, the operation permission determination unit is specifically configured to:

[0071] For at least one operation item, determine whether the user inherits the operation permissions of the user group for at least one operation item, and determine whether the user group has operation permissions for at least one operation item for the resource group;

[0072] Wherein, the resource group has operation permissions for at least one operation item for the resources.

[0073] In an embodiment of the present application, the weight calculation unit is specifically configured to:

[0074] If a node has operation permissions for an operation item, use a first preset value as the representation value; if a node does not have operation permissions for an operation item, use a second preset value as the representation value;

[0075] Calculate the weights of the edges between the nodes according to the representation values.

[0076] In an embodiment of the present application, the apparatus further includes:

[0077] An addition module, configured to add an edge connecting the user and the resource in the permission graph if the specific operation permissions of the user for the resource are different from the operation permissions of the user for the resource represented in the permission graph;

[0078] A calculation module, configured to calculate the weight of the added edge connecting the user and the resource according to the specific operation permissions of the user for the resource.

[0079] In an embodiment of the present application, the apparatus further includes:

[0080] A new permission construction module, which is used to construct an edge between a newly added node and a target node in the permission graph if there is at least one node among newly added users, user groups, resource groups, and resources; wherein, the target node is a node having an operation permission relationship with the newly added node.

[0081] A new weight calculation module, which is used to calculate the weight of the edge between the newly added node and the target node in the permission graph according to the operation permission relationship between the newly added node and the target node.

[0082] In an embodiment of the present application, if the newly added resource is created by a user in the permission graph, the new permission construction module includes:

[0083] A direct connection unit, which is used to construct an edge between the newly added resource and the user who created the resource, and determine the weight of the edge between the newly added resource and the user who created the resource according to the operation permission relationship between the newly added resource and the user who created the resource.

[0084] In an embodiment of the present application, the device further includes:

[0085] A weight sum calculation module, which is used to use the sum of the weights of all edges in the path from the user to the resource as the weight of this path.

[0086] A path determination module, which is used to determine a path representing the maximum operation permission according to the weight of the path, so as to determine the operation permission of the user for the resource through this path.

[0087] In an embodiment of the present application, the device further includes:

[0088] An identification value determination module, which is used to determine a representation value indicating whether the user has operation permission for each operation item of the resource according to the weight of the path representing the maximum operation permission.

[0089] An operation permission determination module, which is used to determine whether the user has operation permission for each operation item of the resource according to the representation value.

[0090] The permission management device provided by the embodiment of the present application can execute the permission management method provided by any embodiment of the present application, and has corresponding functional modules and beneficial effects for executing the method.

[0091] Figure 9 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. Figure 9 It shows a block diagram of an exemplary electronic device 412 suitable for implementing the embodiment of the present application. Figure 9 The displayed electronic device 412 is only an example, and should not bring any limitation to the functions and usage scope of the embodiment of the present application.

[0092] As shown Figure 9 in FIG. 412, the electronic device 412 may include: one or more processors 416; a memory 428 for storing one or more programs, which when executed by the one or more processors 416 cause the one or more processors 416 to implement the permission management method provided by the embodiments of the present application, including:

[0093] Constructing nodes according to user groups, the users included in the user groups, resource groups, and the resources included in the resource groups;

[0094] Constructing edges between the nodes according to the operation permission relationships between the user groups, the users, the resource groups, and the resources to generate a permission graph.

[0095] The components of the electronic device 412 may include, but are not limited to: one or more processors or the processor 416, a memory 428, and a bus 418 connecting different device components (including the memory 428 and the processor 416).

[0096] The bus 418 represents one or more of several types of bus architectures, including a memory bus or a memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the multiple bus architectures. By way of example, these architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0097] The electronic device 412 typically includes a variety of computer device-readable storage media. These storage media can be any available storage media accessible by the electronic device 412, including volatile and non-volatile storage media, removable and non-removable storage media.

[0098] The memory 428 may include computer device-readable storage media in the form of volatile memory, such as random access memory (RAM) 430 and / or cache memory 432. The electronic device 412 may further include other removable / non-removable, volatile / non-volatile computer device storage media. By way of example only, a storage system 434 may be used for reading and writing non-removable, non-volatile magnetic storage media ( Figure 9 not shown, commonly referred to as a "hard disk drive"). Although Figure 9not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (such as a "floppy disk") and an optical disk drive for reading and writing a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM or other optical storage medium) may be provided. In these cases, each drive may be connected to the bus 418 through one or more data storage medium interfaces. The memory 428 may include at least one program product having a set (such as at least one) of program modules configured to perform the functions of the embodiments of the present invention.

[0099] A program / utility 440 having a set (at least one) of program modules 442 may be stored, for example, in the memory 428. Such program modules 442 include, but are not limited to, an operating device, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment. The program modules 442 generally perform the functions and / or methods in the embodiments described in the present invention.

[0100] The electronic device 412 may also communicate with one or more external devices 414 (such as a keyboard, a pointing device, a display 424, etc.), and may also communicate with one or more devices that enable a user to interact with the electronic device 412, and / or communicate with any device that enables the electronic device 412 to communicate with one or more other computing devices (such as a network card, a modem, etc.). Such communication may be carried out through an input / output (I / O) interface 422. Moreover, the electronic device 412 may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 420. As Figure 9 shown, the network adapter 420 communicates with other modules of the electronic device 412 through the bus 418. It should be understood that although Figure 9 not shown in the figure, other hardware and / or software modules may be used in combination with the electronic device 412, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID devices, tape drives, and data backup storage devices, etc.

[0101] The processor 416 executes various functional applications and data processing by running at least one of the other programs in the multiple programs stored in the memory 428, for example, implementing a permission management method provided by the embodiments of the present application.

[0102] An embodiment of the present invention provides a storage medium containing computer-executable instructions, and the computer-executable instructions are used to execute a permission management method when executed by a computer processor, including:

[0103] Construct nodes according to user groups, users included in the user groups, resource groups, and resources included in the resource groups.

[0104] Construct edges between the nodes according to the operation permission relationships among the user groups, the users, the resource groups, and the resources, and generate a permission graph.

[0105] The computer storage medium of the embodiments of the present application may adopt any combination of one or more computer-readable storage media. The computer-readable storage medium may be a computer-readable signal storage medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, apparatus, or component, or any combination of the above. More specific examples (non-exhaustive list) of the computer-readable storage medium include: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the embodiments of the present application, the computer-readable storage medium may be any tangible storage medium that contains or stores a program, and the program may be used by or in combination with an instruction execution device, apparatus, or component.

[0106] The computer-readable signal storage medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal storage medium may also be any computer-readable storage medium other than the computer-readable storage medium, and the computer-readable storage medium may send, propagate, or transmit a program for use by or in combination with an instruction execution device, apparatus, or component.

[0107] The program code contained on the computer-readable storage medium may be transmitted using any appropriate storage medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0108] Computer program code for performing the operations of the present invention may be written in one or more programming languages or combinations thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and also including conventional procedural programming languages such as the "C" language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or device. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0109] Note that the above is only a preferred embodiment of the present invention and the technical principles applied. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, re-adjustments, and substitutions can be made by those skilled in the art without departing from the protection scope of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments. Without departing from the concept of the present invention, more other equivalent embodiments may be included, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A permission management method, characterized in that, The method includes: Constructing nodes according to user groups, users included in the user groups, resource groups, and resources included in the resource groups; wherein, the nodes are four-layer nodes, including nodes at the user level, user group level, resource group level, and resource level; Constructing edges between the nodes according to the operation permission relationships among the user groups, the users, the resource groups, and the resources, and generating a permission graph; The constructing of the edges between the nodes according to the operation permission relationships among the user groups, the users, the resource groups, and the resources includes: Determining the operation permissions of each node for at least one operation item; Calculating the weights of the edges between the nodes according to whether each node has operation permissions for at least one operation item.

2. The method according to claim 1, wherein Determining the operation permissions of each node for at least one operation item includes: For at least one operation item, determining whether the user inherits the operation permissions of the user group for at least one operation item, and determining whether the user group has operation permissions for at least one operation item for the resource group; Wherein, the resource group has operation permissions for at least one operation item for the resources.

3. The method according to claim 1, wherein Calculating the weights of the edges between the nodes according to whether each node has operation permissions for at least one operation item includes: If a node has operation permissions for an operation item, taking a first preset value as the representation value, and if a node does not have operation permissions for an operation item, taking a second preset value as the representation value; Calculating the weights of the edges between the nodes according to the representation value.

4. The method according to claim 1, wherein After generating the permission graph, the method further includes: If the specific operation permissions of the user for the resource are different from the operation permissions of the user for the resource represented in the permission graph, adding an edge connecting the user and the resource in the permission graph; Calculating the weight of the added edge connecting the user and the resource according to the specific operation permissions of the user for the resource.

5. The method according to claim 1, wherein After generating the permission graph, the method further includes: If there are at least one node among newly added users, user groups, resource groups, and resources, constructing an edge between the newly added node and a target node in the permission graph; wherein, the target node is a node having an operation permission relationship with the newly added node; Calculating the weight of the edge between the newly added node and the target node in the permission graph according to the operation permission relationship between the newly added node and the target node.

6. The method according to claim 5, wherein If the newly added resource is created by a user in the permission graph, constructing an edge between the newly added node and a target node in the permission graph includes: Constructing an edge between the newly added resource and the user who created the resource, and determining the weight of the edge between the newly added resource and the user who created the resource according to the operation permission relationship between the newly added resource and the user who created the resource.

7. The method according to any one of claims 1-6, characterized in that, After generating the permission graph, the method further includes: Taking the sum of the weights of all the edges in the path from the user to the resource as the weight of the path; Determining the path representing the maximum operation permission according to the weight of the path, so as to determine the operation permissions of the user for the resource through this path.

8. The method according to claim 7, wherein After determining the path representing the maximum operation permission, the method further includes: Determine a representation value indicating whether the user has operation permissions for each operation item of the resource according to the weight of the path representing the maximum operation permission. Determine whether the user has operation permissions for each operation item of the resource according to the representation value.

9. A permission management device, characterized in that, The device includes: A node construction module, configured to construct nodes according to a user group, users included in the user group, a resource group, and resources included in the resource group; wherein the nodes are four-layer nodes, including nodes at the user level, user group level, resource group level, and resource level. A permission graph generation module, configured to construct edges between the nodes according to the operation permission relationships among the user group, the user, the resource group, and the resources, and generate a permission graph. The permission graph generation module includes: An operation permission determination unit, configured to determine the operation permissions of each node for at least one operation item. A weight calculation unit, configured to calculate the weights of the edges between the nodes according to whether each node has operation permissions for at least one operation item.

10. An electronic device, characterized in that, The electronic device includes: One or more processors; A memory, configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the permission management method according to any one of claims 1-8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the permission management method according to any one of claims 1-8.

Images