A permission configuration method, system, device and computer-readable storage medium

Abstract

The present invention discloses a permission configuration method, system, device and computer-readable storage medium, which relate to the field of system configuration. The API of the operating system is the basic functional configuration of the operating system and is the lowest-level application program interface that does not require user configuration. Therefore, a preset permission addition and deletion policy is determined based on the API of the operating system. Therefore, the initial configuration information of each permission in the current operating system is first determined. Based on each initial configuration information, target configuration information after updating the initial configuration information representing each permission can be obtained. Then, based on the initial configuration information, the target configuration information and the preset permission addition and deletion policy, the configuration information of each permission is updated to the target configuration information. Compared with the existing technology, this configuration process is designed only by relying on the API provided by the operating system itself. Therefore, there is no need for developers to rewrite the inf file for the operating system after each version upgrade. It is simple, convenient, easy to implement and has strong versatility.

Description

Technical Field

[0001] The present invention relates to the technical field of system configuration, and in particular to a permission configuration method, system, device and computer-readable storage medium. Background Art

[0002] In an operating system such as Windows, to ensure system security, it is necessary to configure user permissions under various operation permissions to determine whether they have access rights.

[0003] The existing method for implementing this configuration relies on pre-written program scripts (.inf files) that invoke the secedit system command during operation to configure user permissions. However, operating systems are subject to version upgrades, requiring developers to modify the above-mentioned .inf files with each upgrade to achieve compatibility with the new operating system version and ultimately implement user permission configuration. However, this method is too cumbersome and not conducive to practical application. Summary of the Invention

[0004] The purpose of the present invention is to provide a permission configuration method, system, device and computer-readable storage medium. The configuration process is designed only by relying on the API provided by the operating system itself, so there is no need for developers to rewrite the INF file for each version upgrade of the operating system. It is simpler, more convenient, easy to implement and has strong versatility.

[0005] To solve the above technical problems, the present invention provides a permission configuration method, comprising:

[0006] Determine the initial configuration information of each permission in the current operating system;

[0007] Acquire target configuration information after updating the configuration information representing each of the permissions based on each of the initial configuration information;

[0008] The initial configuration information of each permission is updated to the target configuration information based on the initial configuration information, the target configuration information and a preset permission addition and deletion policy, wherein the preset permission addition and deletion policy is predetermined according to an API of the operating system.

[0009] Preferably, determining the initial configuration information of each permission in the current operating system includes:

[0010] An API representing permission configuration query is called according to the identification information of each permission respectively, so as to determine the initial configuration information of each permission in the current operating system.

[0011] Preferably, obtaining target configuration information representing the updated configuration of each permission based on each of the initial configuration information includes:

[0012] Controlling the display module to display the initial configuration information;

[0013] Receive the target configuration information after updating the fed-back configuration information representing each of the permissions, wherein the target configuration information is determined based on the target security level of the operating system and / or the target permission requested to be allocated by the user to be configured.

[0014] Preferably, the initial configuration information includes the SID of each user who has configured the permission;

[0015] Before controlling the display module to display the initial configuration information, the method further includes:

[0016] The user's sid is used as a first parameter, and a first conversion tool is called to convert the user's sid into a corresponding character string to be displayed.

[0017] Preferably, updating the initial configuration information of each permission to the target configuration information based on the initial configuration information, the target configuration information and the preset permission addition and deletion policy includes:

[0018] For the i-th permission, perform the following steps, where 1≤i≤the total number of permissions:

[0019] S21: let j = 1;

[0020] S22: Determine whether the target configuration information contains the j-th first identity information in the initial configuration information; if not, proceed to S23; if so, proceed to S24;

[0021] S23: removing the j-th first identity information based on the API representing the permission removal, and proceeding to S24;

[0022] S24: Let j = j + 1, and determine whether the updated j is greater than the total number of first identity information in the initial configuration information; if so, proceed to S25; if not, return to S22;

[0023] S25: set z=1;

[0024] S26: Determine whether the initial configuration information contains the z-th second identity information in the target configuration information; if not, proceed to S27; if so, proceed to S28;

[0025] S27: Add the zth second identity information based on the API adding the representation permission, and proceed to S28;

[0026] S28: Let z=z+1, and determine whether the updated z is greater than the total number of second identity information in the target configuration information; if so, end the loop; if not, return to S26.

[0027] Preferably, before removing the j-th first identity information based on the representation permission removal API, the method further includes:

[0028] Call the handle acquisition tool to obtain a handle for global use;

[0029] The API based on the representation permission removal removes the j-th first identity information, including:

[0030] Calling an API representing permission removal with the handle, the j-th first identity information, and the identification information of the i-th permission as second parameters to remove the j-th first identity information from the initial configuration information of the i-th permission;

[0031] The API based on the representation permission adds the zth second identity information, including:

[0032] An API representing permission addition is called with the handle, the zth second identity information, and the identification information of the ith permission as a third parameter to add the zth second identity information to the initial configuration information of the ith permission.

[0033] Preferably, when the zth second identity information in the target configuration information is a target character string;

[0034] Before determining whether the target configuration information contains the j-th first identity information in the initial configuration information, the method further includes:

[0035] The second conversion tool is called with the zth second identity information as the fourth parameter to convert the zth second identity information into the corresponding SID.

[0036] To solve the above technical problems, the present invention further provides a rights allocation system, comprising:

[0037] A first determining unit, configured to determine initial configuration information of each permission in the current operating system;

[0038] A first acquiring unit is configured to acquire target configuration information after updating the configuration information representing each of the permissions based on each of the initial configuration information;

[0039] The first configuration unit is used to update the initial configuration information of each permission to the target configuration information based on the initial configuration information, the target configuration information and a preset permission addition and deletion policy, wherein the preset permission addition and deletion policy is predetermined according to the API of the operating system.

[0040] To solve the above technical problems, the present invention further provides a rights allocation device, comprising:

[0041] memory for storing computer programs;

[0042] A processor is used to execute the steps of the permission allocation method as described above.

[0043] To solve the above technical problems, the present invention further provides a computer-readable storage medium, comprising:

[0044] The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for allocating rights.

[0045] The present application provides a permission configuration method, system, device and computer-readable storage medium. The API of the operating system is the basic functional configuration of the operating system. It is the lowest-level application program interface and does not require user configuration. Therefore, the preset permission addition and deletion policy is determined based on the API of the operating system. Therefore, the initial configuration information of each permission in the current operating system is first determined. Based on each initial configuration information, the target configuration information after the initial configuration information representing each permission is updated can be obtained. Then, based on the initial configuration information, the target configuration information and the preset permission addition and deletion policy, the configuration information of each permission is updated to the target configuration information. Compared with the existing technology, this configuration process is designed only by relying on the API provided by the operating system itself. Therefore, there is no need for developers to rewrite the inf file for each version upgrade of the operating system. It is simpler, more convenient, easy to implement and has strong versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the prior art and the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 A flowchart of a permission configuration method provided by the present invention;

[0048] Figure 2 A flowchart of updating the configuration information of the i-th permission to the target configuration information is provided by the present invention;

[0049] Figure 3 A schematic diagram of the structure of a permission configuration system provided by the present invention;

[0050] Figure 4 This is a structural diagram of a permission configuration device provided by the present invention. DETAILED DESCRIPTION

[0051] The core of the present invention is to provide a permission configuration method, system, device and computer-readable storage medium. The configuration process is designed only by relying on the API provided by the operating system itself, so there is no need for developers to rewrite the INF file for each version upgrade of the operating system. It is simpler, more convenient, easy to implement and highly versatile.

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0053] Please refer to Figure 1 , Figure 1 The present invention provides a flowchart of a method for configuring permissions.

[0054] Considering that in an operating system, in order to ensure the operational safety of the operating system, it is necessary to configure the user permissions under each operating permission (such as system operating permission) to clarify whether each user has access rights. In order to implement the above-mentioned user permission configuration in the prior art, it is necessary to pre-write an inf file, which will call the secedit system command during the operation of the file to achieve the above-mentioned purpose. However, after the version of the operating system is updated, it is necessary to re-modify the program script written in the inf file to adapt to the version of the current operating system, resulting in the above-mentioned method being too cumbersome and limited by the constraints of the operating system version, which is not conducive to practical application. In order to solve the above-mentioned technical problems, the present application provides a permission configuration method that is simple, convenient, easy to implement, and has strong versatility.

[0055] The permission configuration method includes:

[0056] S11: Determine the initial configuration information of each permission in the current operating system;

[0057] This permission configuration method can be applied to various computer devices, including but not limited to servers, and can be specifically applied to user permission configuration for security baseline projects in such computer devices, without particular limitation herein. Specifically, upon receiving a first identification signal representing a permission configuration, initial configuration information for each permission (e.g., system operation permission) in the current operating system is determined, and this first identification signal can be input by an administrator on a user interface.

[0058] In addition, the initial configuration information may be the SID information (ie, user unique security identifier) ​​of all users who have the permission.

[0059] S12: acquiring target configuration information after updating configuration information representing each permission based on each initial configuration information;

[0060] Specifically, the initial configuration information may be output so that the user can return to the target configuration information after updating the current initial configuration information.

[0061] S13: Based on the initial configuration information, the target configuration information and the preset permission addition and deletion policy, the initial configuration information of each permission is updated to the target configuration information. The preset permission addition and deletion policy is predetermined according to the API of the operating system.

[0062] Specifically, considering that the operating system API is the basic functional configuration of the operating system and is the lowest-level application program interface, which does not require user configuration and can implement corresponding functions through calling, a preset permission addition and deletion policy is determined based on the operating system API. Then, based on the initial configuration information, the target configuration information, and the preset permission addition and deletion policy, the initial configuration information of each permission is updated to the target configuration information.

[0063] In summary, this application provides a permission configuration method that uses the operating system's API as the lowest-level application programming interface (API) without requiring user configuration, predetermines a preset permission addition and deletion policy, and ultimately updates the initial configuration information for each permission to the target configuration information. Compared to the prior art, this configuration process is designed solely based on the API provided by the operating system itself. Therefore, there is no need for developers to rewrite the INF file for each operating system version upgrade. This eliminates the drawback of the prior art of relying on system commands to implement user permission configuration. This method is simpler, more convenient, more stable, easier to implement, and more versatile.

[0064] Based on the above embodiment:

[0065] As a preferred embodiment, determining the initial configuration information of each permission in the current operating system includes:

[0066] The API representing the permission configuration query is called according to the identification information of each permission to determine the initial configuration information of each permission in the current operating system.

[0067] In this embodiment, steps are given for determining the initial configuration information of each permission in the current operating system. That is, different permissions have unique identification information. Therefore, for any permission, an API representing the permission configuration query is called according to the identification information of the permission to obtain the current initial configuration information of the permission. Taking the Windows operating system as an example, the system API LsaEnumerateAccountsWithUserRight can be used as an input parameter to call the system API based on the identification information of the permission to be queried, and then the SID information of all users who have the permission can be enumerated.

[0068] It can be seen that determining the initial configuration information of each permission in the current operating system by calling the system API is not affected by the version of the operating system compared to the prior art.

[0069] As a preferred embodiment, obtaining target configuration information after updating the configuration representing each permission based on each initial configuration information includes:

[0070] Control the display module to display initial configuration information;

[0071] Receive the target configuration information after updating the fed-back configuration information representing each permission, wherein the target configuration information is determined based on the target security level of the operating system and / or the target permission requested to be allocated by the user to be configured.

[0072] In this embodiment, a step is provided for obtaining target configuration information after updating the configuration representing each permission based on each initial configuration information. Specifically, after determining the initial configuration information of each permission in the current operating system, the display module is first controlled to display the initial configuration information. The display module includes but is not limited to a pre-set user interaction interface. Then, after the user to be configured masters the initial configuration information, he or she determines the target permission to be configured and / or the target security level of the operating system (that is, the security level determined by the main protection of the operating system, for example, when the target security level is level 1, which permissions can be opened, and when the target security level is level 2, compared with level 1, some permissions will no longer be open to the user). Then, the target configuration information after updating the configuration information representing each permission is received based on the feedback. The implementation method is simple and reliable, and the security of the operating system is guaranteed.

[0073] As a preferred embodiment, the initial configuration information includes the SID of each user whose permissions have been configured;

[0074] Before the control display module displays the initial configuration information, it also includes:

[0075] The user's sid is used as the first parameter, and the first conversion tool is called to convert the user's sid into a corresponding character string to be displayed.

[0076] In this embodiment, considering that the initial configuration information includes the SIDs of each user who has configured the permission, the SIDs are generally complex. To facilitate more intuitive understanding, before the control display module displays the initial configuration information, the user's SID can be used as the first parameter and a first conversion tool can be called to convert the user's SID into a corresponding string to be displayed. Taking the Windows operating system as an example, the first conversion tool can be the LookupAccountSid function.

[0077] As a preferred embodiment, based on the initial configuration information, the target configuration information and the preset permission addition and deletion policy, the initial configuration information of each permission is updated to the target configuration information, including:

[0078] Perform the following steps for the i-th permission, where 1≤i≤the total number of permissions:

[0079] S21: let j = 1;

[0080] S22: Determine whether the target configuration information contains the j-th first identity information in the initial configuration information; if not, proceed to S23; if so, proceed to S24;

[0081] S23: removing the j-th first identity information based on the API representing the permission removal, and proceeding to S24;

[0082] S24: Let j = j + 1, and determine whether the updated j is greater than the total number of first identity information in the initial configuration information; if so, proceed to S25; if not, return to S22;

[0083] S25: set z=1;

[0084] S26: Determine whether the initial configuration information contains the z-th second identity information in the target configuration information; if not, proceed to S27; if so, proceed to S28;

[0085] S27: Add the zth second identity information based on the API adding the representation permission, and proceed to S28;

[0086] S28: Let z=z+1, and determine whether the updated z is greater than the total number of second identity information in the target configuration information; if so, end the loop; if not, return to S26.

[0087] In this embodiment, specific steps are given for updating the configuration information of each permission to the target configuration information based on the initial configuration information, the target configuration information and the preset permission addition and deletion policy. Please refer to Figure 2It can be understood that by executing the above steps S21 to S28 for each permission, the configuration information of each permission can be updated to the corresponding target configuration information. The specific implementation steps are described above and will not be repeated here. It can be seen that the update of the configuration information of each permission is simply and reliably guaranteed by the above enumeration determination method.

[0088] It should be noted that, in the above-mentioned step of removing the j-th first identity information based on the API representing the removal of permissions, taking the Windows operating system as an example, the API representing the removal of permissions is the system API LsaRemoveAccountRights, which can remove the initial configuration information corresponding to the current permissions of the specified user's SID; in the above-mentioned step of adding the z-th second identity information based on the API representing the addition of permissions, taking the Windows operating system as an example, the API representing the addition of permissions is the system API LsaAddAccountRights, which can add the specified user's SID to the initial configuration information corresponding to the current permissions.

[0089] It should also be noted that before entering step S21, it is necessary to ensure the consistency of the information types included in the initial configuration information and the target configuration information. For example, if the types of information included in the initial configuration information are all SID information types, then the types of information included in the corresponding target configuration information are also SID information types; for example, if the types of information included in the initial configuration information are all user string information types, then the types of information included in the corresponding target configuration information are also string information types.

[0090] As a preferred embodiment, before removing the j-th first identity information based on the representation permission removal API, the method further includes:

[0091] Call the handle acquisition tool to obtain a handle for global use;

[0092] The API based on the representation permission removal removes the j-th first identity information, including:

[0093] Call the permission removal API with the handle, the j-th first identity information, and the identification information of the i-th permission as the second parameter to remove the j-th first identity information from the initial configuration information of the i-th permission;

[0094] The API based on the representation permission adds the zth second identity information, including:

[0095] The API representing permission addition is called with the handle, the zth second identity information, and the identification information of the ith permission as the third parameter to add the zth second identity information to the initial configuration information of the ith permission.

[0096] In this embodiment, considering that it is necessary to obtain the corresponding handle when making a system API call, before removing the j-th first identity information based on the API that represents the permission removal, the handle acquisition tool is called to obtain a handle for global use. Taking the Windows operating system as an example, the handle acquisition tool is the LsaOpenPolicy function, which is called to obtain LSA_HANDLE for global use.

[0097] Therefore, in accordance with the method described above, when it is determined that there is redundant j-th first identity information in the initial configuration information of the current permission, the handle, the j-th first identity information and the identification information of the i-th permission are used as the second parameter to call the API representing permission removal, so as to move the j-th first identity information out of the initial configuration information of the i-th permission; when it is determined that the z-th second identity information is missing in the initial configuration information of the current permission, the handle, the z-th second identity information and the identification information of the i-th permission are used as the third parameter to call the API representing permission removal, so as to add the z-th second identity information to the initial configuration information of the i-th permission. The implementation method is simple and reliable.

[0098] It should also be noted that when it is determined that the update of the target configuration information of each of the permissions is completed, the handle closing tool can be called to ensure the safety of the system operation. Specifically, taking the Windows operating system as an example, the handle closing tool is the LsaClose function, which is called to close the globally used LSA_HANDLE.

[0099] As a preferred embodiment, when the zth second identity information in the target configuration information is a target character string;

[0100] Before determining whether the target configuration information contains the j-th first identity information in the initial configuration information, the method further includes:

[0101] The second conversion tool is called with the zth second identity information as the fourth parameter to convert the zth second identity information into the corresponding SID.

[0102] In this embodiment, considering that the first identity information stored in the system is usually the user's SID, that is, it is stored in the SID information type, and the target configuration information received in feedback is usually string information type information, therefore, before determining whether the target configuration information contains the jth first identity information in the initial configuration information, the zth second identity information is used as the fourth parameter to call the second conversion tool to convert the zth second identity information into the corresponding SID, which is also convenient for direct use when subsequently calling the API for removing permissions and calling the API for adding permissions.

[0103] Specifically, taking the Windows operating system as an example, the second conversion tool may be a LookupAccountName function.

[0104] Please refer to Figure 3 , Figure 3 This is a structural diagram of a rights allocation system provided by the present invention.

[0105] The permission allocation system includes:

[0106] A first determining unit 31 is configured to determine initial configuration information of each permission in the current operating system;

[0107] A first acquiring unit 32 is configured to acquire target configuration information after updating the configuration information representing each permission based on each initial configuration information;

[0108] The first configuration unit 33 is used to update the initial configuration information of each permission to the target configuration information based on the initial configuration information, the target configuration information and the preset permission addition and deletion policy. The preset permission addition and deletion policy is predetermined according to the API of the operating system.

[0109] For an introduction to the authority allocation system provided in the present invention, please refer to the embodiment of the authority allocation method described above, which will not be described in detail here.

[0110] As a preferred embodiment, the first determining unit 31 specifically includes:

[0111] The first calling unit is configured to call an API representing permission configuration query according to identification information of each permission, so as to determine initial configuration information of each permission in the current operating system.

[0112] As a preferred embodiment, the first acquiring unit 32 specifically includes:

[0113] an output display unit, configured to control the display module to display the initial configuration information;

[0114] The feedback receiving unit is used to receive the target configuration information after the feedback characterizing the configuration information of each of the permissions is updated, wherein the target configuration information is determined based on the target security level of the operating system and / or the target permission requested to be allocated by the user to be configured.

[0115] As a preferred embodiment, the initial configuration information includes the SID of each user who has configured the permission; the first acquisition unit 32 further includes:

[0116] The first conversion unit is used to take the user's SID as a first parameter and call a first conversion tool before the output display unit to convert the user's SID into a corresponding character string to be displayed.

[0117] As a preferred embodiment, the first configuration unit 33 specifically includes:

[0118] A first assignment unit is configured to update the configuration information of the i-th permission to the target configuration information by setting j=1 for the i-th permission, where 1≤i≤the total number of the permissions;

[0119] The first judgment unit is used to judge whether the target configuration information contains the j-th first identity information in the initial configuration information; if not, trigger the removal calling unit; if so, enter the second judgment unit;

[0120] The removal calling unit is configured to remove the j-th first identity information based on the API representing the permission removal and enter the second judgment unit;

[0121] The second judgment unit is configured to set j=j+1 and judge whether the updated j is greater than the total number of first identity information in the initial configuration information; if so, trigger the second assignment unit; if not, return to the first judgment unit;

[0122] The second assignment unit is used to set z=1;

[0123] The third judgment unit is used to judge whether the initial configuration information contains the z-th second identity information in the target configuration information; if not, trigger the adding and calling unit; if so, trigger the fourth judgment unit;

[0124] The adding and calling unit is configured to add the zth second identity information based on the API representing the permission addition, and trigger the fourth determining unit;

[0125] The fourth judgment unit is used to set z=z+1 and judge whether the updated z is greater than the total number of second identity information in the target configuration information; if so, complete the update of the configuration information of the i-th permission to the target configuration information; if not, return to the third judgment unit.

[0126] As a preferred embodiment, the first configuration unit 33 further includes:

[0127] A handle calling unit, configured to call a handle obtaining tool to obtain a handle for global use before removing the calling unit;

[0128] The removal calling unit specifically includes:

[0129] A second calling unit is configured to call an API representing permission removal by taking the handle, the j-th first identity information, and the identification information of the i-th permission as second parameters, so as to remove the j-th first identity information from the initial configuration information of the i-th permission;

[0130] The adding calling unit specifically includes:

[0131] The third calling unit is used to call the API representing permission addition by taking the handle, the zth second identity information and the identification information of the ith permission as third parameters to add the zth second identity information to the initial configuration information of the ith permission.

[0132] As a preferred embodiment, when the zth second identity information in the target configuration information is a target character string; the first configuration unit 33 further includes:

[0133] The second conversion unit is used to call a second conversion tool with the zth second identity information as a fourth parameter before the first judgment unit to convert the zth second identity information into a corresponding SID.

[0134] Please refer to Figure 4 , Figure 4 This is a structural diagram of a rights allocation device provided by the present invention.

[0135] The authority allocation device includes:

[0136] Memory 41, for storing computer programs;

[0137] The processor 42 is configured to execute the steps of the permission allocation method as described above.

[0138] For an introduction to the authority allocation device provided in the present invention, please refer to the embodiment of the authority allocation method described above, which will not be described in detail here.

[0139] The present invention also provides a computer-readable storage medium, comprising:

[0140] The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for allocating rights.

[0141] For an introduction to the computer-readable storage medium provided in the present invention, please refer to the embodiment of the above-mentioned permission allocation method, which will not be repeated here.

[0142] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0143] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0144] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0145] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0146] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A permission configuration method, characterized in that: include: Determine the initial configuration information of each permission in the current operating system; Acquire target configuration information after updating the configuration information representing each of the permissions based on each of the initial configuration information; updating the initial configuration information of each permission to the target configuration information based on the initial configuration information, the target configuration information, and a preset permission addition and deletion policy, wherein the preset permission addition and deletion policy is predetermined according to an API of the operating system; Based on the initial configuration information, the target configuration information and the preset permission addition and deletion policy, the initial configuration information of each permission is updated to the target configuration information, including: For the i-th permission, perform the following steps, where 1≤i≤the total number of permissions: S21: Let j = 1; S22: Determine whether the target configuration information contains the j-th first identity information in the initial configuration information; if not, proceed to S23; if so, proceed to S24; S23: removing the j-th first identity information based on the API representing the permission removal, and proceeding to S24; S24: Let j = j + 1, and determine whether the updated j is greater than the total number of first identity information in the initial configuration information; if so, proceed to S25; if not, return to S22; S25: Let z = 1; S26: Determine whether the initial configuration information contains the z-th second identity information in the target configuration information; if not, proceed to S27; if so, proceed to S28; S27: Add the zth second identity information based on the API adding the representation permission, and proceed to S28; S28: Let z=z+1, and determine whether the updated z is greater than the total number of second identity information in the target configuration information; if so, end the loop; if not, return to S26.

2. The permission configuration method according to claim 1, wherein: Determine the initial configuration information for each permission in the current operating system, including: An API representing permission configuration query is called according to the identification information of each permission respectively, so as to determine the initial configuration information of each permission in the current operating system.

3. The permission configuration method according to claim 1, wherein: Acquiring target configuration information after updating the configuration of each permission based on each of the initial configuration information includes: Controlling the display module to display the initial configuration information; Receive the target configuration information after updating the fed-back configuration information representing each of the permissions, wherein the target configuration information is determined based on the target security level of the operating system and / or the target permission requested to be allocated by the user to be configured.

4. The permission configuration method according to claim 3, wherein: The initial configuration information includes the sid of each user who has configured the permission; Before controlling the display module to display the initial configuration information, the method further includes: The user's sid is used as a first parameter, and a first conversion tool is called to convert the user's sid into a corresponding character string to be displayed.

5. The permission configuration method according to claim 1, wherein: Before the API for removing the representation permission removes the j-th first identity information, the following steps are also included: Call the handle acquisition tool to obtain a handle for global use; The API based on the representation permission removal removes the j-th first identity information, including: Calling an API representing permission removal with the handle, the j-th first identity information, and the identification information of the i-th permission as second parameters to remove the j-th first identity information from the initial configuration information of the i-th permission; The API based on the representation permission adds the zth second identity information, including: An API representing permission addition is called with the handle, the zth second identity information, and the identification information of the ith permission as a third parameter to add the zth second identity information to the initial configuration information of the ith permission.

6. The permission configuration method according to claim 1, wherein: When the zth second identity information in the target configuration information is a target character string; Before determining whether the target configuration information contains the j-th first identity information in the initial configuration information, the method further includes: The second conversion tool is called with the zth second identity information as the fourth parameter to convert the zth second identity information into the corresponding SID.

7. A rights allocation system, characterized in that: include: A first determining unit, configured to determine initial configuration information of each permission in the current operating system; A first acquiring unit is configured to acquire target configuration information after updating the configuration information representing each of the permissions based on each of the initial configuration information; a first configuration unit, configured to update the initial configuration information of each permission to the target configuration information based on the initial configuration information, the target configuration information, and a preset permission addition and deletion policy, wherein the preset permission addition and deletion policy is predetermined according to an API of the operating system; The first configuration unit specifically includes: A first assignment unit is configured to update the configuration information of the i-th permission to the target configuration information by setting j=1 for the i-th permission, where 1≤i≤the total number of the permissions; The first judgment unit is used to judge whether the target configuration information contains the j-th first identity information in the initial configuration information; if not, trigger the removal calling unit; if so, enter the second judgment unit; The removal calling unit is configured to remove the j-th first identity information based on the API representing the permission removal and enter the second judgment unit; The second judgment unit is configured to set j=j+1 and judge whether the updated j is greater than the total number of first identity information in the initial configuration information; if so, trigger the second assignment unit; if not, return to the first judgment unit; The second assignment unit is used to set z=1; The third judgment unit is used to judge whether the initial configuration information contains the z-th second identity information in the target configuration information; if not, trigger the adding and calling unit; if so, trigger the fourth judgment unit; The adding and calling unit is configured to add the zth second identity information based on the API representing the permission addition, and trigger the fourth determining unit; The fourth judgment unit is used to set z=z+1 and judge whether the updated z is greater than the total number of second identity information in the target configuration information; if so, complete the update of the configuration information of the i-th permission to the target configuration information; if not, return to the third judgment unit.

8. A rights allocation device, characterized in that: include: memory for storing computer programs; A processor, configured to execute the steps of the permission allocation method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that include: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the rights allocation method according to any one of claims 1 to 6.

Images