A role-based sharing permission management method and system

Abstract

The embodiment of the application provides a role sharing-based permission management method and system, and relates to the technical field of data management.The role sharing-based permission management method comprises the following steps: obtaining tenant management information; obtaining permission configuration data of an application permission set; generating tenant role information according to the tenant management information and the permission configuration data; and generating application service information according to the tenant role information, wherein the application service information comprises one or more application permissions.The role sharing-based permission management method can realize differentiated management of permission sets, thereby achieving the technical effects of minimized storage and efficient and flexible management.

Description

Technical Field

[0001] This application relates to the field of data management technology, and more specifically, to a role-sharing-based access control method, system, electronic device, and computer-readable storage medium. Background Technology

[0002] Currently, B2B products are characterized by complex data, cumbersome business processes, and numerous user roles. To ensure the security of system data during enterprise use, a reasonable permission design is crucial, especially for B2B Software as a Service (SaaS) products, which involve multi-tenancy and require a single product to be used by numerous customers, thus placing even higher demands on permission control. In terms of implementation requirements, firstly, permission data for different customers needs to be isolated by tenant; secondly, the permission sets acquired by customers can differ (system applicability and different versions). Based on these two requirements, a common technical approach is to copy the relevant permission sets to the target customer after the tenant successfully activates or purchases the service. The customer then uses the corresponding permission management function to allocate and manage permissions differently for different users. However, this existing technology has the following obvious problems: high storage costs due to data copying; complex modification of permissions granted to customers after system permissions change; and low management efficiency, failing to quickly realize the collection of permissions already acquired by customers. Summary of the Invention

[0003] The purpose of this application is to provide a role-sharing-based permission management method, system, electronic device, and computer-readable storage medium, which can realize differentiated management of permission sets, thereby achieving the technical effect of minimizing storage and efficient and flexible management.

[0004] In a first aspect, embodiments of this application provide a permission management method based on role-sharing, including:

[0005] Obtain tenant management information;

[0006] Retrieve permission configuration data for the application permission set;

[0007] Tenant role information is generated based on the tenant management information and the permission configuration data;

[0008] Application service information is generated based on the tenant role information, and the application service information includes one or more application permissions.

[0009] In the above implementation process, the role-sharing-based permission management method generates tenant role information based on tenant management information and permission configuration data, thereby introducing the concept of roles. Different types of roles resolve the different permission sets corresponding to each role. That is, one type of role corresponds to one permission set, and application service information includes one or more application permissions. All tenants can share the same set of roles, and multi-tenant permission set differentiation management is realized in the resource granting process, thereby achieving the technical effect of minimizing storage and efficient and flexible management.

[0010] Furthermore, the step of obtaining tenant management information includes:

[0011] Obtain tenant's application payment data;

[0012] Tenant management information is generated based on the application's payment data.

[0013] In the above implementation process, the tenant's application payment data no longer directly depends on permissions, but is associated with the corresponding tenant role information through tenant management information; thus, permissions are associated with roles, and roles are then authorized to tenants to achieve differentiated management of multi-tenant permission sets.

[0014] Furthermore, after the step of generating tenant role information based on the tenant management information and the permission configuration data, the method further includes:

[0015] Determine whether the tenant role information is platform role information or paid role information;

[0016] If the tenant role information is platform role information, then configure a common permission set;

[0017] If the tenant role information is paid role information, then configure a differential permission set according to the type of the paid role information.

[0018] In the above implementation process, different types of role data are defined through platform roles and paid roles to realize the granting logic of common permission sets and differential permission sets for tenants.

[0019] Furthermore, the platform role information is uniformly maintained by the management backend, which configures the permission sets that each application grants to the enterprise free of charge, and automatically grants them when the enterprise activates the service;

[0020] The paid role information is maintained uniformly by the management backend. After clarifying the sales rules by combining market demand and product characteristics, services are created in the management backend and associated with paid function permissions.

[0021] Furthermore, after the step of generating application service information based on the tenant role information, the method further includes:

[0022] Generate a set of available permissions based on application service information;

[0023] Create custom role information, and use the custom role information to split and reorganize the available permission set. The custom role information is used to provide differentiated permission management for different users.

[0024] In the above implementation process, different permissions can be managed differently for different users by customizing role information.

[0025] Secondly, embodiments of this application provide a role-sharing-based access control system, including:

[0026] The tenant acquisition module is used to obtain tenant management information;

[0027] The permission acquisition module is used to obtain the permission configuration data of the application permission set;

[0028] The role module is used to generate tenant role information based on the tenant management information and the permission configuration data;

[0029] The service module is used to generate application service information based on the tenant role information, and the application service information includes one or more application permissions.

[0030] Furthermore, the tenant acquisition module is specifically used to: acquire the tenant's application payment data; and generate tenant management information based on the application payment data.

[0031] Furthermore, the role-sharing-based access control system also includes:

[0032] The judgment module is used to determine whether the tenant role information is platform role information or paid role information; if the tenant role information is platform role information, a common permission set is configured; if the tenant role information is paid role information, a differential permission set is configured according to the type of paid role information.

[0033] Furthermore, the role-sharing-based access control system also includes:

[0034] A custom module is used to generate a set of available permissions based on application service information; create custom role information, and split and reorganize the set of available permissions through the custom role information. The custom role information is used to provide differentiated permission management for different users.

[0035] Thirdly, an electronic device provided in this application includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method as described in any of the first aspects.

[0036] Fourthly, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in any of the first aspects.

[0037] Fifthly, embodiments of this application provide a computer program product that, when run on a computer, causes the computer to perform the method described in any of the first aspects.

[0038] Other features and advantages disclosed in this application will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the above-described technology disclosed in this application.

[0039] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A flowchart illustrating a role-sharing-based access control method provided in this application embodiment;

[0042] Figure 2 A schematic diagram of a role-sharing-based access control architecture provided in an embodiment of this application;

[0043] Figure 3 A flowchart illustrating another role-sharing-based access control method provided in this application embodiment;

[0044] Figure 4 A structural block diagram of a role-sharing-based access control system provided in an embodiment of this application;

[0045] Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0046] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0047] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0048] This application provides a role-sharing-based permission management method, system, electronic device, and computer-readable storage medium, which can be applied to the management services of SaaS products. The role-sharing-based permission management method generates tenant role information based on tenant management information and permission configuration data, thereby introducing the concept of roles. Different types of roles address the different permission sets corresponding to each role. That is, one type of role corresponds to one permission set, and application service information includes one or more application permissions. All tenants can share the same set of roles, realizing differentiated management of multi-tenant permission sets in the resource granting process, thereby achieving the technical effect of minimizing storage and efficient and flexible management.

[0049] Please see Figure 1 and Figure 2 , Figure 1 This is a flowchart illustrating a role-sharing-based access control method provided in an embodiment of this application. Figure 2 This is a schematic diagram of a role-sharing-based permission management architecture provided in an embodiment of this application; the role-sharing-based permission management method is applied to a management backend and includes the following steps:

[0050] S100: Obtain tenant management information.

[0051] For example, such as Figure 2 As shown, the functionalities of each element in the role-based access control architecture are as follows:

[0052] Permission Center: Basic data services, providing basic operations such as adding, deleting, modifying, and querying data in tables related to tenants, applications, permissions, and roles;

[0053] Management backend: Provided for use by the platform's internal operations personnel, it carries the management functions of basic data in the permission center and drives core processes, such as the activation and initialization of tenants after a transaction by enterprise customers, the assembly of sellable application services, and the listing and delisting of services.

[0054] Service Marketplace: Applications developed by the platform, relying on the management backend, assemble the permissions associated with the application into services and list them on the service marketplace. Enterprises with existing tenants can purchase (additional purchases or renewals) independently. After payment, they can request automatic authorization from the permission center.

[0055] SaaS platform: After purchasing, enterprises can see the purchased applications and corresponding permission sets. Enterprise administrators can create custom roles to give different users differentiated permission management.

[0056] For example, tenant management information may be the payment information of a tenant after purchasing the corresponding service, and the corresponding service may be provided based on the tenant's payment information; optionally, tenant management information may also include information such as the tenant's activation and initialization, assembly of salable application services, and service listing and delisting.

[0057] S200: Retrieves permission configuration data for the application permission set.

[0058] For example, the permission configuration data of the application permission set can be the corresponding permissions associated with the application; the permission configuration data is based on the application developed by the platform, and the permissions associated with the application are assembled into services and put on the service market through the management backend.

[0059] S300: Generates tenant role information based on tenant management information and permission configuration data.

[0060] For example, different tenant role information corresponds to different permission configuration data, realizing differentiated management of multi-tenant permission sets in the resource granting process.

[0061] S400: Generates application service information based on tenant role information. The application service information includes one or more application permissions.

[0062] For example, this role-sharing-based permission management method generates tenant role information based on tenant management information and permission configuration data, thereby introducing the concept of roles. Different types of roles resolve the different permission sets corresponding to each role. That is, one type of role corresponds to one permission set, and application service information includes one or more application permissions. All tenants can share the same set of roles, realizing differentiated management of multi-tenant permission sets in the resource granting process, thereby achieving the technical effect of minimizing storage and efficient and flexible management.

[0063] For example, in the role-sharing-based permission management method provided in this application embodiment, the tenant has a corresponding role, and the role contains corresponding permissions, and the permissions contain corresponding applications.

[0064] Please see Figure 3 , Figure 3 This is a flowchart illustrating another role-sharing-based permission management method provided in an embodiment of this application.

[0065] For example, S100: The step of obtaining tenant management information includes:

[0066] S110: Obtain the tenant's application payment data;

[0067] S120: Generate tenant management information based on application payment data.

[0068] For example, the tenant's application payment data no longer directly depends on permissions, but is associated with the corresponding tenant role information through tenant management information; thus, permissions are associated with roles, and roles are then authorized to tenants to achieve differentiated management of multi-tenant permission sets.

[0069] For example, S300: After the step of generating tenant role information based on tenant management information and permission configuration data, the permission management method based on role sharing further includes:

[0070] S310: Determine whether the tenant role information is platform role information or paid role information; if the tenant role information is platform role information, configure a common permission set; if the tenant role information is paid role information, configure a different permission set according to the type of paid role information.

[0071] For example, in the role-sharing-based permission management method provided in this application embodiment, platform roles are uniformly maintained by the platform administrator in the management backend, configuring the permission sets that each application grants to the enterprise for free, and automatically granting them when the enterprise activates the service, so as to realize the function of granting common permission sets to the enterprise; paid roles are uniformly maintained by the platform service market administrator in the management backend, and after clarifying the sales rules by combining market demand and product characteristics, services are created in the management backend, and associated with the functional permissions that the application needs to pay to obtain, producing services that can be sold independently, and listing the services on the application market; generally, an application can create multiple service versions, such as basic version, advanced version, flagship version, etc., and the functional permission sets associated with the services are realized through paid role types. Enterprises purchase different services or different service versions, ultimately realizing the function of enterprise-produced differentiated permission sets.

[0072] For example, by defining different types of role data through platform roles and paid roles, the logic for granting common permission sets and different permission sets for tenants can be realized.

[0073] In some implementations, tenant role information may include multiple paid roles, each corresponding to a different set of permissions; alternatively, the set of permissions obtained by the enterprise may include a platform role and multiple paid roles.

[0074] For example, the platform role information is maintained uniformly by the management backend, which configures the permission sets that each application grants to the enterprise for free and automatically grants them when the enterprise activates the service;

[0075] Paid role information is maintained uniformly in the management backend. After clarifying the sales rules by combining market demand and product characteristics, services are created in the management backend and associated with paid function permissions.

[0076] For example, after step S400: generating application service information based on tenant role information, the role-sharing-based permission management method further includes:

[0077] S410: Generate a set of available permissions based on application service information;

[0078] S420: Create custom role information. Use custom role information to split and reorganize the available permission set. Custom role information is used to provide differentiated permission management for different users.

[0079] For example, the role-sharing-based permission management method provided in this application embodiment, based on the existing solution, includes at least the following improvements: the permission set owned by the tenant no longer directly depends on the permissions, but associates permissions through roles, and then authorizes the roles to the tenant; by defining different types of role data, the granting logic of common permission sets and different permission sets for tenants is realized.

[0080] Please see Figure 4 , Figure 4 The structural block diagram of the role-sharing-based access control system provided in this application embodiment includes:

[0081] Tenant acquisition module 100 is used to acquire tenant management information;

[0082] The permission acquisition module 200 is used to acquire permission configuration data for the application permission set;

[0083] Role module 300 is used to generate tenant role information based on tenant management information and permission configuration data;

[0084] Service module 400 is used to generate application service information based on tenant role information. The application service information includes one or more application permissions.

[0085] For example, the tenant acquisition module 100 is specifically used to: acquire the tenant's application payment data; and generate tenant management information based on the application payment data.

[0086] For example, a role-sharing-based access control system also includes:

[0087] The judgment module is used to determine whether the tenant role information is platform role information or paid role information; if the tenant role information is platform role information, a common permission set is configured; if the tenant role information is paid role information, a differential permission set is configured according to the type of paid role information.

[0088] For example, a role-sharing-based access control system also includes:

[0089] The custom module is used to generate a set of available permissions based on application service information; it also creates custom role information, which is used to split and reorganize the set of available permissions for different users.

[0090] It should be noted that the role-sharing-based access control system provided in this application embodiment is different from... Figures 1 to 3 The method embodiments shown correspond to each other, and will not be described again here to avoid repetition.

[0091] This application also provides an electronic device, please refer to [link to application]. Figure 5 , Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of this application. The electronic device may include a processor 510, a communication interface 520, a memory 530, and at least one communication bus 540. The communication bus 540 is used to enable direct communication between these components. In this embodiment, the communication interface 520 of the electronic device is used for signaling or data communication with other node devices. The processor 510 may be an integrated circuit chip with signal processing capabilities.

[0092] The processor 510 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or the processor 510 can be any conventional processor.

[0093] The memory 530 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The memory 530 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 510, the electronic device can perform the aforementioned operations. Figures 1 to 3The various steps involved in the method implementation examples.

[0094] Alternatively, the electronic device may also include a storage controller and an input / output unit.

[0095] The memory 530, storage controller, processor 510, peripheral interface, and input / output unit are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses 540. The processor 510 is used to execute executable modules stored in the memory 530, such as software function modules or computer programs included in electronic devices.

[0096] The input / output unit is used to provide users with the ability to create tasks and to set optional start periods or preset execution times for those tasks, thereby enabling user-server interaction. The input / output unit may be, but is not limited to, a mouse and keyboard.

[0097] Understandable. Figure 5 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown. Figure 5 The components shown can be implemented using hardware, software, or a combination thereof.

[0098] This application also provides a storage medium storing instructions. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described again here.

[0099] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0101] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0102] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0103] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0104] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0105] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A role-based sharing based permission management method, characterized by, include: Obtain tenant management information; Retrieve permission configuration data for the application permission set; Tenant role information is generated based on the tenant management information and the permission configuration data; Determine whether the tenant role information is platform role information or paid role information; If the tenant role information is platform role information, then configure a common permission set; If the tenant role information is paid role information, then configure a differentiated permission set according to the type of the paid role information; Application service information is generated based on the tenant role information, and the application service information includes one or more application permissions.

2. The role-based sharing permission management method of claim 1, wherein, The steps for obtaining tenant management information include: Obtain tenant's application payment data; Tenant management information is generated based on the application's payment data.

3. The role-based sharing permission management method of claim 1, wherein, The platform role information is uniformly maintained by the management backend, which configures the permission sets that each application grants to the enterprise for free and automatically grants them when the enterprise activates the service. The paid role information is maintained uniformly by the management backend. After clarifying the sales rules by combining market demand and product characteristics, services are created in the management backend and associated with paid function permissions.

4. The permission management method based on role sharing according to claim 1, characterized in that, After the step of generating application service information based on the tenant role information, the method further includes: Generate a set of available permissions based on application service information; Create custom role information, and use the custom role information to split and reorganize the available permission set. The custom role information is used to provide differentiated permission management for different users.

5. A role-sharing-based access control system, characterized in that, include: The tenant acquisition module is used to obtain tenant management information; The permission acquisition module is used to obtain the permission configuration data of the application permission set; The role module is used to generate tenant role information based on the tenant management information and the permission configuration data; The service module is used to generate application service information based on the tenant role information, wherein the application service information includes one or more application permissions; The role-sharing-based access control system also includes: The judgment module is used to determine whether the tenant role information is platform role information or paid role information; If the tenant role information is platform role information, then a common permission set is configured; if the tenant role information is paid role information, then a differentiated permission set is configured according to the type of paid role information.

6. The role-sharing-based access control system according to claim 5, characterized in that, The tenant acquisition module is specifically used for: Obtain tenant's application payment data; Tenant management information is generated based on the application's payment data.

7. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the role-sharing-based access control system method as described in any one of claims 1 to 4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the role-sharing-based access control system method as described in any one of claims 1 to 4.

Images