Access control methods, devices, computer equipment, and storage media

Abstract

This application relates to a permission management method, apparatus, computer device, storage medium, and computer program product. The method includes: acquiring permissions with an expiration date granted to a role; detecting whether the expiration date of the permissions has expired; and revoking the permissions when the expiration date has passed. This method enables timely and effective automatic revocation of permissions after their expiration.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to a method, apparatus, computer equipment, storage medium, and computer program product for access control. Background Technology

[0002] The application system permission model can grant application permissions directly to users and permission objects, or it can grant application permissions to application system roles and then assign roles to users and permission objects. During system use, business operations are performed by administrators manually assigning relevant permissions to other business administrators.

[0003] However, in traditional technology, since the revocation of role permissions requires manual revocation by the administrator, errors and omissions often occur as the number of users increases. Summary of the Invention

[0004] Therefore, it is necessary to provide a permission management method, apparatus, computer device, computer-readable storage medium, and computer program product that can automatically revoke permissions after their expiration date, in order to address the aforementioned technical problems.

[0005] Firstly, this application provides a method for managing access permissions. The method includes:

[0006] Obtain time-limited permissions granted to the role;

[0007] Check if the detection permission has expired;

[0008] When the validity period of a permission expires, the permission shall be revoked.

[0009] In one embodiment, before acquiring the time-limited permissions granted to the role, the method further includes:

[0010] For each task within multiple tasks of each role, configure the validity period of the permissions to the first value.

[0011] In one embodiment, the method further includes:

[0012] Once all of a character's task permissions have been revoked, the character's permissions will be revoked as well.

[0013] In one embodiment, before acquiring the time-limited permissions granted to the role, the method further includes:

[0014] Obtain the permission allocation request sent by the requesting party. The permission allocation request includes: the request task for the requesting role and the request period.

[0015] Based on the request deadline, the first value corresponding to the request task is modified to obtain the second value.

[0016] In one embodiment, after obtaining the time-limited permissions granted to the role, the method further includes:

[0017] When the second value is greater than zero, the validity period of the permission is within the specified range;

[0018] When the second value is zero, the permission is valid indefinitely.

[0019] In one embodiment, detecting whether the validity period of the permission has expired includes:

[0020] When the validity period of a permission is within a certain range, the system monitors in real time whether the permission has expired.

[0021] Secondly, this application also provides an access control device. The device includes:

[0022] The permission acquisition module is used to acquire permissions granted to a role that have an expiration period.

[0023] The expiration detection module is used to detect whether the validity period of the permission has expired;

[0024] The permission revoke module is used to revoke permissions when their validity period expires.

[0025] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method described in any of the above embodiments.

[0026] Fourthly, this application also provides a computer device readable storage medium. The computer device readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the method described in any of the above embodiments.

[0027] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the method described in any of the above embodiments.

[0028] The aforementioned permission management methods, devices, computer equipment, storage media, and computer program products first acquire the permissions granted to roles with expiration dates; then, they detect whether the permissions have expired; and finally, they revoke the permissions when their expiration dates have expired. By configuring and detecting the expiration dates of permissions granted by the requesting party, the automatic revoke of permissions is achieved accurately and efficiently. Attached Figure Description

[0029] Figure 1 This is an application environment diagram of the permission management method in one embodiment;

[0030] Figure 2 This is a flowchart illustrating a permission management method in one embodiment;

[0031] Figure 3 This is a flowchart illustrating the permission management method in another embodiment;

[0032] Figure 4 This is a structural block diagram of a permission management device in one embodiment;

[0033] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0035] The permission management method provided in this application can be applied to a single side of the server or the requesting end, or it can be applied to a system including both the requesting end and the server, and implemented through the interaction between the requesting end and the server.

[0036] The permission management method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, the requesting client 102 communicates with the server 104 via a network. A data storage system can store the data that the server 104 needs to process. The data storage system can be integrated onto the server 104, or it can be located in the cloud or on another network server. The server 104 communicates and interacts with the requesting client 102, thereby entering the permission management environment. The server 104 obtains the permissions with expiration dates granted to the role and authorizes these expired permissions to the requesting client 102. Furthermore, the server 104 checks whether the validity period of the permissions authorized to the requesting client 102 has expired. When the validity period of the permissions expires, the server 104 revokes the permissions authorized to the requesting client 102. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0037] In one embodiment, such as Figure 2 As shown, a permission management method is provided. Taking the application of this method to a system including a requester and a server as an example, the method includes the following steps 202 to 206.

[0038] Step 202: Obtain the permissions granted to the role that have an expiration date.

[0039] In this embodiment, a role can have multiple tasks, and each task has permissions. Obtaining time-limited permissions granted to a role can allow obtaining time-limited permissions granted to multiple tasks of that role.

[0040] In this embodiment, the server can simultaneously acquire permissions with expiration dates granted to multiple roles.

[0041] Step 204: Check if the permission has expired.

[0042] In this embodiment, the server can monitor the validity period of the permissions granted to the requesting party in real time and monitor whether the validity period of the permissions has expired.

[0043] Step 206: When the validity period of the permission expires, the permission is revoked.

[0044] In this embodiment, when the server detects that the validity period of the permission granted to the requesting party has expired, it automatically revoks the permission from the requesting party.

[0045] The above-described permission management method first obtains the permissions with expiration dates granted to the role; then checks whether the permissions have expired; and finally, revoks the permissions when they expire. By configuring and checking the expiration dates of permissions granted by the requesting party, the automatic revocation of permissions is achieved accurately and efficiently.

[0046] In one embodiment, before obtaining the time-limited permissions granted to the role, the method further includes configuring the time-limited period of the permissions to a first value for each of the multiple tasks of each of the multiple roles.

[0047] In this embodiment, the server can simultaneously configure the default validity period of permissions, i.e., the first value, for each task in multiple tasks of each role.

[0048] In this embodiment, the default validity period of permissions for each task in multiple tasks of each role can be the same or different.

[0049] In one embodiment, the method further includes: revoking the character's permissions after all the permissions for all tasks of the character have been revoked.

[0050] In this embodiment, the server can grant permissions for multiple tasks of a role to the requesting end at the same time. When permissions for at least one task of a role are granted to the requesting end, the role is in an authorized state on the requesting end.

[0051] In this embodiment, when the validity period of the permission for one task of a role expires, the server can automatically revoke the permission for that task of the role from the requesting end, while the permissions for other tasks of the role remain valid; when the validity period of the permissions granted to the requesting end for all tasks of the role expires, the permissions for the role are automatically revoked from the requesting end.

[0052] In one embodiment, before obtaining the time-limited permissions granted to the role, the method further includes: obtaining a permission allocation request sent by the requesting end, the permission allocation request including: the request task of the requesting role and the request period; and modifying a first value corresponding to the request task based on the request period to obtain a second value.

[0053] In this embodiment, before granting the role's task permissions to the requesting client, the server first obtains the permission allocation request sent by the requesting client, and then grants the role's task permissions to the requesting client based on the permission allocation request.

[0054] In this embodiment, the permission allocation request includes, but is not limited to, requesting tasks for a requesting role.

[0055] In this embodiment, when there is no request period in the permission allocation request, the server can query the first value of the request task of the request role based on the request task of the request role in the permission allocation request. The first value remains unchanged, that is, the second value is equal to the first value. The validity period of the permission of the request task of the request role is configured to be the second value. Then the validity period of the permission of the request task of the request role is still equal to the first value.

[0056] In this embodiment, when there is a request period in the permission allocation request, the server can modify the first value of the request task of the requesting role based on the request task and request period in the permission allocation request to obtain a second value, and configure the validity period of the permission of the request task of the requesting role to be the second value.

[0057] In this embodiment, the administrator can decide whether to approve or reject the request period in a permission allocation request through the server on the management terminal. For example, if a permission allocation request has a request period of 60 days, and the first value of the request task for the requesting role is 35 days, the administrator can choose to approve or reject the request period. When the administrator approves the request period, the server can grant the requesting party the permission for the requesting role's request task with a 60-day validity period; when the administrator rejects the request period, the validity period of the requesting role's request task permission is still equal to the first value, that is, the server will grant the requesting party the permission for the requesting role's request task with a 35-day validity period. Based on the first value and the request period in the permission allocation request, the server can modify the validity period of the permission, that is, even if the validity period of the permission is the first value, the validity period of the permission on the requesting party can be customized for different requesting parties. This solution separates the configuration of the first value from the requesting party. When the requesting party does not have a personalized validity period requirement, the validity period of the first value can be directly adopted, which can reduce the workload of permission management and improve the efficiency of permission management.

[0058] In one embodiment, after obtaining the permissions granted to the role with an expiration date, the method further includes: when the second value is greater than zero, the validity period of the permission is valid for a period of time; when the second value is equal to zero, the validity period of the permission is valid indefinitely.

[0059] In this embodiment, when the permission allocation request sent by the requesting party does not specify a time limit, or when the administrator rejects the requesting party's time limit request, the validity period of the permission is a first value. In this case, when the first value is greater than zero, the validity period of the permission is valid for a specified period; when the first value is equal to zero, the validity period of the permission is permanent.

[0060] In this embodiment, the server configures the validity period of the request role's request task permission of the requesting end to a second value. When the second value is greater than zero, that is, the validity period of the permission obtained by the requesting end is greater than zero, and there is an expiration time, which is valid in interval; when the second value is equal to zero, that is, the validity period of the permission obtained by the requesting end is permanent and will not expire.

[0061] In one embodiment, detecting whether the validity period of the permission has expired includes: when the validity period of the permission is within a valid range, monitoring in real time whether the validity period of the permission has expired.

[0062] In this embodiment, the server can first mark the expiration dates of permissions with different validity periods, and then add them to the permission revoke queue. Permissions are revoked based on the expiration date of the marked expiration. Permissions with the same expiration time can use the same marked expiration date. When the validity period corresponding to the marked expiration date expires, multiple permissions corresponding to that marked expiration can be revoked, improving the efficiency of permission revoke.

[0063] In this embodiment, the server can also send an expiration reminder to the requesting client when the permission's validity period is about to expire, inquiring whether the requesting client wants to initiate a renewal request. If the requesting client sends a renewal request, the expiration period can be reconfigured. It is understood that when the current validity period has not yet expired, the renewed validity period can be added to the current validity period, or it can be recalculated directly from the renewed validity period. For example, if the permission has 3 days remaining, and the requesting client requests a 30-day renewal, and the administrator approves the renewal request, if the renewed validity period is added to the current validity period, then on the requesting client, the task's permission will be 33 days; if it is recalculated directly from the renewed validity period, then on the requesting client, the task's permission will be 30 days. By sending expiration reminders to the requesting client, users can be promptly notified to determine whether to renew, thereby improving interaction efficiency and enhancing the user experience.

[0064] In another embodiment, when the validity period corresponding to the task's permissions is about to expire, the server can also send an expiration reminder to the role corresponding to the task, and the role can determine whether to send a renewal query. For example, the server can also configure an expiration period for the role's permissions, and after receiving the expiration reminder, the role can determine whether to send a renewal query based on the role's validity period.

[0065] In this embodiment, when the validity period corresponding to the role's permissions is about to expire, the server can also send an expiration reminder to the parent role corresponding to the role, and the parent role can determine whether to send a renewal query for the role's permissions, in order to ensure permission security and ease of use.

[0066] In this embodiment, when the validity period of the permission is permanent, the server does not check the permissions of the task for which the role is granted permanent validity.

[0067] In this embodiment, when the validity period of a permission is within a specified range, the server adds the valid permissions corresponding to the role's tasks within that range to a revocation queue. The server monitors these permissions in real time, and when the validity period of a role's task's permission expires, it automatically revoks the permissions corresponding to that task from the requesting end. Once all permissions for a role's tasks have been revoked, the server automatically revoks the role's permissions from the requesting end.

[0068] In this embodiment, when the permission for a task with a validity period expires, if the event executed by the task has not been completed, the execution progress of the event is saved on the requesting end, and the permission for the task is revoked. When the permission for the task is re-granted to the requesting end and used again to execute the same event, the previously incomplete execution progress can be read.

[0069] In another embodiment, when the permission for a task with a validity period expires, if the event executed by the task has not been completed, the execution progress of the event may not be saved, and the permission for the task may be revoked. When the permission for the task is re-authorized to the requesting party and used again to execute the same event, the event is re-executed.

[0070] In another embodiment, such as Figure 3 As shown, administrators can access the permission platform through the server and authorize permissions corresponding to the tasks of the requesting roles.

[0071] In this embodiment, the administrator can select the requesting party to be authorized by operating the permission platform, obtain the permission allocation request of the requesting party, and process the permission allocation request.

[0072] In this embodiment, after the administrator selects a request client to be processed, the server can configure a model for that request client. It is understood that the administrator can select multiple request clients to be processed, and the server can simultaneously process permission authorization for multiple selected request clients.

[0073] In this embodiment, as Figure 3 As shown, the models that the server can configure include, but are not limited to: ACL (Access Control List, a list of existing services and information that a device can access), RBAC (Role-Based Access Control), TBAC (Task-Based Access Control), etc.

[0074] In the RBAC model, the relationship between users (requesting parties) and roles, and between roles and permissions, is generally many-to-many. Based on the RBAC model, this approach introduces the concept of roles, using roles as a bridge between permissions and users. Permissions are first assigned to roles, and then roles are assigned to users, thus completing the process of granting permissions to users. In other words, under this model, a user can simultaneously hold multiple roles, and each role can simultaneously hold multiple permissions. The RBAC model, or "User-Role-Permission" authorization model, separates users from permissions, enhancing security while offering greater flexibility and simplification.

[0075] The core of the ACL model lies in the direct link between users and permissions (functional permissions, data permissions).

[0076] The TBAC model introduces the concept of tasks, which are task-centric, enabling dynamic authorization and enhancing security.

[0077] In this embodiment, the permission allocation request sent by the requesting end may include a request model, and the server can configure the model for the requesting end based on the request model. By configuring different models for different requesting ends and modifying the validity period of permissions based on the request period in the permission allocation requests of different requesting ends, the different needs of multiple requesting ends can be met, resulting in high reusability.

[0078] In this embodiment, the server can configure the RBAC model for the requesting end to configure the validity period of permissions.

[0079] The RBAC model follows the principle of least privilege, meaning that roles can be configured with the minimum set of permissions required to complete a task. The RBAC model also follows the principle of separation of responsibilities, which is reflected in the use of mutually exclusive roles to collaboratively complete sensitive tasks; for example, requiring an accountant and a financial administrator to participate in the same posting. Furthermore, the RBAC model follows the principle of data abstraction, which is reflected in the abstraction of permissions, such as using abstract permissions like loan and deposit for financial operations instead of the typical read, write, and execute permissions provided by the operating system.

[0080] In another embodiment, the server can assign an expiration date to the valid permissions within a given range when authorizing the requesting client, so as to enable expiration detection.

[0081] In this embodiment, as Figure 3 As shown, when the validity period of a permission is within a certain range, the server adds the permission to a revoke queue. Upon expiration, permissions are revoked based on the queue order. This ensures timely and complete permission revoke after expiration, without missing any expired permissions. This improves the efficiency of permission revoke.

[0082] In this embodiment, the application can support both permanently valid permission authorization and permission authorization and revocation within a specified period, increasing the flexibility of permission management. Furthermore, by distinguishing between permanently valid and period-valid permissions during the authorization process, and only performing real-time monitoring on period-valid permissions, the workload of permission management can be reduced.

[0083] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0084] Based on the same inventive concept, this application also provides a permission management device for implementing the permission management method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more permission management device embodiments provided below can be found in the limitations of the permission management method described above, and will not be repeated here.

[0085] In one embodiment, such as Figure 4 As shown, a permission management device is provided, including: a permission acquisition module 402, a time limit detection module 404, and a permission revocation module 406, wherein:

[0086] Permission acquisition module 402 is used to acquire permissions with expiration dates granted to a role;

[0087] The expiration detection module 404 is used to detect whether the validity period of the permission has expired.

[0088] The permission revokement module 406 is used to revoke permissions when their validity period expires.

[0089] In one embodiment, prior to the permission acquisition module 402, the above-mentioned apparatus may further include:

[0090] The first numerical configuration module is used to configure the validity period of permissions for each task in multiple tasks of each role, with the first numerical value as the limit.

[0091] In one embodiment, the above-described apparatus may further include:

[0092] The role recycling module is used to reclaim a role's permissions once all of a role's task permissions have been revoked.

[0093] In one embodiment, prior to the permission acquisition module 402, the above-mentioned apparatus may further include:

[0094] The request retrieval module is used to retrieve permission allocation requests sent by the requesting party. Permission allocation requests include: the request task for the requesting role and the request period.

[0095] The second value acquisition module is used to modify the first value corresponding to the request task based on the request deadline to obtain the second value.

[0096] In one embodiment, after the permission acquisition module 402, the above-mentioned apparatus may further include:

[0097] The interval validity module is used to ensure that the validity period of the permission is within the interval when the second value is greater than zero.

[0098] The "Permanently Valid" module is used to ensure that the permission is valid indefinitely when the second value is equal to zero.

[0099] In one embodiment, the period detection module 404 may include:

[0100] The interval validity period detection submodule is used to monitor in real time whether the validity period of a permission has expired when the validity period of the permission is within an interval.

[0101] Each module in the aforementioned access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0102] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores initial numerical data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a permission management method.

[0103] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0104] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: acquiring permissions with an expiration date granted to a role; detecting whether the expiration date of the permissions has expired; and revoking the permissions when the expiration date of the permissions has expired.

[0105] In one embodiment, the processor executing a computer program may further include, before acquiring a time-limited permission granted to a role, configuring the time-limited period of the permission to a first value for each of the multiple tasks of each of the multiple roles.

[0106] In one embodiment, when the processor executes a computer program to implement the above method, it may further include: revoking the permissions of the role after all the permissions of the role's tasks have been revoked.

[0107] In one embodiment, when the processor executes the computer program, before acquiring the time-limited permissions granted to the role, it may further include: acquiring a permission allocation request sent by the requesting end, the permission allocation request including: the request task of the requesting role and the request period; and modifying a first value corresponding to the request task based on the request period to obtain a second value.

[0108] In one embodiment, after the processor executes the computer program to obtain the permission granted to the role with a validity period, it may further include: when the second value is greater than zero, the validity period of the permission is valid for a period of time; when the second value is equal to zero, the validity period of the permission is valid indefinitely.

[0109] In one embodiment, when the processor executes a computer program, it can detect whether the validity period of the permission has expired. This can include: when the validity period of the permission is within a valid range, monitoring whether the validity period of the permission has expired in real time.

[0110] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, performs the following steps: acquiring a permission granted to a role with an expiration date; detecting whether the expiration date of the permission has expired; and revoking the permission when the expiration date of the permission has expired.

[0111] In one embodiment, when the computer program is executed by the processor, before acquiring the time-limited permissions granted to the role, it may further include: configuring the time-limited period of the permissions to a first value for each of the multiple tasks of each of the multiple roles.

[0112] In one embodiment, when the computer program is executed by the processor to implement the above method, it may further include: revoking the permissions of the role after all the permissions of the role's tasks have been revoked.

[0113] In one embodiment, when the computer program is executed by the processor, before acquiring the time-limited permissions granted to the role, it may further include: acquiring a permission allocation request sent by the requesting party, the permission allocation request including: the request task of the requesting role and the request period; and modifying a first value corresponding to the request task based on the request period to obtain a second value.

[0114] In one embodiment, after the computer program is executed by the processor to acquire the time-limited permission granted to the role, it may further include: when the second value is greater than zero, the time limit of the permission is valid for a period of time; when the second value is equal to zero, the time limit of the permission is valid indefinitely.

[0115] In one embodiment, when the computer program is executed by the processor, it detects whether the validity period of the permission has expired. This may include: when the validity period of the permission is within a valid range, monitoring whether the validity period of the permission has expired in real time.

[0116] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: acquiring permissions granted to a role with an expiration date; detecting whether the expiration date of the permissions has expired; and revoking the permissions when the expiration date of the permissions has expired.

[0117] In one embodiment, when the computer program is executed by the processor, before acquiring the time-limited permissions granted to the role, it may further include: configuring the time-limited period of the permissions to a first value for each of the multiple tasks of each of the multiple roles.

[0118] In one embodiment, when the computer program is executed by the processor to implement the above method, it may further include: revoking the permissions of the role after all the permissions of the role's tasks have been revoked.

[0119] In one embodiment, when the computer program is executed by the processor, before acquiring the time-limited permissions granted to the role, it may further include: acquiring a permission allocation request sent by the requesting party, the permission allocation request including: the request task of the requesting role and the request period; and modifying a first value corresponding to the request task based on the request period to obtain a second value.

[0120] In one embodiment, after the computer program is executed by the processor to acquire the time-limited permission granted to the role, it may further include: when the second value is greater than zero, the time limit of the permission is valid for a period of time; when the second value is equal to zero, the time limit of the permission is valid indefinitely.

[0121] In one embodiment, when the computer program is executed by the processor, it detects whether the validity period of the permission has expired. This may include: when the validity period of the permission is within a valid range, monitoring whether the validity period of the permission has expired in real time.

[0122] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0123] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0124] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A rights management method, characterized by, The method is applied to a server side, and the method comprises: configuring, by a role-based access control model, a validity period of a permission for each task in a plurality of tasks of each role in a plurality of roles as a first value; obtaining a permission allocation request sent by a request end, the permission allocation request comprising: a request task of a request role and a request deadline; modifying the first value corresponding to the request task based on the request deadline to obtain a second value; obtaining a permission with a validity period granted to a plurality of tasks of a role; when the second value is greater than zero, the validity period of the permission is interval validity; when the second value is equal to zero, the validity period of the permission is permanent validity; for the permission of each task, when the validity period of the permission is interval validity, monitoring whether the validity period of the permission expires in real time; when the validity period of the permission expires, the request end saves an event executed by a task corresponding to the permission which is not completed; adding the permission to a permission recycling queue, recycling the permission based on the order of the recycling queue; when the permission of the task is authorized to the request end again and is used to execute the same event again, the request end is used to read the event executed by the task corresponding to the permission which is not completed; when the permissions of all tasks of the role are recycled, recycling the permission of the role; the method further comprises: labeling the permissions with different validity periods with a deadline, and using the same deadline label for the permissions with the same expiration time; when the validity period corresponding to the deadline label expires, recycling the plurality of permissions corresponding to the deadline label based on the plurality of permissions; the method further comprises: sending an expiration reminder to a role corresponding to a task before the validity period of the permission of the task; after the role receives the expiration reminder, determining whether to send a renewal inquiry based on the validity period of the role; or sending an expiration reminder to a superior role of a role corresponding to a task before the validity period of the permission of the task; after the superior role receives the expiration reminder, determining whether to send a renewal inquiry based on the superior role.

2. The method of claim 1, wherein, The principle of the access control model of the role comprises at least one of a least privilege principle and a separation of duties principle.

3. The method of claim 2, wherein, The access control model comprises an existing service and information list model accessible to a device, a role-based access control model, or a task-based access control model.

4. The method of claim 1, wherein, When the validity period of the permission is permanent validity, the server does not detect the permission of the task of the role granted with the permanent validity.

5. A rights management apparatus characterized by comprising: The device comprises: a first value configuration module configured to configure, by a role-based access control model, a validity period of a permission for each task in a plurality of tasks of each role in a plurality of roles as a first value; a request obtaining module configured to obtain a permission allocation request sent by a request end, the permission allocation request comprising: a request task of a request role and a request deadline; a second value obtaining module configured to modify the first value corresponding to the request task based on the request deadline to obtain a second value; a permission obtaining module configured to obtain a permission with a validity period granted to a plurality of tasks of a role; when the second value is greater than zero, the validity period of the permission is interval validity; when the second value is equal to zero, the validity period of the permission is permanent validity; The period detection module is configured to, for each task permission, monitor whether the validity period of the permission expires in real time when the validity period of the permission is interval valid. The permission recovery module is configured to, when the validity period of the permission expires, request an end to save an event performed by an unfinished task corresponding to the permission, add the permission to a permission recovery queue, recover the permission based on the order of the recovery queue, and when the permission of the task is authorized to the end again and is used to perform the same event again, the end is configured to read the event performed by the unfinished task corresponding to the permission. The role recovery module is configured to, when the permissions of all tasks of the role are recovered, recover the permission of the role. The marking module is configured to mark the permissions with different validity periods, use the same validity period mark for the permissions with the same expiration time, and recover the permissions corresponding to the validity period mark based on the validity period mark when the validity period corresponding to the validity period mark expires. The reminding module is configured to send an expiration reminder to a role corresponding to a task before the validity period corresponding to a permission of the task, determine whether to send a renewal inquiry based on the validity period of the role after the role receives the expiration reminder, or send an expiration reminder to a superior role of the role corresponding to the task before the validity period corresponding to the permission of the task, and determine whether to send a renewal inquiry based on the superior role after the superior role receives the expiration reminder.

6. The apparatus of claim 5, wherein, The principle of the access control model of the role includes at least one of a least privilege principle and a responsibility separation principle.

7. The apparatus of claim 6, wherein The access control model includes an existing service and information list model accessible to a device, a role-based access control model, or a task-based access control model.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method of any one of claims 1 to 4.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 4.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 4.

Images