Information access control method and device, computer device and medium

Abstract

The application discloses a kind of information access control method, device, equipment and storage medium, comprising: when receiving the information access request sent by client user, the uniform resource identifier included in information access request is obtained, and the identity information of client user is obtained, based on the preset authority mapping relationship, the authority of access uniform resource identifier is determined, as the first access authority, based on identity information, the user group to which client user belongs is determined, as target user group, and the authority of target user group is obtained, as the second access authority, based on space search algorithm, whether the second access authority includes the first access authority is judged, to obtain the result of judgment, if the result of judgment is that the second access authority includes the first access authority, then redirect to uniform resource identifier, if the result of judgment is that the second access authority does not include the first access authority, then refuse to access the uniform resource identifier, the control efficiency of information access is improved using the present application.

Description

Technical Field

[0001] This invention relates to the field of data processing, and more particularly to a method, apparatus, computer equipment, and medium for controlling information access. Background Technology

[0002] With the rapid development of computer technology, more and more transactions are being processed through the network, and accessing the Internet to obtain information has become a common occurrence in daily life. Some large enterprises often have multiple different businesses, and different user groups have different permissions for different content.

[0003] To control user permissions, the current approach is mainly to set different display pages for different users. However, when there are many user groups, this approach requires generating multiple display pages, which makes data access management quite complex. Summary of the Invention

[0004] This invention provides a method, apparatus, computer device, and storage medium for controlling information access, in order to improve the efficiency of information access control.

[0005] To address the aforementioned technical problems, embodiments of this application provide a method for controlling information access, comprising:

[0006] Upon receiving an information access request from a client user, the system retrieves the Uniform Resource Identifier (URI) contained in the information access request and obtains the client user's identity information.

[0007] Based on a preset permission mapping relationship, the permission to access the Uniform Resource Identifier is determined as the first access permission;

[0008] Based on the identity information, the user group to which the client user belongs is determined as the target user group, and the permissions of the target user group are obtained as the second access permission;

[0009] Based on a spatial search algorithm, it is determined whether the second access permission includes the first access permission, and the determination result is obtained.

[0010] If the determination result is that the second access permission includes the first access permission, then redirect to the Uniform Resource Identifier; if the determination result is that the second access permission does not include the first access permission, then deny access to the Uniform Resource Identifier.

[0011] Optionally, before determining the permission to access the Uniform Resource Identifier based on a preset permission mapping relationship as the first access permission, the method further includes:

[0012] Generate a permission node tree based on all permissions;

[0013] Each basic Uniform Resource Identifier in the access page for information;

[0014] Based on the permission node tree, the preset permission mapping relationship for each Uniform Resource Identifier is generated.

[0015] Optionally, the first access permission includes at least one permission information.

[0016] Optionally, the determination of whether the second access permission includes the first access permission based on the spatial search algorithm, and the determination result includes:

[0017] Based on the R-tree approach, a spatial index for the second access permission is generated;

[0018] Obtain each permission node in the first access permission as the target node;

[0019] Each target node is queried sequentially in the spatial index of the second access permission. If the query result is successful each time, the judgment result is determined to be that the second access permission includes the first access permission; otherwise, the judgment result is determined to be that the second access permission does not include the first access permission.

[0020] Optionally, before obtaining the client user's identity information and the Uniform Resource Identifier (URL) included in the information access request upon receiving the information access request from the client user, the information access control method further includes:

[0021] Receive the login request from the client user and obtain the user's identity information from the login request;

[0022] Based on the user identity information, an access node is assigned to the client user to obtain the target access node;

[0023] Based on the target access node, the information access requests of the client user are controlled.

[0024] To address the aforementioned technical problems, embodiments of this application also provide an information access control device, comprising:

[0025] The access request receiving module is used to obtain the Uniform Resource Identifier contained in the information access request and obtain the identity information of the client user when it receives the information access request sent by the client user.

[0026] The first permission determination module is used to determine the permission to access the Uniform Resource Identifier based on a preset permission mapping relationship, as the first access permission;

[0027] The first permission determination module is used to determine the user group to which the client user belongs, based on the identity information, as the target user group, and to obtain the permissions of the target user group, as the second access permission;

[0028] The permission determination module is used to determine, based on a spatial search algorithm, whether the second access permission includes the first access permission, and to obtain the determination result.

[0029] The access control module is configured to redirect access to the Uniform Resource Identifier if the determination result indicates that the second access permission includes the first access permission, and to deny access to the Uniform Resource Identifier if the determination result indicates that the second access permission does not include the first access permission.

[0030] Optionally, the device further includes:

[0031] The node tree generation module is used to generate a permission node tree based on all permissions.

[0032] The Uniform Resource Identifier (URI) acquisition module is used to obtain each basic URI identifier in the information access page;

[0033] The mapping relationship generation module is used to generate the preset permission mapping relationship for each of the Uniform Resource Identifiers based on the permission node tree.

[0034] Optionally, the permission determination module includes:

[0035] The index generation unit is used to generate a spatial index for the second access permission based on an R-tree approach.

[0036] The target node acquisition unit is used to acquire each permission node in the first access permission as a target node;

[0037] The permission determination unit is used to sequentially query each target node in the spatial index of the second access permission. If the query result is successful each time, the determination result is that the second access permission includes the first access permission; otherwise, the determination result is that the second access permission does not include the first access permission.

[0038] Optionally, the information access control device further includes:

[0039] The identity information acquisition module is used to receive the login request from the client user and obtain the user's identity information from the login request;

[0040] The access node sharding module is used to allocate access nodes to the client user based on the user identity information, thereby obtaining the target access node;

[0041] The access request control module is used to control the information access requests of the client user based on the target access node.

[0042] To address the aforementioned technical problems, this application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the aforementioned information access control method.

[0043] To address the aforementioned technical problems, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the aforementioned information access control method.

[0044] The information access control method, apparatus, computer device, and storage medium provided in this invention, upon receiving an information access request from a client user, obtains the Uniform Resource Identifier (URL) contained in the information access request and the client user's identity information. Based on a preset permission mapping relationship, it determines the permission to access the URL as the first access permission. Based on the identity information, it determines the user group to which the client user belongs as the target user group and obtains the permissions of the target user group as the second access permission. Based on a spatial search algorithm, it determines whether the second access permission includes the first access permission and obtains the determination result. If the determination result is that the second access permission includes the first access permission, it redirects to the URL; if the determination result is that the second access permission does not include the first access permission, it denies access to the URL. This achieves user access control with different permissions through a unified page, improving the efficiency of information access control. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a schematic diagram of the application environment of this application;

[0047] Figure 2 This is a flowchart of one embodiment of the information access control method of this application;

[0048] Figure 3 This is a schematic diagram of a structure of an embodiment of a control device for information access according to this application;

[0049] Figure 4 This is a schematic diagram of the structure of one embodiment of the computer device according to this application. Detailed Implementation

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0051] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Please see Figure 1 ,like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0054] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc.

[0055] Terminal devices 101, 102, and 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture E interface displays Perts Group Audio Layer III, Dynamic Picture Experts Compression Standard Audio Layer 3), MP4 players (Moving Picture E interface displays Perts Group Audio Layer IV, Dynamic Picture Experts Compression Standard Audio Layer 4), laptops, and desktop computers, etc.

[0056] Server 105 can be a server that provides various services, such as a backend server that supports the pages displayed on terminal devices 101, 102, and 103.

[0057] It should be noted that the face image super-resolution reconstruction method provided in this application embodiment is executed by the server, and correspondingly, the face image super-resolution reconstruction device is set in the server.

[0058] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included. The terminal devices 101, 102, and 103 in this embodiment can specifically correspond to application systems in actual production.

[0059] Please see Figure 2 , Figure 2 This invention illustrates an information access control method provided by an embodiment of the present invention, which is applied to... Figure 1 Taking the server-side as an example, the details are as follows:

[0060] S201: Upon receiving an information access request from a client user, obtain the Uniform Resource Identifier contained in the information access request and obtain the client user's identity information.

[0061] A Uniform Resource Identifier (URL) is a string used to identify the name of an Internet resource. Every resource document and image available on the Web can be located using a Uniform Resource Identifier (URL).

[0062] Specifically, when a client needs to obtain access information, it clicks on the corresponding page element, generates an information access request, and sends it to the server. After receiving the information access request from the client user, the server obtains the Uniform Resource Identifier contained in the information access request and obtains the client user's identity information.

[0063] It should be noted that different access information corresponds to different permissions. In this embodiment, the permissions include, but are not limited to, guest permissions, ordinary user permissions, and management permissions. When the permission is guest permission, the user's identity information can be random guest identity information, such as a randomly generated guest identity string.

[0064] In one specific optional implementation, before step S201, that is, before determining the access permission to the Uniform Resource Identifier based on a preset permission mapping relationship as the first access permission, the method further includes:

[0065] Generate a permission node tree based on all permissions;

[0066] Each basic Uniform Resource Identifier in the access page for information;

[0067] Based on the permission node tree, a preset permission mapping relationship is generated for each Uniform Resource Identifier.

[0068] A node tree is a tree structure based on an XML document, allowing access to all nodes. Nodes can be modified or deleted, and new elements can be created. This node tree displays a collection of nodes and the relationships between them. The tree starts with the root node and branches out to text nodes at the lowest level. Nodes in a node tree have hierarchical relationships, described by parent, child, and sibling nodes. A parent node has child nodes, and child nodes at the same level are called sibling nodes (siblings). The top node in the node tree is called the root node. Every node except the root node has a parent node. A node can have any number of child nodes. Leaves are nodes without child nodes. Sibling nodes are nodes that share the same parent node. The image below shows a portion of a node tree and the relationships between nodes. Because XML data is structured as a tree, it can be traversed without knowing the exact structure of the tree or the data types it contains.

[0069] Specifically, in this embodiment, a relationship chain of users, roles, and permissions is used to set permissions, assign different permissions to each role, and each user's identity information corresponds to at least one role to achieve dynamic permission control. Based on the pre-set correspondence between all permissions and roles in the database, a permission node tree is generated, and then the access permission information corresponding to each basic unified resource identifier in the information access page is obtained. Based on the access permission information corresponding to each basic unified resource identifier and the permission node tree, the preset permission mapping relationship of each unified resource identifier is determined.

[0070] S202: Based on the preset permission mapping relationship, determine the permission to access the Uniform Resource Identifier as the first access permission.

[0071] The preset permission mapping relationship is a pre-set permission relationship between each Uniform Resource Identifier (URI) of the access page, which is based on the actual application. Permissions include, but are not limited to, browsing, modifying, downloading, deleting, marking, and hiding operations.

[0072] S203: Based on the identity information, determine the user group to which the client user belongs, as the target user group, and obtain the permissions of the target user group as the second access permission.

[0073] S204: Based on the spatial search algorithm, determine whether the second access permission includes the first access permission, and obtain the judgment result.

[0074] Among them, the spatial search algorithm is a search algorithm based on spatial range, which is commonly used for the storage and query of geographic data. In this embodiment, considering that the first access permission usually involves multiple permissions and the user group corresponding to the second access permission has a fixed permission range, the spatial search algorithm can more quickly determine the relationship between the first access permission and the second access permission when there are many permissions, thereby improving the efficiency of information access control.

[0075] In one specific optional implementation, in step S204, based on a spatial search algorithm, it is determined whether the second access permission includes the first access permission, and the determination result includes:

[0076] Based on the R-tree approach, a spatial index with second access permissions is generated;

[0077] Obtain each permission node in the first access permission list as the target node;

[0078] Each target node is queried sequentially in the spatial index of the second access permission. If each query result is a successful query, the result is determined to be that the second access permission includes the first access permission; otherwise, the result is determined to be that the second access permission does not include the first access permission.

[0079] R-trees, also known as B-trees, are another form of B-tree development into multi-dimensional space. They divide the object space into ranges, with each node corresponding to a region and a disk page. The disk page of a non-leaf node stores the ranges of all its child nodes, and the regions of all child nodes of a non-leaf node fall within its own range. The disk page of a leaf node stores the bounding rectangle of all spatial objects within its range. R-trees are a dynamic indexing structure.

[0080] S205: If the determination result is that the second access permission includes the first access permission, then redirect to the Uniform Resource Identifier; if the determination result is that the second access permission does not include the first access permission, then deny access to the Uniform Resource Identifier.

[0081] Optionally, the first access permission includes at least one permission information.

[0082] In this embodiment, upon receiving an information access request from a client user, the system obtains the Uniform Resource Identifier (URL) contained in the request and the client user's identity information. Based on a preset permission mapping relationship, the system determines the permission to access the URL and assigns it as the first access permission. Based on the identity information, the system determines the user group to which the client user belongs and assigns it as the target user group. The system then obtains the permissions of the target user group and assigns them as the second access permission. Based on a spatial search algorithm, the system determines whether the second access permission includes the first access permission. If the determination result is that the second access permission includes the first access permission, the system redirects to the URL. If the determination result is that the second access permission does not include the first access permission, access to the URL is denied. This allows for user access control with different permissions through a unified page, improving the efficiency of information access management.

[0083] In one specific optional implementation, before obtaining the client user's identity information and the Uniform Resource Identifier (URL) contained in the information access request upon receiving an information access request from a client user, the information access control method further includes:

[0084] Receive login requests from client users and obtain user identity information from the login requests;

[0085] Based on user identity information, an access node is assigned to the client user to obtain the target access node;

[0086] Based on the target access node, information access requests from client users are controlled.

[0087] In this embodiment, user groups are obtained based on user identity information, and then target access nodes are allocated and determined based on user groups. This ensures that the user groups corresponding to the same target access node are the same, that is, the user permissions corresponding to the same target access node are the same. This helps to improve the efficiency and accuracy of permission control and ensure the efficiency and security of information access.

[0088] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0089] Figure 3 A schematic block diagram of an information access control device is shown, corresponding one-to-one with the information access control methods described in the above embodiments. For example... Figure 3 As shown, the information access control device includes an access request receiving module 31, a first permission determination module 32, a first permission determination module 33, a permission judgment module 34, and an access control module 35. Detailed descriptions of each functional module are as follows:

[0090] The access request receiving module 31 is used to obtain the Uniform Resource Identifier contained in the information access request and obtain the identity information of the client user when it receives the information access request sent by the client user.

[0091] The first permission determination module 32 is used to determine the permission to access the Uniform Resource Identifier based on a preset permission mapping relationship, as the first access permission.

[0092] The first permission determination module 33 is used to determine the user group to which the client user belongs based on the identity information, as the target user group, and to obtain the permissions of the target user group as the second access permission;

[0093] The permission judgment module 34 is used to determine whether the second access permission includes the first access permission based on a spatial search algorithm, and obtain the judgment result.

[0094] Access control module 35 is used to redirect to the Uniform Resource Identifier if the determination result is that the second access permission includes the first access permission, and to deny access to the Uniform Resource Identifier if the determination result is that the second access permission does not include the first access permission.

[0095] Optionally, the device further includes:

[0096] The node tree generation module is used to generate a permission node tree based on all permissions.

[0097] The Uniform Resource Identifier (URI) acquisition module is used to obtain each basic URI identifier in the information access page;

[0098] The mapping relationship generation module is used to generate a preset permission mapping relationship for each Uniform Resource Identifier based on the permission node tree.

[0099] Optionally, the permission determination module 34 includes:

[0100] The index generation unit is used to generate a spatial index with second access permissions based on the R-tree approach.

[0101] The target node acquisition unit is used to acquire each permission node in the first access permission as the target node;

[0102] The permission judgment unit is used to query each target node in the spatial index of the second access permission in turn. If the query result is successful each time, the judgment result is determined to be that the second access permission includes the first access permission; otherwise, the judgment result is determined to be that the second access permission does not include the first access permission.

[0103] Optionally, the information access control device also includes:

[0104] The identity information acquisition module is used to receive login requests from client users and obtain user identity information from the login requests;

[0105] The access node sharding module is used to assign access nodes to client users based on user identity information, thereby obtaining the target access node;

[0106] The access request control module is used to control client users' information access requests based on the target access node.

[0107] Specific limitations regarding the information access control device can be found in the limitations of the information access control method described above, and will not be repeated here. Each module in the aforementioned information access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0108] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed] for details. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0109] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected via a system bus. It should be noted that only the computer device 4 with components connected to the memory 41, processor 42, and network interface 43 is shown in the figure; however, it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0110] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0111] The memory 41 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or D-interface display memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 may be an internal storage unit of the computer device 4, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 41 may also be an external storage device of the computer device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 4. Of course, the memory 41 may include both the internal storage unit and its external storage device of the computer device 4. In this embodiment, the memory 41 is typically used to store the operating system and various application software installed on the computer device 4, such as program code for controlling electronic documents. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or will be output.

[0112] In some embodiments, the processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 42 is typically used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run program code stored in the memory 41 or process data, such as running data access program code.

[0113] The network interface 43 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 4 and other electronic devices.

[0114] This application also provides another embodiment, namely, providing a computer-readable storage medium storing a data access program that can be executed by at least one processor to cause the at least one processor to perform the steps of the information access control method described above.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0117] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0118] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A method for controlling information access, characterized in that, The information access control method includes: upon receiving an information access request from a client user, obtaining a Uniform Resource Identifier (URI) contained in the information access request, and obtaining the client user's identity information; determining the permission to access the URI based on a preset permission mapping relationship, as a first access permission; determining the user group to which the client user belongs, as a target user group, based on the identity information, and obtaining the permissions of the target user group, as a second access permission; and determining whether the second access permission includes the first access permission based on a spatial search algorithm, and obtaining a determination result. If the determination result is that the second access permission includes the first access permission, then redirect to the Uniform Resource Identifier; if the determination result is that the second access permission does not include the first access permission, then deny access to the Uniform Resource Identifier. Before determining the access permission to the Uniform Resource Identifier based on the preset permission mapping relationship as the first access permission, the method further includes: Based on all permissions, generate a permission node tree; retrieve each basic Uniform Resource Identifier (URL) in the information access page; Based on the permission node tree, the preset permission mapping relationship for each Uniform Resource Identifier is generated; The first access permission includes at least one permission information; The spatial search algorithm determines whether the second access permission includes the first access permission, and the determination result includes: Based on the R-tree approach, a spatial index for the second access permission is generated; each permission node in the first access permission is obtained as a target node; each target node is queried sequentially in the spatial index of the second access permission. If each query result is successful, the judgment result is determined to be that the second access permission includes the first access permission; otherwise, the judgment result is determined to be that the second access permission does not include the first access permission.

2. The information access control method as described in claim 1, characterized in that, Before obtaining the client user's identity information and the Uniform Resource Identifier (URL) contained in the information access request upon receiving an information access request from a client user, the information access control method further includes: Receive the login request from the client user and obtain the user's identity information from the login request; Based on the user identity information, an access node is assigned to the client user to obtain the target access node; Based on the target access node, the information access requests of the client user are controlled.

3. A control device for information access, characterized in that, The information access control device includes: an access request receiving module, configured to, upon receiving an information access request sent by a client user, obtain a Uniform Resource Identifier (URI) contained in the information access request and obtain the client user's identity information; a first permission determination module, configured to, based on a preset permission mapping relationship, determine the permission to access the URI as a first access permission; a first permission determination module, configured to, based on the identity information, determine the user group to which the client user belongs as a target user group and obtain the permissions of the target user group as a second access permission; and a permission judgment module, configured to, based on a spatial search algorithm, determine whether the second access permission includes the first access permission and obtain a judgment result. The access control module is configured to redirect access to the Uniform Resource Identifier if the determination result is that the second access permission includes the first access permission, and to deny access to the Uniform Resource Identifier if the determination result is that the second access permission does not include the first access permission. The information access control device also includes: The node tree generation module is used to generate a permission node tree based on all permissions; the Uniform Resource Identifier (URI) acquisition module is used to acquire each basic URI in the information access page; and the mapping relationship generation module is used to generate the preset permission mapping relationship for each URI based on the permission node tree. The permission determination module includes: an index generation unit, used to generate a spatial index of the second access permission based on an R-tree; a target node acquisition unit, used to acquire each permission node in the first access permission as a target node; and a permission determination unit, used to sequentially query each target node in the spatial index of the second access permission. If each query result is a successful query, the determination result is that the second access permission includes the first access permission; otherwise, the determination result is that the second access permission does not include the first access permission.

4. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the information access control method as described in any one of claims 1 to 2.

5. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the information access control method as described in any one of claims 1 to 2.

Images