A method, system and device for managing permissions
Patent Information
- Application Number
- CN202211292956.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-10-21
- Publication Date
- 2026-10-30
- Estimated Expiration
- 2042-10-21
AI Technical Summary
[0003]SMB(Server Message Block，网络节点间的共享传输协议)是一种在文件系统中实现文件共享的常用协议，如果需要在Linux文件系统上实现基于SMB协议的文件共享，需要Linux系统的访问权限的类型也是完整和具体的，现有技术的做法是把NTFS系统的所有类型的访问权限向Linux文件系统映射，但是这种映射会存在一部分NTFS的权限无法映射至Linux文件系统的情况，会最终导致Linux文件系统的权限并不够完整和具体，这种权限映射无法满足对于文件系统的访问权限的精确控制
[0034]本申请提供了一种权限管理方法、系统及装置。接收到扩展信息添加指令时，根据扩展信息添加指令获取权限扩展文件和扩展信息添加指令对应的文件系统中的待扩展文件，权限扩展文件包括所有类型的访问权限；将权限扩展文件添加至待扩展文件的文件扩展区域以使该待扩展文件具有所有类型的访问权限。本申请通过将权限扩展文件添加至文件系统中的待扩展文件，可以使得文件系统中的待扩展文件具有所有类型的访问权限，使得文件系统的权限并完整和具体，进而使得整个文件系统可以实现基于SMB协议的文件共享，实现对文件系统的访问权限的精确控制。
Smart Images
Figure CN115510469B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of management, and in particular to a method, system and apparatus for access control. Background Technology
[0002] An important function of a file system is access permission verification. Access permissions differ across different file systems. For example, the access permission types on the Linux file system are mainly read, write, and execute, while the access permission types on NTFS (New Technology File System, the file system in the Windows environment) are more complete and specific, such as read data, read attributes, read extended attributes, read permissions, write data, write attributes, write extended attributes, append data, etc.
[0003] SMB (Server Message Block) is a common protocol for file sharing in file systems. To implement file sharing based on the SMB protocol on a Linux file system, the types of access permissions of the Linux system need to be complete and specific. The current approach is to map all types of access permissions of the NTFS system to the Linux file system. However, this mapping will result in some NTFS permissions not being mapped to the Linux file system, which will ultimately lead to the Linux file system permissions not being complete and specific enough. This permission mapping cannot meet the requirements for precise control of file system access permissions. Summary of the Invention
[0004] The purpose of this invention is to provide a permission management method, system, and apparatus. This application adds permission extension files to files to be extended in the file system, enabling the files to be extended in the file system to have all types of access permissions, making the permissions of the file system complete and specific, thereby enabling the entire file system to realize file sharing based on the SMB protocol and achieving precise control over the access permissions of the file system.
[0005] To address the aforementioned technical problems, this invention provides a permission management method applied to a file system server, comprising:
[0006] When an extended information addition instruction is received, the permission extension file and the file to be extended in the file system corresponding to the extended information addition instruction are obtained according to the extended information addition instruction. The permission extension file includes all types of access permissions.
[0007] The permission extension file is added to the file extension area of the file to be extended so that the file to be extended has all types of access permissions.
[0008] Preferably, after adding the permission extension file to the file extension area of the file to be extended to give the file to be extended all types of access permissions, the method further includes:
[0009] Upon receiving a file access instruction, it is determined whether the file access instruction has access rights based on the file access instruction and the file expansion area of the file to be expanded corresponding to the file access instruction.
[0010] If so, allow the execution of the access action corresponding to the file access instruction;
[0011] If not, the control prompt module issues a message indicating that the file access instruction does not have the required access permission.
[0012] Preferably, determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction includes:
[0013] When the user sending the file access command is an anonymous user, it is determined that the file access command has read-only permissions;
[0014] Determine whether the file to be expanded has read permissions based on the file expansion area of the file to be expanded corresponding to the file access instruction;
[0015] If so, allow the anonymous user to read the file to be expanded;
[0016] If not, the control prompt module issues a message indicating that the file access instruction does not have the required access permission.
[0017] Preferably, determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction includes:
[0018] When the user sending the file access command is a regular user, it is determined that the file access command has read and write permissions, and the access level of the regular user is higher than that of the anonymous user.
[0019] When it is determined, based on the file extension area of the file to be extended corresponding to the file access instruction, that the file to be extended has both read and write permissions, the user is allowed to read and write the file to be extended.
[0020] When it is determined that the file to be expanded has only read permissions based on the file expansion area of the file to be expanded corresponding to the file access instruction, the user is allowed to read the file to be expanded.
[0021] If the file to be expanded is determined to have only write permissions based on the file expansion area of the file to be expanded corresponding to the file access instruction, then the user is allowed to write to the file to be expanded.
[0022] Preferably, determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction includes:
[0023] When the user sending the file access command is an administrator user, it is determined that the file access command has read, write, and modify permissions, and the execution of the access action corresponding to the file access command is allowed. The access level of the administrator user is higher than that of the ordinary user.
[0024] Preferably, the method further includes: when it is determined that the file to be expanded has write permissions and the received file access instruction is a data write instruction, creating a sub-file and / or subfolder corresponding to the file to be expanded so that the user can write data to the sub-file and / or the subfolder.
[0025] Preferably, after creating subfiles and / or subfolders corresponding to the file to be expanded so that the user can write data to the subfiles and / or subfolders, the method further includes:
[0026] Add the permission extension file of the file to be extended to the file extension area of the subfile and / or subfolder corresponding to the file to be extended.
[0027] Preferably, all types of access permissions include read permission, write permission, execute permission, delete permission, delete subfolder permission, change permission, and file ownership permission.
[0028] To address the aforementioned technical problems, the present invention also provides an access control system, comprising:
[0029] The permission extension file and file to be extended acquisition unit is used to, when receiving an extension information addition instruction, acquire the permission extension file and the file to be extended in the file system corresponding to the extension information addition instruction, according to the extension information addition instruction, wherein the permission extension file includes all types of access permissions;
[0030] The permission extension file adding unit is used to add the permission extension file to the file extension area of the file to be extended so that the file to be extended has all types of access permissions.
[0031] To address the aforementioned technical problems, the present invention also provides an access control device, comprising:
[0032] Memory, used to store computer programs;
[0033] A processor for executing the computer program to implement the steps of the above-described permission management method.
[0034] This application provides a permission management method, system, and apparatus. Upon receiving an instruction to add extended information, the method retrieves a permission extension file and the file to be extended in the file system corresponding to the instruction, wherein the permission extension file includes all types of access permissions. The permission extension file is then added to the file extension area of the file to be extended, thereby granting the file to all types of access permissions. By adding the permission extension file to the file to be extended in the file system, this application enables the file to have all types of access permissions, making the file system permissions complete and specific. This, in turn, allows the entire file system to achieve file sharing based on the SMB protocol, enabling precise control over file system access permissions. Attached Figure Description
[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the prior art and embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0036] Figure 1 A flowchart of a permission management method provided by the present invention;
[0037] Figure 2 A schematic diagram of the structure of a permission management system provided by the present invention;
[0038] Figure 3 This is a schematic diagram of the structure of a permission management device provided by the present invention. Detailed Implementation
[0039] The core of this invention is to provide a permission management method, system, and apparatus. This application adds permission extension files to files to be extended in the file system, enabling the files to be extended in the file system to have all types of access permissions, making the permissions of the file system complete and specific, thereby enabling the entire file system to realize file sharing based on the SMB protocol and achieving precise control over the access permissions of the file system.
[0040] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0041] Please refer to Figure 1 , Figure 1 A flowchart illustrating a permission management method provided by the present invention. This method is applied to a file system server and includes:
[0042] S11: When receiving an extended information addition instruction, obtain the permission extension file and the file to be extended in the file system corresponding to the extended information addition instruction, according to the extended information addition instruction. The permission extension file includes all types of access permissions.
[0043] When a file system needs to implement file sharing, it requires specific and complete access permissions for different types. This solution can add permission extension files to the file system when it receives an instruction to add extension information. Specifically, the extension files are added to a specific file in the file system that needs to be extended. After the extension files are added to the file, the entire file system will have different types of access permissions, thus improving the reliability of the solution.
[0044] The permission extension file includes all types of access permissions. The permission extension file can be adjusted according to actual usage. It is a pre-built file. When new access permissions are generated, they can be added to the permission extension file to expand the permission extension file and improve the comprehensiveness of the solution.
[0045] S12: Add the permissions extension file to the file extension area of the file to be extended so that the file to be extended has all types of access permissions.
[0046] The next step is to add the permission extension file to the file extension area of the file to be extended. After adding the permission extension file to the file extension area, the file system can have all types of access permissions, enabling the file system to achieve file sharing and improving the reliability and feasibility of the solution.
[0047] It should be noted that the file extension area is the annotation area of the file to be extended. Tags for the file to be extended can be added to this area. After the tag is added, the file to be extended will have the permissions corresponding to that tag. The added permissions extension file is added to the file extension area of the file to be extended in the form of extension fields, so that the file to be extended can be added normally, which improves the reliability and feasibility of the solution.
[0048] In summary, this application provides a permission management method. Upon receiving an instruction to add extended information, the method retrieves a permission extension file and the file to be extended in the file system corresponding to the instruction, wherein the permission extension file includes all types of access permissions. The permission extension file is then added to the file extension area of the file to be extended, thereby granting the file to all types of access permissions. By adding the permission extension file to the file to be extended in the file system, this application enables the file to have all types of access permissions, making the file system permissions complete and specific. This, in turn, allows the entire file system to achieve file sharing based on the SMB protocol, enabling precise control over file system access permissions.
[0049] Based on the above embodiments:
[0050] As a preferred embodiment, after adding the permission extension file to the file extension area of the file to be extended to give the file to be extended all types of access permissions, the method further includes:
[0051] Upon receiving a file access instruction, determine whether the file access instruction has the necessary permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction.
[0052] If so, allow the execution of the access action corresponding to the file access instruction;
[0053] If not, the control prompt module issues a message indicating that the file access command does not have the required access rights.
[0054] After the permission extension file is added to the file to be extended, when a file access instruction is received, it is determined whether the file access instruction and the corresponding file extension area of the file to be extended can correspond. In other words, it is determined whether the file access instruction has access permissions. If they can correspond, it means that the file access instruction has access permissions, and the corresponding action for the file access instruction is executed. If the file access instruction does not correspond to the file to be extended, it means that the file access instruction does not have access permissions, and the user's client is provided with information that access permissions are not granted, thus improving the user experience.
[0055] As a preferred embodiment, determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction includes:
[0056] When the user sending the file access command is an anonymous user, it is determined that the file access command has read-only permissions;
[0057] Determine whether the file to be expanded has read permissions based on the file expansion area of the file to be expanded corresponding to the file access instruction;
[0058] If so, allow anonymous users to read the file to be expanded;
[0059] If not, the control prompt module issues a message indicating that the file access command does not have the required access rights.
[0060] If the user sending the file access command is an anonymous user, it means that the user only has read permission for the file. Therefore, it is determined whether the file to be expanded corresponding to the file access command has read permission. If read permission is granted, the user can execute the read operation on the file to be expanded. If the file does not have read permission, the prompting module will issue a prompt message to inform the user that they do not have access permission, thus improving the feasibility of the solution.
[0061] As a preferred embodiment, determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction includes:
[0062] When the user sending the file access command is a regular user, it is determined that the file access command has read and write permissions, and the access level of a regular user is higher than that of an anonymous user.
[0063] When it is determined from the file extension area of the file to be extended corresponding to the file access instruction that the file to be extended has both read and write permissions, the user is allowed to read and write the file to be extended.
[0064] When it is determined that the file to be expanded has only read permissions based on the file expansion area of the file to be expanded corresponding to the file access instruction, the user is allowed to read the file to be expanded.
[0065] If the file extension region of the file to be extended is determined to have only write permissions based on the file access instruction, then the user is allowed to write to the file to be extended.
[0066] If it is determined that the user sending the file access command is a regular user, then the regular user's access level is higher than that of the anonymous user, indicating that the regular user has read and write permissions for the file. At this point, it is determined whether the file to be expanded corresponding to the file access command has the above two permissions. If the file to be expanded has read permissions, then the user is allowed to read the file to be expanded. If the file to be expanded has write permissions, then the user is allowed to write data to the file to be expanded. If the file to be expanded can be read and written simultaneously, then the user is allowed to read and write data to the file to be expanded. The entire judgment process is automated, improving the automation level of the solution.
[0067] As a preferred embodiment, determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction includes:
[0068] When the user sending the file access command is an administrator user, the file access command is confirmed to have read, write, and modify permissions, and the execution of the access action corresponding to the file access command is allowed. The access level of the administrator user is higher than that of ordinary users.
[0069] When the user sending the file access command is an administrator user, that user has the highest level of privileges, allowing them to read or write data to the file at will. They also have the ability to change the permissions of other users. Administrator users have higher privileges than ordinary users, which improves the processing efficiency of the solution.
[0070] It should be noted that the identification information of ordinary users, anonymous users, and administrator users can be pre-stored on the server side. Then, when a file access command is received, the identification information of the user who sent the command can be checked to determine the user's level, thus improving the reliability of the solution.
[0071] Specifically, first, in the SMB database on the server, add complete identification information for the Administrators (corresponding to administrator users), Authenticated Users (corresponding to ordinary users), and Users (corresponding to anonymous users) user groups. Add the SMB users that need to share, and set the relationship between the SMB user groups and users. On the Linux server, enter the ICFS cluster directory and create a shared directory as root. On the shared directory, use the ICFS cluster-specific setxattr command to set extended fields in Windows ACL format for the shared directory. The keyword for the extended fields is SMB_NTFS_ACL. After adding these, the file to be extended will have all types of access permissions, improving the reliability of the solution.
[0072] As a preferred embodiment, the method further includes: when it is determined that the file to be expanded has write permissions and the received file access instruction is a data write instruction, creating a sub-file and / or subfolder corresponding to the file to be expanded so that the user can write data to the sub-file and / or subfolder.
[0073] Once it is determined that the user can write data to the file to be expanded, a corresponding sub-file and / or subfolder is created on the server side. After the sub-file and / or subfolder is created, the user can easily write data to the sub-file and / or subfolder, so as to execute the user's normal data writing process and improve the reliability of the solution.
[0074] Specifically, from the client's perspective, a network drive is mapped using a valid shared directory and an SMB user. Subfolders and files are created on the Windows client. After receiving the client's creation request, the server reads the file extension area of the file to be extended in the current shared directory and verifies the identity of the currently accessing user. If a subfolder is created, the server verifies whether the shared directory has permissions to add the subfolder; if a subfile is created, the server verifies whether the shared directory has permissions to add the file.
[0075] Specifically, the process of a client accessing a newly created subfolder and file is as follows: the client sends an access request message, including the desired access permission mask in the request message. After receiving the access request, the server performs permission verification as the accessing user. The server reads the extended permission information of the subfolder or file and matches permissions according to the user's user group. Since the current implementation uses allow permissions, according to the principle of permission accumulation, when the sum of all matched permissions exceeds the user's desired permissions for accessing the file, the access request is allowed, thus enabling the user to access the file to be expanded, improving the reliability of the solution.
[0076] In addition to granting user access, the system also grants the user additional permissions in the current file that are different from the permissions corresponding to their file access command. This is called permission accumulation, which grants the user the permissions corresponding to the command and the permissions in the current file. This allows the system to grant the user an additional permission based on the settings of the file to be expanded. This allows users to set their own permissions, improving the flexibility of the solution and the user experience.
[0077] As a preferred embodiment, after creating subfiles and / or subfolders corresponding to the file to be expanded so that the user can write data to the subfiles and / or subfolders, the method further includes:
[0078] Add the permission extension file for the file to be extended to the file extension area of the subfiles and / or subfolders corresponding to the file to be extended.
[0079] Newly created subfiles or subfolders can inherit the permissions contained in the permission extension file of the original file. After the new subfile or subfolder is generated, the original permission extension file can be added to the file extension area of the subfile or subfolder so that subsequent user data writing or file access can be executed normally, improving user experience and system reliability.
[0080] Specifically, the permission handling for subfolders and files includes reading the original directory, i.e., all permission information of the original file to be expanded; traversing each permission record, determining its inheritance type, and processing according to the following rules: If a new subfolder is created and the original directory's inheritance type is "apply to subfolder," then add a permission list with the inheritance type "apply to subfolder" to ensure that the currently effective permissions can continue to be passed down to the next level of folders; if a new subfolder is created and the original directory's inheritance type is "apply to subfile," then add a permission list with the inheritance type "apply to subfile" and "inherit only" to ensure that the currently effective permissions can continue to be passed down to the next level of files; if a new subfile is created and the original directory's inheritance type is "apply to subfolder," then ignore the inheritance processing of this permission; if a new subfile is created and the original directory's inheritance type is "apply to subfile," then only this permission needs to be inherited.
[0081] The permissions extension file contains a detailed list of ACL permissions. It sets permissions for the Administrators group: permission type: Allow, permission value: a combination of all permission bits, inheritance type: applies to this folder, subfolders, and files; it sets permissions for the Authenticated Users group: permission type: Allow, permission value: a combination of modify permission bits (including read, write, and execute), inheritance type: applies to this folder, subfolders, and files; it sets permissions for the Users group: permission type: Allow, permission value: a combination of read and execute permission bits, inheritance type: applies to this folder, subfolders, and files. Inheritance types include: subfolder inheritance: newly created subfolders in the current directory inherit the permissions of the current directory, and these permissions also apply to the current directory; subfile inheritance: newly created subfiles in the current directory inherit the permissions of the current directory, and these permissions also apply to the current directory; inheritance only: newly created subfolders in the current directory inherit the permissions of the current directory, but these permissions do not apply to the current directory. The entire permissions extension file is more specific and complete, improving the reliability of the solution.
[0082] As a preferred embodiment, all types of access permissions include read permission, write permission, execute permission, delete permission, delete subfolder permission, change permission, and file ownership permission.
[0083] The pre-defined access permissions are numerous, comprehensive, and specific. Based on the types of file processing permissions in Windows, the ICFS file system defines the following access permissions: Read permissions: including read attribute, read extended attribute, read data, and read permission; Write permissions: including write attribute, write extended attribute, write data, and append data; Execute permissions: corresponding to the execute permission bit; Delete permissions: used to control whether the file itself can be deleted; Delete subfolder permissions: used to control whether a directory can delete read-only subfolders and files within it; Change permissions: used to control whether file modification permissions are allowed; Take ownership: used to control changing the file owner to the current user. Specifically, administrator users, with sufficient permissions, can arbitrarily change the file owner. This comprehensive provision of all types of access permissions enhances the reliability and completeness of the solution.
[0084] Please refer to Figure 2 , Figure 2 This is a schematic diagram of the structure of a permission management system provided by the present invention.
[0085] To address the aforementioned technical problems, the present invention also provides an access control system, comprising:
[0086] The permission extension file and file to be extended acquisition unit 10 is used to acquire the permission extension file and the file to be extended in the file system corresponding to the extension information addition instruction when receiving the extension information addition instruction. The permission extension file includes all types of access permissions.
[0087] The permission extension file adding unit 11 is used to add the permission extension file to the file extension area of the file to be extended so that the file to be extended has all types of access permissions.
[0088] After adding the permission extension file unit, it also includes:
[0089] The first judgment unit is used to determine whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction when a file access instruction is received. If yes, the execution permission unit is triggered; otherwise, the first prompt unit is triggered.
[0090] The execution permission unit is used to allow the execution of the access action corresponding to the file access instruction;
[0091] The first prompting unit is used to control the prompting module to issue a message indicating that the file access permission is not available.
[0092] The judgment unit includes:
[0093] The read-only permission determination unit is used to determine whether the file access instruction has read-only permission when the user sending the file access instruction is an anonymous user.
[0094] The second judgment unit is used to determine whether the file to be expanded has read permission based on the file expansion area of the file to be expanded corresponding to the file access instruction. If yes, it triggers the read permission unit; if no, it triggers the second prompt unit.
[0095] The read permission unit is used to allow anonymous users to read the file to be expanded;
[0096] The second prompting unit is used to control the prompting module to issue a message indicating that the file access command does not have the required access permission.
[0097] The judgment unit includes:
[0098] The read and write permission determination unit is used to determine whether the file access instruction has read and write permissions when the user sending the file access instruction is a regular user. The access level of a regular user is higher than that of an anonymous user.
[0099] The first permission unit is used to allow the user to read and write the file to be expanded when the file expansion area of the file to be expanded is determined according to the file expansion area of the file to be expanded corresponding to the file access instruction.
[0100] The second permission unit is used to allow the user to read the file to be expanded when the file expansion area of the file to be expanded is determined according to the file expansion area of the file to be expanded corresponding to the file access instruction;
[0101] The third permission unit is used to allow the user to write to the file to be expanded when it is determined from the file expansion area of the file to be expanded corresponding to the file access instruction that the file to be expanded only has write permission.
[0102] The judgment unit includes:
[0103] When the user sending the file access command is an administrator user, the file access command is confirmed to have read, write, and modify permissions, and the execution of the access action corresponding to the file access command is allowed. The access level of the administrator user is higher than that of ordinary users.
[0104] The permission management system also includes: when it is determined that the file to be expanded has write permissions and the received file access instruction is a data write instruction, creating a sub-file and / or subfolder corresponding to the file to be expanded so that the user can write data to the sub-file and / or subfolder.
[0105] The access control system also includes:
[0106] Add the permission extension file for the file to be extended to the file extension area of the subfiles and / or subfolders corresponding to the file to be extended.
[0107] All types of access permissions include read permission, write permission, execute permission, delete permission, delete subfolder permission, change permission, and file ownership permission.
[0108] For an introduction to the permission management system provided in this solution, please refer to the above-described embodiment of the permission management method; it will not be repeated here.
[0109] Please refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of a permission management device provided by the present invention.
[0110] To address the aforementioned technical problems, the present invention also provides an access control device, comprising:
[0111] Memory 1 is used to store computer programs;
[0112] Processor 2 is used to execute computer programs to implement the steps of the above-described permission management method.
[0113] For a description of the access control device provided in this solution, please refer to the embodiments of the access control method described above; it will not be repeated here.
[0114] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0115] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0116] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for managing access permissions, characterized in that, Server-side applications for file systems include: When an extended information addition instruction is received, the permission extension file and the file to be extended in the file system corresponding to the extended information addition instruction are obtained according to the extended information addition instruction. The permission extension file includes all types of access permissions. Add the permission extension file to the file extension area of the file to be extended so that the file to be extended has all types of access permissions; Specifically, by adding the permission extension file to the file to be extended in the file system corresponding to the extension information addition instruction, the file to be extended is given all types of access permissions; After adding the permission extension file to the file extension area of the file to be extended to give the file to be extended all types of access permissions, the process further includes: Upon receiving a file access instruction, determine whether the file access instruction has access permissions based on the file access instruction and the file expansion area of the file to be expanded corresponding to the file access instruction. If so, allow the execution of the access action corresponding to the file access instruction; If not, the control prompt module issues a message indicating that the file access instruction does not have the required access rights; It also includes: when it is determined that the file to be expanded has write permissions and the received file access instruction is a data write instruction, creating a sub-file and / or subfolder corresponding to the file to be expanded so that the user can write data to the sub-file and / or the subfolder; After creating subfiles and / or subfolders corresponding to the file to be expanded so that the user can write data to the subfiles and / or subfolders, the method further includes: Add the permission extension file of the file to be extended to the file extension area of the subfile and / or subfolder corresponding to the file to be extended; The permission handling for subfolders and files includes reading all permission information of the original file to be expanded; iterating through each permission record, determining its inheritance type, and processing it according to the following rules: if a new subfolder is created and the original directory's inheritance type is "apply to subfolder", then add a permission list with the inheritance type "apply to subfolder"; if a new subfolder is created and the original directory's inheritance type is "apply to subfile", then add a permission list with the inheritance type "apply to subfile" and only inheritance; if a new subfile is created and the original directory's inheritance type is "apply to subfolder", then ignore the inheritance processing of that permission; if a new subfile is created and the original directory's inheritance type is "apply to subfile", then inherit that permission.
2. The access control method as described in claim 1, characterized in that, Determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be expanded corresponding to the file access instruction includes: When the user sending the file access command is an anonymous user, it is determined that the file access command has read-only permissions; Determine whether the file to be expanded has read permissions based on the file expansion area of the file to be expanded corresponding to the file access instruction; If so, allow the anonymous user to read the file to be expanded; If not, the control prompt module issues a message indicating that the file access instruction does not have the required access permission.
3. The access control method as described in claim 2, characterized in that, Determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be expanded corresponding to the file access instruction includes: When the user sending the file access command is a regular user, it is determined that the file access command has read and write permissions, and the access level of the regular user is higher than that of the anonymous user. When it is determined, based on the file extension area of the file to be extended corresponding to the file access instruction, that the file to be extended has both read and write permissions, the user is allowed to read and write the file to be extended. When it is determined that the file to be expanded has only read permissions based on the file expansion area of the file to be expanded corresponding to the file access instruction, the user is allowed to read the file to be expanded. If the file to be expanded is determined to have only write permissions based on the file expansion area of the file to be expanded corresponding to the file access instruction, then the user is allowed to write to the file to be expanded.
4. The access control method as described in claim 3, characterized in that, Determining whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be expanded corresponding to the file access instruction includes: When the user sending the file access command is an administrator user, it is determined that the file access command has read, write, and modify permissions, and the execution of the access action corresponding to the file access command is allowed. The access level of the administrator user is higher than that of the ordinary user.
5. The access control method as described in any one of claims 1 to 4, characterized in that, All types of access permissions include read permission, write permission, execute permission, delete permission, delete subfolder permission, change permission, and file ownership permission.
6. A permission management system, characterized in that, include: The permission extension file and file to be extended acquisition unit is used to, when receiving an extension information addition instruction, acquire the permission extension file and the file to be extended in the file system corresponding to the extension information addition instruction, wherein the permission extension file includes all types of access permissions; The permission extension file adding unit is used to add the permission extension file to the file extension area of the file to be extended so that the file to be extended has all types of access permissions; Specifically, by adding the permission extension file to the file to be extended in the file system corresponding to the extension information addition instruction, the file to be extended is given all types of access permissions; Also includes: The first judgment unit is used to determine whether the file access instruction has access permissions based on the file access instruction and the file extension area of the file to be extended corresponding to the file access instruction when a file access instruction is received. If yes, the execution permission unit is triggered; otherwise, the first prompt unit is triggered. The execution permission unit is used to allow the execution of the access action corresponding to the file access instruction; The first prompting unit is used to control the prompting module to issue a message indicating that the file access command does not have permission. It also includes: when it is determined that the file to be expanded has write permissions and the received file access instruction is a data write instruction, creating a sub-file and / or subfolder corresponding to the file to be expanded so that the user can write data to the sub-file and / or the subfolder; After creating subfiles and / or subfolders corresponding to the file to be expanded so that the user can write data to the subfiles and / or subfolders, the method further includes: Add the permission extension file of the file to be extended to the file extension area of the subfile and / or subfolder corresponding to the file to be extended; The permission handling for subfolders and files includes reading all permission information of the original file to be expanded; iterating through each permission record, determining its inheritance type, and processing it according to the following rules: if a new subfolder is created and the original directory's inheritance type is "apply to subfolder", then add a permission list with the inheritance type "apply to subfolder"; if a new subfolder is created and the original directory's inheritance type is "apply to subfile", then add a permission list with the inheritance type "apply to subfile" and only inheritance; if a new subfile is created and the original directory's inheritance type is "apply to subfolder", then ignore the inheritance processing of that permission; if a new subfile is created and the original directory's inheritance type is "apply to subfile", then inherit that permission.
7. A permission management device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the access control method according to any one of claims 1 to 5.