A method, device, equipment and medium for determining authority

Abstract

The present application discloses a permission determination method, apparatus, device and medium, which first obtains a permission request for a target permission for a target resource; obtains a target rule that matches the permission request through a first path or a second path; if the target rule can be obtained through the first path, the request result of the permission request is determined according to the target rule; if the target rule cannot be obtained through the first path, the target rule is obtained through the second path, and the request result of the permission request is determined according to the obtained target rule. Among them, the first path is a path that is faster to obtain the target rule. In this way, the request result can be quickly determined based on the first path, which improves the speed of determining the request result and the efficiency of the system resources for the user to obtain the request. Moreover, when the first path is unavailable, the request result is determined using the second path, which can ensure that the request result of the permission request is obtained.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, apparatus, device and medium for determining authority. Background Art

[0002] The permissions system is used to review permissions for requests to access system resources. When a user requests access to a system resource, a permissions review is performed based on the specific circumstances of the resource the user is requesting access to. If the permission is approved, the user is granted access to the system resource.

[0003] Currently, the permission system is slow in determining permission results, resulting in inefficient user access to system resources. Summary of the Invention

[0004] In view of this, the present application provides a permission determination method, apparatus, device and medium, which can improve the speed of the permission system in determining permission results.

[0005] To solve the above problems, the technical solutions provided by this application are as follows:

[0006] In a first aspect, an embodiment of the present application provides a method for determining authority, the method comprising:

[0007] Obtain the user's permission request for the target operation on the target resource;

[0008] Acquire a target rule matching the permission request through the first path or the second path;

[0009] In response to obtaining the target rule through the first path, determining a request result of the permission request according to the target rule; or,

[0010] In response to not obtaining the target rule through the first path, obtaining the target rule through the second path, and determining a request result of the permission request according to the target rule.

[0011] In a second aspect, an embodiment of the present application provides a permission determination device, the device comprising:

[0012] A first acquisition unit is used to obtain a user's permission request for a target operation on a target resource;

[0013] a second acquiring unit, configured to acquire a target rule matching the permission request through the first path or the second path;

[0014] A determination unit for, in response to obtaining the target rule through the first path, determining a request result of the permission request according to the target rule; or, in response to not obtaining the target rule through the first path, obtaining the target rule through the second path, and determining a request result of the permission request according to the target rule.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0016] one or more processors;

[0017] a storage device having one or more programs stored thereon,

[0018] When the one or more programs are executed by the one or more processors, the one or more processors implement the permission determination method as described in the first aspect.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the permission determination method as described in the first aspect is implemented.

[0020] It can be seen that this application has the following beneficial effects:

[0021] The present application provides a permission determination method, apparatus, device and medium, which first obtains a permission request for a target permission for a target resource; obtains a target rule that matches the permission request through a first path or a second path; if the target rule can be obtained through the first path, the request result of the permission request is determined according to the target rule; if the target rule cannot be obtained through the first path, the target rule is obtained through the second path, and the request result of the permission request is determined according to the obtained target rule. Among them, the first path is a path that is faster to obtain the target rule. In this way, the request result can be quickly determined based on the first path, which improves the speed of determining the request result and the efficiency of the system resources for the user to obtain the request. Moreover, when the first path is unavailable, the request result is determined using the second path, which can ensure that the request result of the permission request is obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0023] Figure 1 A schematic diagram of a framework of an exemplary application scenario provided in an embodiment of the present application;

[0024] Figure 2 A flowchart of a method for determining authority provided in an embodiment of the present application;

[0025] Figure 3 A flowchart of a method for determining permissions provided in an embodiment of the present application;

[0026] Figure 4 A flowchart of a method for determining permissions provided in an embodiment of the present application;

[0027] Figure 5 A schematic diagram of the structure of a permission determination device provided in an embodiment of the present application;

[0028] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to facilitate understanding and explanation of the technical solutions provided by the embodiments of the present application, the background technology of the present application will be described below.

[0030] The resource system includes a permissions system for determining a user's permission to access system resources. The permissions system can determine whether a user has permission based on the user's permission request for a target operation on the target resource. Currently, the permissions system can use an attribute-based access control (ABAC) permission calculation model to determine permissions. The ABAC permission calculation model can obtain corresponding rules for determining whether permission is granted based on the requesting user, the requested target resource, and the requested target operation. Based on the determined rules, a computing resource that uses the rules to determine permission is obtained. Based on the obtained computing resource and the determined rules, it can be determined whether the user has the permission request for the target operation on the target resource, that is, the request result. The resource system can determine whether the user has permission based on the request result obtained by the permissions system. However, the current permission system's rule determination process is relatively cumbersome, resulting in a slow request result, which affects the efficiency of users in obtaining target resources.

[0031] Based on this, the embodiments of the present application provide a permission determination method, apparatus, device and medium, which first obtains a permission request for a target permission for a target resource; obtains a target rule that matches the permission request through a first path or a second path; if the target rule can be obtained through the first path, the request result of the permission request is determined according to the target rule; if the target rule cannot be obtained through the first path, the target rule is obtained through the second path, and the request result of the permission request is determined according to the obtained target rule. Among them, the first path is a path that is faster to obtain the target rule. In this way, the request result can be quickly determined based on the first path, which improves the speed of determining the request result and the efficiency of the system resources for the user to obtain the request. Moreover, when the first path is unavailable, the request result is determined using the second path, which can ensure that the request result of the permission request is obtained.

[0032] In order to facilitate understanding of a method for determining authority provided in an embodiment of the present application, Figure 1 See the example scenario shown. Figure 1 As shown in the figure, this figure is a framework diagram of an exemplary application scenario provided in an embodiment of the present application.

[0033] In some embodiments, the permission system can determine the request result of the permission request based on the user's permission request for the target operation of the target resource. The permission system stores the result resources that match the permission request in the target storage space in advance. When the user needs to perform the target operation on the target resource, he first triggers the generation of a permission request for the target operation of the target resource. After obtaining the permission request, the permission system obtains the target rule that matches the permission request through the first path or the second path. Among them, the first path is the path for obtaining the target rule through the target storage space. The second path is the path for obtaining the target rule through the rule library. First obtain the target rule through the first path. If the target rule can be obtained from the first path, the request result of the permission request is determined according to the target rule. If the target rule cannot be obtained from the first path, the target rule is obtained through the second path, and the request result of the permission request is determined according to the target rule.

[0034] Those skilled in the art will understand that Figure 1 The framework diagram shown is only an example in which the embodiments of the present application can be implemented. The scope of application of the embodiments of the present application is not limited by any aspect of the framework.

[0035] To facilitate understanding of the technical solution provided by the embodiment of the present application, a permission determination method provided by the embodiment of the present application is described below with reference to the accompanying drawings.

[0036] First of all, it should be noted that the permission determination method provided in the embodiment of the present application can be applied to a permission system for determining permissions.

[0037] See also Figure 2 As shown in FIG, this figure is a flow chart of a method for determining authority provided in an embodiment of the present application, as shown in FIG. Figure 2 As shown, the method may include S201-S203:

[0038] S201: Obtaining a user's permission request for a target operation on a target resource.

[0039] In some implementations, before a user performs a target operation on a target resource, it is necessary to determine in advance whether the user has the authority to perform the target operation on the target resource.

[0040] The embodiments of the present application do not limit the specific implementation method for users to generate permission requests. In one possible implementation method, the user can automatically trigger the permission request by triggering the target operation on the target resource. In another possible implementation method, the user can pre-generate a permission request for the target operation on the target resource to confirm whether they have the permission to perform the target operation on the target resource.

[0041] In some implementations, before user A needs to read document A, a permission request for user A to read document A can be generated, wherein document A is the target resource and reading is the target operation.

[0042] S202: Acquire a target rule matching the permission request through the first path or the second path.

[0043] The first path and the second path are different paths for obtaining a target rule that matches the permission request. The first path and the second path obtain the target rule at different speeds. In some possible implementations, the speed of obtaining the target rule through the first path is faster than the speed of obtaining the target rule through the second path.

[0044] In some embodiments, obtaining the target rule through the first path is to obtain the cached target rule from the target storage space, and obtaining the target rule through the second path is to obtain the target rule from the rule base. The target storage space is used to store the matching relationship between the permission request and the rule. In one possible implementation, the matching relationship between the permission request and the rule determined historically can be stored in the target storage space. In another possible implementation, the matching relationship between the permission request and the rule is determined in advance, and the permission request and the rule are stored in the target storage space. Among them, the target storage space can be a predetermined cache space. The speed of obtaining the target rule that matches the permission request through the first path, that is, from the target storage space is faster, which can improve the speed of obtaining the target rule.

[0045] In some embodiments, the target rule is a rule used to determine the request result of the permission request. The embodiments of the present application do not limit the specific implementation method of obtaining the target rule. As an example, the target rule is obtained based on the permission information included in the permission request. It should be noted that the target rule can include one or more rules. The number of rules included in the target rule can be determined based on the amount of permission information included in the permission request.

[0046] In some implementations, taking the aforementioned permission request from user A for reading document A as an example, the permission request includes three permission information items: user A, document A, and reading. In the target storage space, corresponding rules can be queried based on user A, document A, and reading, respectively, to obtain the rules for determining user A's permission and the rules for determining the permission for reading document A.

[0047] S203: In response to obtaining the target rule through the first path, determining the request result of the permission request according to the target rule; or, in response to not obtaining the target rule through the first path, obtaining the target rule through the second path, and determining the request result of the permission request according to the target rule.

[0048] In some implementations, if the target rule can be obtained through the first path, the obtained target rule can be used to determine the request result of the permission request.

[0049] The embodiments of the present application do not limit the specific implementation method of using target rules to determine the request result of a permission request. In one possible implementation method, the request result of a permission request is determined using the target rules and the permission information included in the permission request. In another possible implementation method, the computing resources can be first determined using the target rules, and then the request result is determined using the computing resources and the target rules. The embodiments of the present application provide a specific implementation method of using target rules to first determine the computing resources, and then using the computing resources and the target rules to determine the request result. Please see below for details.

[0050] In some implementations, if the target rule cannot be obtained from the first path, the target rule is obtained through the second path, and the target rule is then used to determine the result of the permission request.

[0051] The embodiments of the present application do not limit the specific implementation method of using target rules to determine the request result of a permission request. In one possible implementation method, the request result of a permission request is determined using the target rules and the permission information included in the permission request. In another possible implementation method, the computing resources can be first determined using the target rules, and then the request result is determined using the computing resources and the target rules. The embodiments of the present application provide a specific implementation method of using target rules to first determine the computing resources, and then using the computing resources and the target rules to determine the request result. Please see below for details.

[0052] In some embodiments, based on the relevant content of S201-S203 above, it can be seen that the first path can quickly obtain the target rule that matches the permission request, thereby improving the speed of determining the request result of the permission request. If the target rule cannot be obtained through the first path, the second path can obtain the target rule, ensuring that the request result of the permission request is determined based on the target rule.

[0053] In some implementations, an embodiment of the present application provides a specific implementation method for determining the request result of the permission request according to the target rule, which specifically includes the following two steps.

[0054] Obtaining computing resources for the target rule;

[0055] The computing resource and the target rule are used to determine a request result of the permission request.

[0056] Computing resources are resources used to determine request results based on target rules. Computing resources can be provided by the permission system from downstream systems. Downstream systems can be, for example, business systems or management systems. It should be noted that the embodiments of this application do not limit the source of target rules. Target rules can be obtained through the first path or the second path.

[0057] In some embodiments, see Figure 3 As shown, this figure is a schematic diagram of a permission determination method provided by an embodiment of the present application. After obtaining the user's permission request for the target operation of the target resource, first obtain the target rule that matches the permission request through the first path. If the target rule can be obtained through the first path, the computing resources of the target rule are obtained, and the request result of the permission request is determined using the computing resources and the target rule. If the target rule cannot be obtained through the first path, the target rule that matches the permission request is obtained from the second path. Obtain the computing resources of the target rule. Determine the request result of the permission request using the computing resources and the target rule.

[0058] In some implementations, using the aforementioned permission request from user A for reading document A as an example, the target rules include rules for determining user A's permissions and rules for determining permission to read document A. For example, the rule for determining user A's permissions stipulates that user A's identity must meet a preset identity requirement to be granted permission. User A's identity information is obtained from the user management system as a computing resource. The rule for determining permission to read document A stipulates that the reading operation can only be performed if document A is of a specific type. The document type of document A is obtained from the document management system as a computing resource.

[0059] In some embodiments, the computing resources of the target rule include one or more of subject resources, object resources, operation resources, and environmental resources. Subject resources are resources related to the subject that triggers the permission request. Object resources are resources related to the target resource. Operation resources are resources related to the target operation. Environmental resources are resources related to the environment in which the permission request is triggered. Environmental resources include, for example, time and location resources.

[0060] In some embodiments, after obtaining computing resources, the request result of the permission request can be calculated based on the computing resources and the target rules. Specifically, the computing resources can be used to determine whether the permission request complies with the target rules. If it is determined based on the computing resources that the permission request complies with the target rules, the request result of the permission request is determined to be permissioned. If it is determined based on the computing resources that the permission request does not comply with the target rules, the request result of the permission request is determined to be not permissioned. In one possible implementation, the ABAC permission calculation model can be used to calculate the request result of the permission request using computing resources and target rules.

[0061] In some embodiments, obtaining the target rule through the first path is to obtain the cached target rule from the target storage space. The target storage space may store multiple candidate rules that match the permission request. After obtaining multiple candidate rules that match the permission request in the target storage space, the target rule is determined from the candidate rules, and then the request result is determined based on the target rule. In one possible implementation, the speed of calculating the request result of the candidate rules is different, and the target rule can be determined based on the calculation speed of the candidate rules. The candidate rule whose calculation speed is greater than the threshold is determined as the target rule.

[0062] In some embodiments, candidate rules matching the permission request stored in the target storage space may have different computation speeds. A candidate rule whose computation speed exceeds a threshold is determined as the target rule. The threshold may be a pre-set computation speed threshold. The threshold may also be determined based on the computation speeds of the candidate rules. For example, the threshold may be set based on the maximum computation speed among the candidate rules.

[0063] In some implementations, by using candidate rules with a calculation speed greater than a threshold as target rules, the request result of the permission request can be determined based on the target rule with a faster calculation speed, further improving the efficiency of determining the request result of the permission request.

[0064] In some embodiments, in another possible implementation, the candidate rules have priorities, and the candidate rules whose priorities are greater than a priority threshold are used as target rules.

[0065] In some embodiments, the candidate rules matching the permission request stored in the target storage space may have different priorities. The priority of the candidate rules may be predetermined. For example, the priority of the candidate rules is determined based on the time when the candidate rules were established. The priority of the candidate rules with a later establishment time is higher, and the priority of the candidate rules with an earlier establishment time is lower. For another example, the priority of the candidate rules is determined based on the calculation speed of the candidate rules. The priority of the candidate rules with a faster calculation speed is higher, and the priority of the candidate rules with a slower calculation speed is lower.

[0066] In some embodiments, a candidate rule having a priority greater than a priority threshold is determined as a target rule. The priority threshold may be pre-set. The priority threshold may also be determined based on the priorities of the candidate rules. For example, the priority threshold may be set based on the highest priority among the candidate rules.

[0067] In some implementations, based on the above content, it can be seen that determining a target rule from candidate rules based on calculation speed or priority can more flexibly determine a target rule that meets the needs of determining a request result.

[0068] In some embodiments, after obtaining the request result of the permission request, the request result of the permission request can also be stored to facilitate subsequent direct search for the request result of the permission request. As an example, the request result of the determined permission request can be stored in the target storage space. The target storage space is used to store the request result of the permission request. The embodiment of the present application does not limit the specific implementation method of storing the request result of the permission request in the target storage space. As an example, the permission request and the request result of the permission request can be stored in the form of a key-value pair.

[0069] In some implementations, the request result of the permission request is stored in the target storage space. After a subsequent permission request is obtained, the request result of the newly obtained permission request can be determined based on the request result stored in the target storage space, thereby facilitating rapid determination of the request result of the permission request.

[0070] In some embodiments, computing resources are obtained from a downstream system connected to the authorization system. When the downstream system is unavailable, the authorization system cannot obtain computing resources and thus cannot calculate the requested result.

[0071] In some implementations, in order to solve the above problem, in one possible implementation, an embodiment of the present application provides a method for determining permissions, which, in addition to the above steps, further includes the following steps:

[0072] In some implementations, in response to determining that the downstream system is unavailable, historical results of the permission request are obtained in the target storage space, and the historical results are used as the request results of the permission request.

[0073] The embodiments of the present application do not limit the specific implementation method for determining that the downstream system is unavailable. In one possible implementation, if the computing resources provided by the downstream system cannot be obtained within a preset time period, the downstream system is determined to be unavailable. In another possible implementation, if a disconnection with the downstream system is detected, the downstream system is determined to be unavailable. In yet another possible implementation, if fault information sent by the downstream system is obtained, the downstream system is determined to be unavailable.

[0074] In some implementations, after determining that the downstream system is unavailable, historical results of permission requests are obtained in the target storage space. The historical results of permission requests are previously determined request results of permission requests.

[0075] In some implementations, the historical results of the permission request obtained are used as the request results of the current permission request. The embodiments of the present application do not limit the specific implementation method of obtaining the historical results of the permission request in the target storage space. As an example, the historical results can be obtained using the permission information included in the permission request.

[0076] In some embodiments, see Figure 4 As shown, this figure is a flow chart of a permission determination method provided by an embodiment of the present application. After obtaining the user's permission request for the target operation of the target resource, the target rule that matches the permission request is first obtained through the first path. If the target rule can be obtained through the first path, the computing resources of the target rule are obtained from the downstream system. If the downstream system is available and the computing resources of the target rule can be obtained, the request result of the permission request is determined using the computing resources and the target rule. If the downstream system is unavailable, the historical results of the permission request can be obtained in the target storage space, and the historical results are used as the request result of this permission request. If the target rule cannot be obtained through the first path, the target rule that matches the permission request is obtained from the second path. Obtain the computing resources of the target rule. If the downstream system is available and the computing resources can be obtained, the request result of the permission request is determined using the computing resources and the target rule. If the downstream system is unavailable, the historical results of the permission request can be obtained in the target storage space, and the historical results are used as the request result of this permission request.

[0077] In some implementations, the availability of each downstream system can be obtained, and the availability of the authority system can be calculated using the availability of the downstream system.

[0078] In some implementations, as an example, the product of the availability of each downstream system is calculated to obtain the availability of the authority system.

[0079] For example, the availability of downstream system i is obtained, where the value range of i is a positive integer less than or equal to n, and n is the number of downstream systems. The availability of the permission system can be calculated using formula (1).

[0080]

[0081] For example, if the permission system is connected to three downstream systems and the availability of each downstream system is 99.9%, the availability of the permission system calculated according to formula (1) is 0.970299.

[0082] In some embodiments, as another example, based on calculating the product of the availability of each downstream system, the product of the availability of each downstream system can be multiplied by the availability of the permission system itself to obtain the overall availability of the permission system.

[0083] Based on the permission determination method provided in the above method embodiment, the embodiment of the present application further provides a permission determination device, which will be described below with reference to the accompanying drawings.

[0084] See also Figure 5 As shown in FIG, this figure is a schematic diagram of the structure of a permission determination device provided in an embodiment of the present application. As shown in the figure, the permission determination device includes:

[0085] The first acquisition unit 501 is used to obtain the user's permission request for the target operation on the target resource;

[0086] A second acquiring unit 502 is configured to acquire a target rule matching the permission request through the first path or the second path;

[0087] A determination unit 503 is configured to, in response to obtaining the target rule through the first path, determine the request result of the permission request according to the target rule; or, in response to not obtaining the target rule through the first path, obtain the target rule through the second path, and determine the request result of the permission request according to the target rule.

[0088] In a possible implementation, the determining unit 503 is configured to determine the request result of the permission request according to the target rule, including:

[0089] The determining unit 503 is configured to obtain the computing resources of the target rule; and determine a request result of the permission request using the computing resources and the target rule.

[0090] In a possible implementation, acquiring the target rule through the first path is acquiring the cached target rule from a target storage space, and acquiring the target rule through the second path is acquiring the target rule from a rule library.

[0091] In a possible implementation, the target storage space stores a plurality of candidate rules that match the permission request, and the target rule is a candidate rule whose calculation speed is greater than a speed threshold.

[0092] In a possible implementation, the target storage space stores a plurality of candidate rules that match the permission request, and the target rule is a candidate rule having a priority greater than a priority threshold.

[0093] In a possible implementation, the apparatus further includes:

[0094] The storage unit is configured to store the result of the permission request in the target storage space.

[0095] In a possible implementation, the permission request and the request result are stored in the target storage space in the form of a key-value pair.

[0096] In a possible implementation, the computing resource is obtained from a downstream system, and the apparatus further includes:

[0097] A third acquiring unit is configured to acquire, in response to the downstream system being unavailable, a historical result of the permission request in the target storage space, and use the historical result as a request result of the permission request.

[0098] In a possible implementation, the device is applied to an authority system, and the availability of the authority system is the product of the availability of the downstream system.

[0099] Based on the permission determination method provided by the above method embodiment, the present application also provides an electronic device, including: one or more processors; a storage device having one or more programs stored thereon, and when the one or more programs are executed by the one or more processors, the one or more processors implement the permission determination method described in any of the above embodiments. Figure 6, which shows a schematic structural diagram of an electronic device 600 suitable for implementing an embodiment of the present application. The terminal device in the embodiment of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (portable Android devices), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs (televisions) and desktop computers. Figure 6 The electronic device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0100] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 606 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0101] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 606 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0102] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 606, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present application are performed.

[0103] The electronic device provided in the embodiment of the present application and the permission determination method provided in the above embodiment belong to the same inventive concept. For technical details not fully described in this embodiment, please refer to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0104] Based on the permission determination method provided in the above method embodiment, an embodiment of the present application provides a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the permission determination method as described in any of the above embodiments is implemented.

[0105] It should be noted that the computer-readable medium mentioned above in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0106] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (Hypertext Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0107] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0108] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the authority determination method.

[0109] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including, but not limited to, object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0110] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0111] The units involved in the embodiments described in this application may be implemented by software or hardware. In some cases, the name of a unit / module does not constitute a limitation of the unit itself. For example, a voice data acquisition module may also be described as a "data acquisition module."

[0112] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0113] In the context of the present application, a machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0114] According to one or more embodiments of the present application, [Example 1] provides a method for determining permissions, the method comprising:

[0115] Obtain the user's permission request for the target operation on the target resource;

[0116] Acquire a target rule matching the permission request through the first path or the second path;

[0117] In response to obtaining the target rule through the first path, determining a request result of the permission request according to the target rule; or,

[0118] In response to not obtaining the target rule through the first path, obtaining the target rule through the second path, and determining a request result of the permission request according to the target rule.

[0119] According to one or more embodiments of the present application, [Example 2] provides a method for determining permissions, wherein determining the request result of the permission request according to the target rule includes:

[0120] Obtaining computing resources for the target rule;

[0121] The computing resource and the target rule are used to determine a request result of the permission request.

[0122] According to one or more embodiments of the present application, [Example Three] provides a permission determination method, wherein obtaining the target rule through the first path is to obtain the cached target rule from the target storage space, and obtaining the target rule through the second path is to obtain the target rule from a rule library.

[0123] According to one or more embodiments of the present application, [Example 4] provides a permission determination method, wherein the target storage space stores multiple candidate rules that match the permission request, and the target rule is a candidate rule whose calculation speed is greater than a speed threshold.

[0124] According to one or more embodiments of the present application, [Example 5] provides a permission determination method, wherein the target storage space stores multiple candidate rules that match the permission request, and the target rule is a candidate rule whose priority is greater than a priority threshold.

[0125] According to one or more embodiments of the present application, [Example 6] provides a method for determining permissions, the method further comprising:

[0126] The request result of the permission request is stored in the target storage space.

[0127] According to one or more embodiments of the present application, [Example 7] provides a permission determination method, wherein the permission request and the request result are stored in the target storage space in the form of a key-value pair.

[0128] According to one or more embodiments of the present application, [Example 8] provides a method for determining permissions, wherein the computing resources are obtained from a downstream system, and the method further includes:

[0129] In response to determining that the downstream system is unavailable, a historical result of the permission request is obtained from the target storage space, and the historical result is used as a request result of the permission request.

[0130] According to one or more embodiments of the present application, [Example 9] provides a method for determining authority, which is applied to an authority system, where the availability of the authority system is the product of the availability of the downstream system.

[0131] According to one or more embodiments of the present application, [Example 10] provides a permission determination device, the device including:

[0132] A first acquisition unit is used to obtain a user's permission request for a target operation on a target resource;

[0133] a second acquiring unit, configured to acquire a target rule matching the permission request through the first path or the second path;

[0134] A determination unit for, in response to obtaining the target rule through the first path, determining a request result of the permission request according to the target rule; or, in response to not obtaining the target rule through the first path, obtaining the target rule through the second path, and determining a request result of the permission request according to the target rule.

[0135] According to one or more embodiments of the present application, [Example 11] provides a permission determination device, wherein the determination unit is configured to determine a request result of the permission request according to the target rule, including:

[0136] The determining unit is configured to obtain the computing resources of the target rule; and determine a request result of the permission request using the computing resources and the target rule.

[0137] According to one or more embodiments of the present application, [Example 12] provides a permission determination device, wherein obtaining the target rule through the first path is obtaining the cached target rule from the target storage space, and obtaining the target rule through the second path is obtaining the target rule from a rule library.

[0138] According to one or more embodiments of the present application, [Example 13] provides a permission determination device, wherein the target storage space stores multiple candidate rules that match the permission request, and the target rule is a candidate rule whose calculation speed is greater than a speed threshold.

[0139] According to one or more embodiments of the present application, [Example 14] provides a permission determination device, wherein the target storage space stores multiple candidate rules that match the permission request, and the target rule is a candidate rule whose priority is greater than a priority threshold.

[0140] According to one or more embodiments of the present application, [Example 15] provides a permission determination device, the device further comprising:

[0141] The storage unit is configured to store the result of the permission request in the target storage space.

[0142] According to one or more embodiments of the present application, [Example 16] provides a permission determination device, wherein the permission request and the request result are stored in the target storage space in the form of a key-value pair.

[0143] According to one or more embodiments of the present application, [Example 17] provides a permission determination device, wherein the computing resources are obtained from a downstream system, and the device further includes:

[0144] A third acquiring unit is configured to acquire, in response to the downstream system being unavailable, a historical result of the permission request in the target storage space, and use the historical result as a request result of the permission request.

[0145] According to one or more embodiments of the present application, [Example 18] provides a permission determination device, which is applied to a permission system, and the availability of the permission system is the product of the availability of the downstream system.

[0146] According to one or more embodiments of the present application, [Example 19] provides an electronic device, including:

[0147] one or more processors;

[0148] a storage device having one or more programs stored thereon,

[0149] When the one or more programs are executed by the one or more processors, the one or more processors implement the permission determination method as described in any one of [Example 1] to [Example 9].

[0150] According to one or more embodiments of the present application, [Example 20] provides a computer-readable medium on which a computer program is stored, wherein when the program is executed by a processor, the permission determination method as described in any one of [Example 1] to [Example 9] is implemented.

[0151] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems or devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0152] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0153] It should also be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0154] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0155] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for determining authority, characterized in that: The method comprises: Obtain the user's permission request for the target operation on the target resource; Acquire a target rule matching the permission request through the first path or the second path, wherein the target rule is acquired through the first path faster than the target rule is acquired through the second path, the target rule comprising at least one rule determined for a permission corresponding to at least one of the user, the target resource, and the target operation; In response to obtaining the target rule through the first path, obtaining the computing resources of the target rule, and determining the request result of the permission request using the computing resources and the target rule, the computing resources of the target rule include one or more of subject resources, object resources, operation resources, and environment resources, the subject resources are resources related to the user, the object resources are resources related to the target resources, the operation resources are resources related to the target operation, and the environment resources are resources related to the environment in which the permission request is triggered; or In response to not obtaining the target rule through the first path, obtaining the target rule through the second path, obtaining the computing resource of the target rule, and determining a request result of the permission request using the computing resource and the target rule, where the request result indicates whether the user has permission to perform the target operation on the target resource; The computing resources are obtained from a downstream system, and the method further includes: In response to determining that the downstream system is unavailable, a historical result of the permission request is obtained from the target storage space, and the historical result is used as a request result of the permission request.

2. The method according to claim 1, characterized in that The acquiring of the target rule through the first path is to acquire the cached target rule from a target storage space, and the acquiring of the target rule through the second path is to acquire the target rule from a rule library.

3. The method according to claim 2, characterized in that The target storage space stores a plurality of candidate rules that match the permission request, and the target rule is a candidate rule whose calculation speed is greater than a speed threshold.

4. The method according to claim 2, characterized in that The target storage space stores a plurality of candidate rules that match the permission request, and the target rule is a candidate rule whose priority is greater than a priority threshold.

5. The method according to any one of claims 2 to 4, characterized in that: The method further comprises: The request result of the permission request is stored in the target storage space.

6. The method according to claim 5, characterized in that The permission request and the request result are stored in the target storage space in the form of key-value pairs.

7. The method according to claim 1, characterized in that The method is applied to an authorization system, wherein the availability of the authorization system is the product of the availability of the authorization system and the availability of the downstream system.

8. A permission determination device, characterized in that: The device comprises: A first obtaining unit is used to obtain a user's permission request for a target operation on a target resource; a second acquiring unit, configured to acquire a target rule matching the permission request through the first path or the second path, wherein a speed of acquiring the target rule through the first path is faster than a speed of acquiring the target rule through the second path, the target rule comprising at least one rule determined for a permission corresponding to at least one of the user, the target resource, and the target operation; a determining unit, configured to, in response to obtaining the target rule through the first path, obtain the computing resources of the target rule; determine the request result of the permission request using the computing resources and the target rule; or, in response to not obtaining the target rule through the first path, obtain the target rule through the second path and obtain the computing resources of the target rule; determine the request result of the permission request using the computing resources and the target rule, wherein the computing resources of the target rule include one or more of subject resources, object resources, operation resources, and environment resources, wherein the subject resources are resources related to the user, the object resources are resources related to the target resources, the operation resources are resources related to the target operation, and the environment resources are resources related to the environment in which the permission request is triggered, and the request result is used to indicate whether the user has the permission to perform the target operation on the target resource; The computing resources are obtained from a downstream system, and the apparatus further comprises: A third acquiring unit is configured to acquire, in response to the downstream system being unavailable, a historical result of the permission request in a target storage space, and use the historical result as a request result of the permission request.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the permission determination method according to any one of claims 1 to 7.

10. A computer-readable medium, characterized in that A computer program is stored thereon, wherein when the program is executed by a processor, the permission determination method according to any one of claims 1 to 7 is implemented.

Images