Method, apparatus and device for permission control and storage medium

Abstract

The application provides a permission control method, device, equipment and storage medium. The method comprises the following steps: obtaining a proxy permission setting request sent by an entity user terminal; the proxy permission setting request comprises a personal user identifier and at least one permission set corresponding identifier; the permission set comprises at least one permission; generating a proxy identity identifier for the personal user identifier according to the proxy permission setting request and storing the proxy identity identifier and the personal user identifier in a database in association; determining the permissions in the at least one permission set corresponding identifier as the proxy identity identifier corresponding permissions according to the proxy permission setting request, so as to determine the proxy identity identifier corresponding permissions as the personal user corresponding permissions according to the association. The permissions of the proxy identity are determined by the permission set, so that the permissions of the proxy identity are quickly and flexibly set. The permissions of the personal user are determined by the proxy identity granted to the personal user, so that the permissions of the personal user are quickly and flexibly set.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and in particular to a permission control method and device, equipment and a storage medium. BACKGROUND

[0002] The common permission management method currently includes role-based permission control (RBAC for short), which indirectly gives users permissions by associating users with roles and associating permissions with roles.

[0003] However, the role-based permission control RBAC is limited in authorization flexibility and maintainability. If the existing role permissions do not meet the permission requirements of a user, a new role must be set for the user and the corresponding configuration permissions of the role must be configured one by one, which is difficult to maintain and cannot quickly and flexibly configure permissions according to the differences in permission requirements of each user. SUMMARY

[0004] The present application provides a permission control method, device, equipment and storage medium to solve the problem.

[0005] In a first aspect, the present application provides a permission control method, comprising:

[0006] Obtaining a proxy permission setting request sent by an entity user terminal; the proxy permission setting request includes a personal user identifier and at least one permission set identifier; the permission set includes at least one permission;

[0007] Generating a proxy identity identifier for the personal user identifier according to the proxy permission setting request and storing the proxy identity identifier and the personal user identifier in a database in association;

[0008] Determining the permissions in the at least one permission set identifier as the proxy identity identifier corresponding permissions according to the proxy permission setting request, so as to determine the proxy identity identifier corresponding permissions as the personal user corresponding permissions according to the association between the proxy identity identifier and the personal user identifier.

[0009] Optionally, the permissions included in the permission set are pre-set, comprising:

[0010] Obtaining a permission set generation request sent through a permission set setting interface in the entity user terminal, and determining at least one selected permission in the permission set setting interface; the at least one selected permission is in the entity user identifier corresponding permissions;

[0011] Generating a permission set identifier and determining the at least one selected permission as the permissions included in the permission set.

[0012] Optionally, after determining the permissions in the at least one set of permission corresponding identifiers as the permissions corresponding to the agent identity identifier according to the agent permission setting request, the method further comprises:

[0013] obtaining an agent permission change request sent through the permission management interface in the entity user terminal; the agent permission change request comprises an agent identity identifier and corresponding permission change information;

[0014] changing the permissions corresponding to the agent identity identifier according to the corresponding permission change information using an access control list.

[0015] Optionally, the method of the first aspect further comprises:

[0016] obtaining an entity user permission change request sent through the permission management interface in the entity user terminal; the entity user permission change request comprises an entity user identifier and corresponding permission change information;

[0017] changing the permissions corresponding to the entity user identifier according to the corresponding permission change information using an access control list.

[0018] Optionally, after determining the permissions in the at least one set of permission corresponding identifiers as the permissions corresponding to the agent identity identifier according to the agent permission setting request, the method further comprises:

[0019] obtaining an access request sent by a personal user terminal;

[0020] if it is determined that the agent identity identifier is not included in the access request, performing user-level authentication on the access request according to the personal general basic permissions;

[0021] if it is determined that the user-level authentication is passed, determining to perform an access operation according to the access request.

[0022] Optionally, after obtaining the access request sent by the personal user terminal, the method further comprises:

[0023] if it is determined that the agent identity identifier is included in the access request, determining the permissions corresponding to the agent identity identifier according to an access control list, and performing agent-level authentication on the access request according to the permissions corresponding to the agent identity identifier;

[0024] if it is determined that the agent-level authentication is passed, determining to perform an access operation according to the access request.

[0025] Optionally, the agent permission setting request further comprises an entity user identifier; and the agent identity identifier and the personal user identifier are associated and stored in a database, comprising:

[0026] storing the entity user identifier in the agent permission setting request and the agent identity identifier in the database in association;

[0027] The access request includes authentication mode information; and before performing proxy-level authentication on the access request according to the corresponding permissions of the proxy identity identifier, the method further includes:

[0028] If it is determined according to the authentication mode information that the access request is to be authenticated twice, determining an entity user identifier associated with the proxy identity identifier;

[0029] Determining the corresponding permissions of the entity user according to the access control list and the entity user identifier, and performing root-level authentication on the access request according to the corresponding permissions of the entity user;

[0030] If it is determined that the root-level authentication passes, performing proxy-level authentication on the access request according to the corresponding permissions of the proxy identity identifier.

[0031] In a second aspect, the present application provides a permission control device, including:

[0032] An obtaining module, configured to obtain a proxy permission setting request sent by an entity user terminal; the proxy permission setting request includes a personal user identifier and at least one permission set corresponding identifier; the permission set includes at least one permission;

[0033] A storage module, configured to generate a proxy identity identifier for the personal user identifier according to the proxy permission setting request, and store the proxy identity identifier and the personal user identifier in a database in association;

[0034] A determining module, configured to determine the permissions in the at least one permission set corresponding identifier as the corresponding permissions of the proxy identity identifier according to the proxy permission setting request, and determine the corresponding permissions of the proxy identity identifier as the corresponding permissions of the personal user according to the association between the proxy identity identifier and the personal user identifier.

[0035] In a third aspect, the present application provides an electronic device, including a processor, and a memory and a transceiver connected in communication with the processor;

[0036] The memory stores computer execution instructions; and the transceiver is configured to receive and transmit data;

[0037] The processor executes the computer execution instructions stored in the memory to implement the permission control method of any one of the above aspects.

[0038] In a fourth aspect, the present application provides a computer readable storage medium, the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the permission control method of any one of the above aspects.

[0039] Fifthly, this application provides a computer program product including computer execution instructions that, when executed by a processor, implement the access control method described in any of the preceding aspects.

[0040] The permission control method, apparatus, device, and storage medium provided in this application acquire a proxy permission setting request sent by a physical user terminal. The proxy permission setting request includes: a personal user identifier and at least one permission set corresponding identifier; the permission set includes at least one permission. A proxy identity identifier is generated for the personal user identifier according to the proxy permission setting request, and the proxy identity identifier is associated with the personal user identifier and stored in a database. The permissions in at least one permission set corresponding identifier are determined as the permissions corresponding to the proxy identity identifier according to the proxy permission setting request, so that the permissions corresponding to the proxy identity identifier are determined as the permissions corresponding to the personal user based on the association relationship between the proxy identity identifier and the personal user identifier. By using permission sets to determine the permissions of the proxy identity, the permissions of the proxy identity are quickly and flexibly set; by granting the proxy identity to the personal user to determine the personal user's permissions, the permissions of the personal user are quickly and flexibly set. Attached Figure Description

[0041] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0042] Figure 1 This is a schematic diagram of a network architecture according to this application;

[0043] Figure 2 This is a flowchart of the access control method provided in Embodiment 1 of this application;

[0044] Figure 3 This is a flowchart of an access control method provided in Embodiment 4 of this application;

[0045] Figure 4 This is a schematic diagram of the access control device provided in Embodiment 5 of this application;

[0046] Figure 5 This is a schematic diagram of the structure of the electronic device provided in Embodiment Six of this application.

[0047] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0048] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. The following description refers to the accompanying drawings.

[0049] In the drawings, like reference numerals refer to like elements throughout the several views. The embodiments described in the following examples are not meant to be limiting of all embodiments that would be consistent with the present application. Rather, they are simply what are presently considered to be the most exemplary embodiments. It is contemplated that the application as claimed with respect to any one or more of the exemplary embodiments will include some, all, or none of the characteristics of the exemplary embodiments described in the following examples.

[0050] Examples of apparatuses and methods consistent with some aspects of the present application are described in detail in the claims.

[0051] The terms "first", "second", and the like, are used only to describe different instances of an element and do not imply a relative importance of the elements. In the following description, the meaning of "a plurality" is two or more, unless explicitly specified otherwise.

[0052] 0First, the prior art related to the present application is described in detail and analyzed.

[0053] Since the role-based permission control RBAC is limited in authorization flexibility and maintainability, if the existing role permission does not meet the permission requirements of a user, directly changing the role permission will change the user permission of the role synchronously, which will cause permission confusion, so the maintenance of the permission is more difficult, and the permission configuration cannot be quickly and flexibly configured according to the differences in the permission requirements of each user.

[0054] 5The inventor found in research that the permission set can be used to determine the permission of the agent identity, the permission of the agent identity can be quickly and flexibly set, the agent identity is granted to the individual user, the permission of the individual user can be determined through the agent identity, and the permission of the individual user can be quickly and flexibly set

[0055] Therefore, the present application provides a permission control method, after obtaining an agent permission setting request sent by an entity user terminal, an agent identity is generated for an individual user identifier according to the agent permission setting request, the agent identity identifier is associated and stored in a database with the individual user identifier, the permissions in the identifier corresponding to at least one permission set are determined as the permissions corresponding to the agent identity identifier according to the association relationship between the agent identity identifier and the individual user identifier, and the permissions corresponding to the agent identity identifier are determined as the permissions corresponding to the individual user.

[0056] Therefore, the present application provides a permission control method, after obtaining an agent permission setting request sent by an entity user terminal, an agent identity is generated for an individual user identifier according to the agent permission setting request, the agent identity identifier is associated and stored in a database with the individual user identifier, the permissions in the identifier corresponding to at least one permission set are determined as the permissions corresponding to the agent identity identifier according to the association relationship between the agent identity identifier and the individual user identifier, and the permissions corresponding to the agent identity identifier are determined as the permissions corresponding to the individual user.

[0057] Therefore, the present application provides a permission control method, after obtaining an agent permission setting request sent by an entity user terminal, an agent identity is generated for an individual user identifier according to the agent permission setting request, the agent identity identifier is associated and stored in a database with the individual user identifier, the permissions in the identifier corresponding to at least one permission set are determined as the permissions corresponding to the agent identity identifier according to the association relationship between the agent identity identifier and the individual user identifier, and the permissions corresponding to the agent identity identifier are determined as the permissions corresponding to the individual user.

[0058] Figure 1 A network architecture diagram of the present application is shown in FIG. 1, which includes an individual user terminal 1, an entity user terminal 2, and an electronic device 3. The individual user can perform an agent identity application operation in the individual user terminal 1, so that Figure 1

[0059] ​The personal user terminal 1 sends an agent identity application request to the entity user terminal 2; the entity user terminal 2, after receiving the agent 5 identity application request, if it is determined to establish an agent identity for the personal user identifier, can send an agent

[0060] permission setting request to the electronic device 3; the electronic device 3, after receiving the agent permission setting request, can execute a permission control method to determine the permissions of the agent identity and grant the agent identity to the personal user, so as to determine the permissions corresponding to the agent identity identifier as the permissions corresponding to the personal user.

[0061] In the technical solution of the present application, the collection, storage, use, processing, transmission, provision and disclosure of financial data or user data and other information comply with relevant laws and regulations and do not violate public order and good customs.

[0062] The technical solution of the present application and how the technical solution of the present application solves the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0063] Embodiment one

[0064] Figure 2 The permission control method flowchart provided for the first embodiment of the present application provides a permission control method for the problem addressed by the present embodiment. The method in this embodiment is applied to a permission control device, which can be located in an electronic device. The electronic device can be a digital computer in various forms, such as a laptop computer, a desktop computer, a workstation, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers.

[0065] As shown in Figure 2 , the specific steps of the method are as follows:

[0066] Step S101, obtaining an agent permission setting request sent by an entity user terminal.

[0067] Step S102, generating an agent identity identifier for a personal user identifier according to the agent permission setting request and storing the agent identity identifier and the personal user identifier in association in a database.

[0068] Step S103, determining the permissions in the at least one permission set corresponding identifier as the permissions corresponding to the agent identity identifier according to the agent permission setting request, so as to determine the permissions corresponding to the agent identity identifier as the permissions corresponding to the personal user according to the association relationship between the agent identity identifier and the personal user identifier.

[0069] In the embodiments of the present application, the permission corresponding to the proxy identity identifier is the permission of the proxy identity.

[0070] In the embodiments of the present application, the entity user can be a manager of the accessed resource, and the individual user can be an accesser of the accessed resource. For example, the entity user can be an enterprise user or an entity-level user with unique identification information, and the individual user can be a specific employee of the enterprise or an individual customer.

[0071] In the embodiments of the present application, the entity user and the individual user are not associated through upper and lower levels or affiliation, and the permission constraint on the individual user is realized by granting the proxy identity to the individual user and then authorizing the user through the proxy identity.

[0072] The proxy permission setting request includes: an individual user identifier, and at least one permission set corresponding identifier; and the permission set includes at least one permission.

[0073] The embodiments of the present application do not limit the manner in which the entity user terminal sends the proxy permission setting request. For example, the individual user can apply for a proxy identity and corresponding permissions to the enterprise user, and the entity user terminal can send a proxy permission setting request to the electronic device in response to a determination operation of the enterprise user on the proxy identity application request. Alternatively, the proxy identity application request can include a proxy identity use description, so that the entity user can determine the permissions that need to be granted to the proxy identity through the proxy identity use description, and thus determine the at least one permission set corresponding identifier in the proxy permission setting request.

[0074] For example, the entity user terminal can also send a proxy permission setting request to the electronic device in response to a proxy identity granting operation of the entity user

[0075] The proxy permission setting request; the entity user can select at least one permission set corresponding identifier to generate a proxy identity corresponding to the individual user, and determine the permissions in the permission set as the permissions of the proxy identity, and after the entity user triggers a determination control, the

[0076] The entity user terminal can send the proxy permission setting request including the individual user identifier and the at least one permission set corresponding identifier to the electronic device.

[0077] In the embodiments of the present application, a proxy identity identifier is generated for the individual user identifier according to the proxy permission setting request, and the proxy

[0078] identity identifier and the individual user identifier are stored in the database in association, so as to generate a proxy identity for the individual user identifier, and the individual user can use the proxy identity to access the resource with the permissions of the proxy identity.

[0079] In the embodiments of the present application, at least one permission set can be pre-set, and the entity user can select at least one permission set to make the electronic device determine the permissions in the permission set corresponding identifier as the permissions corresponding to the proxy identity identifier, so as to determine the permissions corresponding to the proxy identity identifier as the permissions corresponding to the personal user according to the association between the proxy identity identifier and the personal user identifier.

[0080] 5Optionally, the proxy permission setting request can further include: proxy identity usage description; so that the user can determine the proxy identity to be selected through the proxy identity usage description when needing to access the resource.

[0081]

[0082] The permission control method provided in the embodiments of the present application includes: obtaining a proxy permission setting request sent by an entity user terminal; the proxy permission setting request includes: a personal user identifier and at least one permission set corresponding identifier; the permission set includes at least one permission; generating a proxy identity identifier for the personal user identifier according to the proxy permission setting request and storing the proxy identity identifier and the personal user identifier in a database in association; determining the permissions in the at least one permission set corresponding identifier as the permissions corresponding to the proxy identity identifier according to the proxy permission setting request, so as to determine the permissions corresponding to the proxy identity identifier as the permissions corresponding to the personal user according to the association between the proxy identity identifier and the personal user identifier.

[0083] The permission control method provided in the embodiments of the present application includes: obtaining a proxy permission setting request sent by an entity user terminal; the proxy permission setting request includes: a personal user identifier and at least one permission set corresponding identifier; the permission set includes at least one permission; generating a proxy identity identifier for the personal user identifier according to the proxy permission setting request and storing the proxy identity identifier and the personal user identifier in a database in association; determining the permissions in the at least one permission set corresponding identifier as the permissions corresponding to the proxy identity identifier according to the proxy permission setting request, so as to determine the permissions corresponding to the proxy identity identifier as the permissions corresponding to the personal user according to the association between the proxy identity identifier and the personal user identifier.

[0084] 5Optionally, the proxy permission setting request can further include: proxy identity usage description; so that the user can determine the proxy identity to be selected through the proxy identity usage description when needing to access the resource.

[0085]

[0086] Specifically, the proxy level permission access control model can be pre-set as an identity recognition and access management (English: IAM) model, the permission control in the IAM model adopts an access control list (English: ACL); the IAM model is configured in json format according to the at least one permission set corresponding identifier and the proxy identity identifier; the access control list is configured according to the configured IAM model by using a parsing conversion strategy, so as to determine the permissions in the at least one permission set corresponding identifier as the permissions corresponding to the proxy identity identifier according to the proxy permission setting request.

[0087] Specifically, the proxy level permission access control model can be pre-set as an identity recognition and access management (English: IAM) model, the permission control in the IAM model adopts an access control list (English: ACL); the IAM model is configured in json format according to the at least one permission set corresponding identifier and the proxy identity identifier; the access control list is configured according to the configured IAM model by using a parsing conversion strategy, so as to determine the permissions in the at least one permission set corresponding identifier as the permissions corresponding to the proxy identity identifier according to the proxy permission setting request.

[0088] Specifically, the proxy level permission access control model can be pre-set as an identity recognition and access management (English: IAM) model, the permission control in the IAM model adopts an access control list (English: ACL); the IAM model is configured in json format according to the at least one permission set corresponding identifier and the proxy identity identifier; the access control list is configured according to the configured IAM model by using a parsing conversion strategy, so as to determine the permissions in the at least one permission set corresponding identifier as the permissions corresponding to the proxy identity identifier according to the proxy permission setting request.​​

[0089] Wherein, IAM can control user-based resource access, and enable single sign-on for user identity authentication. IAM can verify user access requests, and can grant or deny access to resources. ACL can control the resources that a subject (user or user group) can access by associating the subject and the permissions (containing operations and resources) into a list. Users include: individual users, entity users.

[0090] It should be understood that IAM can allow the right person or thing to access the right resource with the right permission. Wherein "person or thing" is called a subject, and "resource" is called an object. Traditional IAM generally includes the following parts, often referred to as "4A" or "5A": account, authentication, permission, application, and audit. In this application, the permission control adopts the access control list ACL. IAM can provide logical expression operations based on the subject, resource, and operation ternary ACL permission policy provided by ACL; it can also perform logical and or operations on the authentication results of multiple ACL permissions according to the authorization validity element; it can also use parsing conversion strategies to parse and convert IAM permission policies and ACL permission policies. The difference between IAM permission policies and ACL permission policies is that IAM permission policies are a superset of ACL permission policies, containing more permission elements in addition to the subject, resource, and operation, such as the authorization validity element; IAM permission policies can also be queried, added, deleted, and updated.

[0091] In the embodiments of the present application, the IAM model includes IAM permission policies, which can be configured in json format. The elements in the IAM permission policy include: authorization validity Effect element, resource Resource element, and operation Action element. The resource element can include: object name, service name, account identifier, and specific resource identifier. The authorization validity element can be compared with the positive authorization and negative authorization modes represented by the white list and the black list, respectively; the resource element represents the specific object authorized; and the operation element refers to the operation on the specific resource, which can be defined by the service name and specific operation behavior in the resource element.

[0092] Specifically, the way of configuring an access control list according to the configured IAM model by using the parsing conversion strategy is as follows: identity information of an authorized request subject is obtained according to the format of the IAM model, and an array of resource elements and an array of operation elements are obtained; after the subject identity information is determined, the array of resource elements is traversed, a first ACL permission policy is generated for each resource element, and subject information and resource information are filled in the ACL permission policy according to the resource element; the array of operation elements is traversed, a second ACL permission policy is generated for each operation element, and operation information is filled in the ACL permission policy according to the operation element; the first ACL permission policy and the second ACL permission policy are combined to obtain a complete subject, resource, and operation three-element ACL permission policy. Optionally, after the parsing conversion is completed to obtain the three-element ACL permission policy, it is confirmed that the number of the converted three-element ACL permission policy is equal to the number of combinations of the resource elements and the operation elements in the IAM permission policy, and if the numbers are not equal, the configuration of the ACL permission policy is performed again. The identity information of the subject is a proxy identity.

[0093] Embodiment Two

[0094] On the basis of the above-described embodiment one, the specific steps of the permission control method further include entity user registration and authorization, and specifically include:

[0095] Step S201: obtaining an entity user registration request sent by an entity user terminal.

[0096] Step S202: generating an entity user account and determining a corresponding entity user identifier according to the entity user registration request.

[0097] Step S203: initializing the permission corresponding to the entity user identifier, so that the entity user obtains entity user basic permission.

[0098] The entity user can be an enterprise user, and the entity user registration request can include a social credit code, and can further include an enterprise name, legal person information, and the like.

[0099] Optionally, after obtaining the entity user registration request sent by the entity user terminal, the information in the entity user registration request can be verified; and after it is determined that the information verification is passed, the entity user account is generated according to the entity user registration request and the corresponding entity user identifier is determined.

[0100] In the embodiments of the application, the social credit code can be determined as the entity user identifier, or a unique identifier of the entity user can be generated according to a preset rule, and the embodiments of the application do not limit this.

[0101] After generating entity user accounts and determining the corresponding entity user identifiers, it is necessary to initialize the permissions corresponding to the entity user identifiers to complete the basic permission configuration of entity users. The basic permissions of entity users may include: system login permissions, authentication information viewing permissions, product subscription permissions, system console access permissions, and other basic permissions to ensure that entity users can complete basic operations.

[0102] In this embodiment of the application, after an entity user sends an entity user registration request and passes authentication for the first time, subsequent logins do not require repeated authentication; users only need to enter their account and password information to verify their login.

[0103] Based on the above embodiments, after an entity user registers and obtains basic entity user permissions, the entity user can change the entity user's permissions. The specific steps for changing the entity user's permissions include:

[0104] Step S204: Obtain the entity user permission change request sent through the permission management interface in the entity user terminal.

[0105] The entity user permission change request includes the entity user identifier and the corresponding permission change information. The corresponding permission change information includes the permission to be changed and the operation on that permission, such as adding or deleting.

[0106] Step S205: Change the permissions corresponding to the entity user identifier using an access control list based on the corresponding permission change information.

[0107] In this embodiment of the application, the entity user identifier corresponds to the entity user's permissions, and the proxy identity identifier corresponds to the proxy identity's permissions.

[0108] This application does not limit the manner in which the entity user terminal sends the entity user permission change request; it can send the entity user permission change request to the electronic device in response to the entity user's operation. For example, if a new accessible resource is added, the entity user can send an entity user permission change request for that new resource to increase access permissions to that new resource.

[0109] In this embodiment, an Access Control List (ACL) is used to control the access permissions of entity users. An ACL can be configured to control entity user permissions based on an entity user permission change request, thereby changing the permissions corresponding to the entity user identifier.

[0110] The permission control method provided in the embodiments of the present application comprises the following steps: obtaining an entity user permission change request sent through a permission management interface in an entity user terminal; the entity user permission change request comprises an entity user identifier and corresponding permission change information; and changing the permission corresponding to the entity user identifier by using an access control list according to the corresponding permission change information. The access control list can be used to realize more flexible access permission control, facilitate the change of the permission corresponding to the entity user identifier, and make the permission corresponding to the entity user identifier flexible and configurable.

[0111] On the basis of the above embodiments, the entity user can set a permission set according to the permission of the entity user, and the setting method of the permission set comprises the following steps:

[0112] In step S206, a permission set generation request sent through a permission set setting interface in an entity user terminal is obtained, and at least one selected permission in the permission set setting interface is determined.

[0113] In step S207, a permission set corresponding identifier is generated, and the at least one selected permission is determined as the permission included in the permission set.

[0114] The at least one selected permission is in the permission corresponding to the entity user identifier.

[0115] In the embodiments of the present application, after the entity user determines the permission corresponding to the entity user identifier, at least one permission set can be determined according to the requirement.

[0116] Specifically, the permission corresponding to the entity user identifier can be displayed in the permission set setting interface in the entity user terminal, and the entity user can select at least one permission therefrom and send a permission set generation request to the electronic device. After receiving the permission set generation request, the electronic device can generate a permission set and a permission set corresponding identifier, and determine the at least one selected permission as the permission included in the permission set. Optionally, the entity user can also delete the set permission set.

[0117] The permission control method provided in the embodiments of the present application comprises the following steps: obtaining a permission set generation request sent through a permission set setting interface in an entity user terminal, and determining at least one selected permission in the permission set setting interface; the at least one selected permission is in the permission corresponding to the entity user identifier; generating a permission set corresponding identifier and determining the at least one selected permission as the permission included in the permission set. The entity user can flexibly set a permission set according to the permission possessed by the entity user, which can improve the flexibility of setting the permission set, further improve the flexibility and individuality degree of setting the proxy permission, ensure that the proxy permission can be set individually, and ensure the efficiency of setting the proxy permission.

[0118] On the basis of the above embodiments, after the entity user registers and determines the corresponding permissions of the entity user identifier, an access request can be initiated, and the permission control method provided in the embodiments of the present application can authenticate the access request, specifically including the following steps:

[0119] Step S208, obtaining the access request sent by the entity user terminal.

[0120] Step S209, authenticating the access request according to the corresponding permissions of the entity user identifier by using the access control list.

[0121] Specifically, after the entity user logs in, the entity user can initiate an access request for a resource that needs to be accessed or operated, and the entity user terminal sends the access request to the electronic device, so that the electronic device authenticates the access request by using the access control list. The access request can include the entity user identifier, the accessed resource information and the operation information.

[0122] After the electronic device receives the access request, the electronic device can determine the authentication subject, the resource and the operation information in the access request, query the authorized permission information of the subject based on the subject information, call the ACL logical expression operation to perform matching operation, and obtain the result of whether the authentication is passed. If it is determined that the authentication is passed, it can be determined that the access operation is performed according to the access request; if it is determined that the authentication is not passed, the corresponding error code and prompt can be sent to the entity user terminal. The subject information is the entity user identifier, and the authorized permission of the subject is the corresponding permission of the entity user identifier.

[0123] Embodiment three

[0124] On the basis of any of the above embodiments, the specific steps of the permission control method further include personal user registration and authorization, specifically including:

[0125] Step S301, obtaining a personal user registration request sent by a personal user terminal.

[0126] Step S302, generating a personal user account according to the personal user registration request and determining the corresponding personal user identifier.

[0127] Step S303, initializing the permissions corresponding to the personal user identifier, so that the personal user obtains the personal general basic permissions.

[0128] The personal general basic permissions can include system login permissions, subscription permissions, console access permissions and the like.

[0129] In the embodiments of the present application, the registration method of the personal user is similar to the registration method of the entity, which will not be described one by one.

[0130] Optionally, the mobile phone number can be included in the personal user registration request, and the mobile phone number can be determined as the personal user identifier.

[0131] On the basis of the above embodiment, after the personal user registers and obtains the basic rights of the personal user, the personal user can obtain the rights corresponding to the agent identity and the agent identity identifier by using the method of steps S101 to S103 in embodiment one.

[0132] After the personal user obtains the rights corresponding to the agent identity and the agent identity identifier, the rights of the personal user can be changed. The way of changing the rights of the personal user specifically includes the following steps:

[0133] Step S304, obtaining an entity user right change request sent through a right management interface in an entity user terminal.

[0134] The entity user right change request includes an entity user identifier and corresponding right change information.

[0135] Step S305, changing the rights corresponding to the entity user identifier by using an access control list according to the corresponding right change information.

[0136] The embodiments of the present application do not limit the way of the right change request sent by the entity user terminal. Similar to the way of the agent right setting request sent by the entity user terminal, the entity user terminal can send an agent right change request after receiving the agent right setting application sent by the personal user terminal, or can send an agent right setting request to the electronic device in response to the agent identity granting operation of the entity user.

[0137] Illustratively, when the personal user accesses the resource using the agent identity, if the system prompts that the authentication fails, the personal user can send an agent right setting application to the electronic device through the personal user terminal to apply to add the related resource rights to the agent identity. The electronic device can query the entity user who has the related rights, and send an authorization application notification to the corresponding entity user terminal. The authorization application notification can include: the basic information of the personal user and the detailed information of the agent identity; the detailed information of the agent identity includes: the agent identity grantor and the description of the use of the agent identity. After the entity user terminal receives the authorization application notification, the entity user can view the personal user's qualifications and determine whether to authorize; if it is determined to authorize, the entity user can send an agent right change request to the electronic device through the right management interface in the entity user terminal.

[0138] Optionally, if the entity user terminal does not have the right to apply for authorization of the personal user, the rights of the entity user can be changed by using steps S204 and S205; the entity user can define a new IAM right policy by configuring the resource elements and operation elements in the IAM model to authorize the agent identity.

[0139] The permission control method provided by the embodiments of the present application acquires a proxy permission change request sent through a permission management interface in an entity user terminal; the proxy permission change request comprises a proxy identity identifier and corresponding permission change information; and the corresponding permission change information is used to change the permission corresponding to the entity user identifier by using an access control list. The permission corresponding to the proxy identity identifier can be changed only, the permission corresponding to other proxy identities or the permission set can be avoided from being affected when the permission of a certain proxy identity is changed, the security problem caused by the permission confusion can be avoided, and the security of the resource can be improved.

[0140] Optionally, the log storage entity user can be used to store various operation information of the entity user, and the various operation information of the entity user comprises an entity user operation time and operation content. Specifically, the operation of the entity user can comprise changing the permission corresponding to the entity user identifier, changing the permission corresponding to the proxy identity identifier, creating a proxy identity for the personal user identifier, and the like. The permission configuration and operation information export function can be further provided to periodically check the granted permission.

[0141] Embodiment Four

[0142] Figure 3 The permission control method flowchart provided by the fourth embodiment of the present application is based on any of the above embodiments, and the personal user can send an access request to the electronic device through the personal user terminal to access the resource. The present application relates to a permission control method for authenticating the access request initiated by the personal user, as shown in Figure 3 The method comprises the following steps:

[0143] In step S401, the access request sent by the personal user terminal is acquired, and it is determined whether the proxy identity identifier is included in the access request.

[0144] In the embodiments of the present application, the access request comprises subject information, and the subject information in the access request sent by the personal user terminal is the proxy identity identifier or the personal user identifier.

[0145] In the embodiments of the present application, the personal user can view the detailed information of the proxy identity of the granted proxy identity before initiating the access, and select the adopted proxy identity, or not select the proxy identity. If the adopted proxy identity is selected, the proxy identity identifier of the adopted proxy identity is included in the access request, and the proxy identity can be executed in step S403 or step S407. If the proxy identity is not selected, the proxy identity identifier is not included in the access request, and the personal user can be authenticated in step S402.

[0146] In step S402, if it is determined that the proxy identity identifier is not included in the access request, the access request is authenticated at the user level according to the personal general basic permission.

[0147] In the embodiments of the present application, the personal general basic permission is the permission corresponding to the user identifier of the user after the user is registered and initialized, and can include system login permission, subscription permission, console access permission, and the like.

[0148] In the embodiments of the present application, if it is determined that the access request does not include the agent identifier, the access request includes the personal user identifier, and the access request can further include resource information, operation information, and identity type information. Optionally, whether the authentication subject is a personal user or an agent can be determined according to the identity type information.

[0149] In the embodiments of the present application, if it is determined that the access request does not include the agent identifier, it can be determined that the authentication subject is a personal user. After it is determined that the authentication subject is a personal user, the personal general basic permission can be used to perform user-level authentication on the access request.

[0150] The permission control method provided in the embodiments of the present application includes the following steps: obtaining an access request sent by a personal user terminal; if it is determined that the access request does not include an agent identifier, performing user-level authentication on the access request according to a personal general basic permission; and if it is determined that the user-level authentication is passed, determining to perform an access operation according to the access request. The access request sent by the personal user terminal can be authenticated, and the personal user can initiate an access request without using an agent, which improves the flexibility of initiating an access request and authentication, and enables a personal user who has not obtained an agent to perform a basic operation.

[0151] Optionally, after the entity user creates an agent for the personal user, the entity user can configure an authentication mode for the agent. The access request can include authentication mode information, and after it is determined that the access request includes the agent identifier, whether to perform secondary authentication and execute subsequent steps can be determined according to the authentication mode information, and the subsequent steps include the following steps.

[0152] In step S403, whether to perform secondary authentication is determined according to the authentication mode information.

[0153] In the embodiments of the present application, if it is determined that the access request includes the agent identifier and the authentication mode information, whether to perform secondary authentication can be determined according to the authentication mode information. The access request can further include a personal user identifier, resource information, operation information, authorization validity information, and identity type information. Optionally, whether the authentication subject is a personal user or an agent can be determined according to the identity type information.

[0154] In the embodiments of the present application, if it is determined that the access request includes the agent identifier, it can be determined that the authentication subject is an agent. After it is determined that the authentication subject is an agent, whether to perform secondary authentication can be determined according to the authentication mode information.

[0155] Specifically, if the authentication mode information is secondary authentication, steps S404 and subsequent steps are performed to conduct secondary authentication on the response request; if the authentication mode information is primary authentication, steps S407 and subsequent steps are performed to conduct proxy-level authentication on the response request.

[0156] Step S404, determining an entity user identifier having an association relationship with the proxy identity identifier.

[0157] The entity user identifier having the association relationship with the proxy identity identifier is an identifier of an entity user who grants the proxy identity.

[0158] In the embodiment of the application, after the proxy identity identifier is generated for the personal user identifier according to the proxy permission setting request, the entity user identifier in the proxy permission setting request and the proxy identity identifier can be associated and stored in the database, so that the entity user identifier having the association relationship with the proxy identity identifier can be determined according to the database in secondary authentication.

[0159] Step S405, determining the corresponding permission of the entity user according to the access control list and the entity user identifier, and conducting root-level authentication on the access request according to the corresponding permission of the entity user.

[0160] The root-level authentication is authentication on the permission of the entity user who grants the proxy identity of the personal user. After the root-level authentication is passed, proxy permission authentication is conducted.

[0161] Specifically, if it is determined that the root-level authentication is passed, steps S406 and subsequent steps are performed to conduct proxy-level authentication on the access request according to the corresponding permission of the proxy identity identifier; if it is determined that the root-level authentication is not passed, an error code and a prompt can be sent to the personal user terminal to prompt the user that the permission of the entity user who grants the proxy identity is invalid.

[0162] It should be understood that after the entity user grants a certain permission to the proxy identity, the entity user deletes the permission in the permission corresponding to the entity user identifier of the entity user, so that the permission of the entity user who grants the proxy identity is invalid, the root-level authentication is not passed, and the proxy-level authentication is passed.

[0163] The permission control method provided in the embodiments of the present application can realize secondary authentication of the access request, so that the root-level permission, i.e., the corresponding entity user permission, is authenticated before the proxy-level permission is authenticated, which can avoid the security control loophole problem caused by the fact that if the root-level permission is invalid, the proxy-level permission is not adjusted accordingly when only the proxy-level permission is checked, and can improve the security of the resource.

[0164] In step S406, the corresponding permission of the proxy identity identifier is determined according to the access control list, and the proxy-level authentication of the access request is performed according to the corresponding permission of the proxy identity identifier.

[0165] In the embodiments of the present application, if it is determined that the proxy-level authentication of the access request is performed, the proxy identity identifier can be obtained from the access request, the corresponding permission of the proxy identity identifier is determined according to the access control list, and the proxy-level authentication of the access request is performed according to the corresponding permission of the proxy identity identifier.

[0166] Specifically, the authorized proxy-level permission information can be determined according to the access control list based on the proxy identity identifier, the IAM model is called to perform matching operation on the access request and the corresponding permission of the proxy identity identifier, and the result of whether the authentication is passed or not is obtained.

[0167] In step S407, if it is determined that the proxy-level authentication is passed, it is determined that the access operation is performed according to the access request.

[0168] Specifically, if it is determined that the proxy-level authentication is passed, step S408 is performed to determine that the access operation is performed according to the access request; if it is determined that the proxy-level authentication is not passed, an error code and a prompt can be sent to the personal user terminal to prompt the user that the user is not granted the relevant permission.

[0169] The permission control method provided in the embodiments of the present application can realize secondary authentication of the access request, so that the root-level permission, i.e., the corresponding entity user permission, is authenticated before the proxy-level permission is authenticated, which can avoid the security control loophole problem caused by the fact that if the root-level permission is invalid, the proxy-level permission is not adjusted accordingly when only the proxy-level permission is checked, and can improve the security of the resource.

[0170] Embodiment five

[0171] Figure 4Fig. 1 is a schematic diagram of a structure of a permission control device according to an embodiment of the present application. The permission control device according to the embodiment of the present application can execute the processing procedure provided by the permission control method embodiment. As shown in Fig. 1, the permission control device 50 includes an interface module 501, a storage module 502, and a permission control module 503. Figure 4

[0172] Specifically, the interface module 501 is configured to acquire a proxy permission setting request sent by an entity user terminal, wherein the proxy permission setting request includes a personal user identifier and at least one permission set corresponding identifier, and the permission set includes at least one permission.

[0173] The storage module 502 is configured to generate a proxy identity identifier for the personal user identifier according to the proxy permission setting request, and store the proxy identity identifier and the personal user identifier in a database in association.

[0174] The permission control module 503 is configured to determine the permissions in the at least one permission set corresponding identifier as the proxy identity identifier corresponding permissions according to the proxy permission setting request, and determine the proxy identity identifier corresponding permissions as the personal user corresponding permissions according to the association between the proxy identity identifier and the personal user identifier.

[0175] The device provided by the embodiment of the present application can be specifically used to execute the method embodiment provided by the above-mentioned embodiment one, and the specific functions will not be repeated here.

[0176] Optionally, the interface module 501 is further configured to acquire a permission set generation request sent through a permission set setting interface in the entity user terminal, and the permission control module 503 is further configured to determine at least one selected permission in the permission set setting interface, wherein the at least one selected permission is in the entity user identifier corresponding permissions, generate a permission set corresponding identifier, and determine the at least one selected permission as the permission included in the permission set.

[0177] Optionally, the interface module 501 is further configured to acquire a proxy permission change request sent through a permission management interface in the entity user terminal, wherein the proxy permission change request includes a proxy identity identifier and corresponding permission change information, and the permission control module 503 is further configured to change the proxy identity identifier corresponding permissions by using an access control list according to the corresponding permission change information.

[0178] Optionally, the interface module 501 is further configured to acquire an entity user permission change request sent through a permission management interface in the entity user terminal, wherein the entity user permission change request includes an entity user identifier and corresponding permission change information, and the permission control module 503 is further configured to change the entity user identifier corresponding permissions by using an access control list according to the corresponding permission change information.

[0179] ​Optionally, the permission control apparatus 50 further comprises: an authentication module; and an interface module 501, configured to acquire the access request sent by the personal user terminal; the authentication module is configured to: if it is determined that the proxy identity is not included in the access request, perform user-level authentication on the access request according to the personal general basic permission; and if it is determined that the user-level authentication is passed, determine to perform the access operation according to the access request.

[0180] Optionally, the authentication module is further configured to: if it is determined that the proxy identity is included in the access request, determine the permission corresponding to the proxy identity according to the access control list, and perform proxy-level authentication on the access request according to the permission corresponding to the proxy identity; and if it is determined that the proxy-level authentication is passed, determine to perform the access operation according to the access request.

[0181] Optionally, the proxy permission setting request further comprises: an entity user identifier; the storage module 502 is further configured to store the entity user identifier in the proxy permission setting request in association with the proxy identity in the database; and the authentication module is further configured to: if it is determined according to the authentication mode information that the access request is to be authenticated twice, determine the entity user identifier having an association relationship with the proxy identity; determine the entity user corresponding permission according to the access control list and the entity user identifier, and perform root-level authentication on the access request according to the entity user corresponding permission; and if it is determined that the root-level authentication is passed, perform proxy-level authentication on the access request according to the permission corresponding to the proxy identity.

[0182] Optionally, the permission control apparatus 50 further comprises: a log module; the log module is configured to: store various operation information of the entity user, the various operation information of the entity user comprising: an entity user operation time and an operation content; and export the permission configuration and the operation information, so as to periodically check the granted permission.

[0183] The apparatus provided by the embodiments of the present application can be specifically used to execute the above-mentioned method embodiments, and specific functions will not be described here.

[0184] Embodiment six

[0185] Figure 5 A structural schematic diagram of an electronic device provided by the embodiment six of the present application is shown in Figure 5 The present application further provides an electronic device 60, comprising: a memory 601, a processor 602 and a transceiver 603.

[0186] The memory 601 is configured to store computer-executable instructions, and the transceiver 603 is configured to transceive data. The memory 601, the processor 602 and the transceiver 603 are in communication connection. Specifically, the program can include program code, and the program code includes computer-executable instructions. The memory 601 can include a high-speed RAM memory, and can also include a non-volatile memory such as at least one disk memory.

[0187] The processor 602 is configured to execute the computer-executable instructions stored in the memory 601.

[0188] The computer-executable instructions are stored in the memory 601 and configured to be executed by the processor 602 to implement the method provided in any one of the embodiments of the present application. The related description can be understood by referring to the related description and effects of the steps in the accompanying drawings, and will not be described here in detail.

[0189] In the embodiments of the present application, the memory 601 and the processor 602 are connected through a bus. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 5 Only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0190] The embodiments of the present application also provide a computer readable storage medium, and the computer readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by a processor, the computer-executable instructions are used to implement the method provided in any one of the embodiments of the present application.

[0191] The embodiments of the present application also provide a computer program product, and the computer program product includes computer-executable instructions. When the computer-executable instructions are executed by a processor, the computer-executable instructions implement the method provided in any one of the embodiments of the present application.

[0192] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0193] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0194] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in a combination of hardware and software functional modules.

[0195] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to the processor or controller of a general-purpose computer, special-purpose computer, or other programmable full-path fusion device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0196] In the context of this application, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0197] Further, although operations are depicted in a particular, sequential order, this should not be understood as requiring or implying that the operations are performed in the order illustrated, or that all illustrated operations are necessary for realizing the desired result. In certain contexts, multitasking and parallel processing can be advantageous. Likewise, the specific sequential order described above need not be adhered to, nor should the features be realized in the particular order given - that is, even though a feature can be described in the context of performing other features, among other implementations, the feature can be realized in the context of the others, or even in the context of a single feature. Furthermore, certain features can be used in combination with one another to realize and achieve one or more benefits, and it will be understood that the ordering of operations presented is merely an example and the length of the operations can be altered to achieve the desired results. Accordingly, the skilled artisan will appreciate that the order of certain operational steps can be changed or even reversed without departing from the scope and spirit of the application.

[0198] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the application be limited only by the scope of the claims, a properly construed, and it is intended that any variations be considered as falling within the scope of the application. The specification and examples given are intended as illustrative only and not in a limiting sense. The true scope and spirit of the application are indicated by the following claims.

[0199] It should be understood that the application is not limited to the precise construction and compositions described above and shown in the accompanying drawings, and various modifications and changes can be effected therein by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims appended hereto.

Claims

1. A method of controlling rights, characterized by, The method comprises the following steps: acquiring a proxy authority setting request sent by an entity user terminal; the proxy authority setting request comprises a personal user identifier, at least one authority set corresponding identifier and an entity user identifier; the authority set comprises at least one authority; the authorities comprised in the authority set are set in advance, which comprises the following steps: acquiring an authority set generation request sent through an authority set setting interface in the entity user terminal, and determining at least one authority selected in the authority set setting interface; the at least one authority selected is in the authorities corresponding to the entity user identifier; generating an authority set corresponding identifier and determining the at least one authority selected as the authorities comprised in the authority set; generating a proxy identity identifier for the personal user identifier according to the proxy authority setting request and storing the proxy identity identifier and the personal user identifier in a database in association; storing the proxy identity identifier and the personal user identifier in the database in association comprises the following step: storing the entity user identifier in the proxy authority setting request and the proxy identity identifier in the database in association; determining the authorities in the at least one authority set corresponding identifier as the authorities corresponding to the proxy identity identifier according to the proxy authority setting request, so as to determine the authorities corresponding to the proxy identity identifier as the authorities corresponding to the personal user according to the association between the proxy identity identifier and the personal user identifier; acquiring an access request sent by a personal user terminal; the access request comprises authentication mode information; if it is determined that the access request comprises the proxy identity identifier, determining the authorities corresponding to the proxy identity identifier according to an access control list, and performing proxy-level authentication on the access request according to the authorities corresponding to the proxy identity identifier; if it is determined that the proxy-level authentication is passed, it is determined that the access operation according to the access request is executed; if it is determined that the access request does not comprise the proxy identity identifier, performing user-level authentication on the access request according to a personal general basic authority; if it is determined that the user-level authentication is passed, it is determined that the access operation according to the access request is executed; before the proxy-level authentication on the access request according to the authorities corresponding to the proxy identity identifier, the method further comprises the following steps: if it is determined according to the authentication mode information that the access request will be subjected to secondary authentication, determining the entity user identifier having the association with the proxy identity identifier; determining the authorities corresponding to the entity user according to the access control list and the entity user identifier, and performing root-level authentication on the access request according to the authorities corresponding to the entity user; if it is determined that the root-level authentication is passed, performing proxy-level authentication on the access request according to the authorities corresponding to the proxy identity identifier.

2. The method of claim 1, wherein, after the authorities in the at least one authority set corresponding identifier are determined as the authorities corresponding to the proxy identity identifier according to the proxy authority setting request, the method further comprises the following steps: acquiring a proxy authority change request sent through an authority management interface in the entity user terminal; the proxy authority change request comprises the proxy identity identifier and corresponding authority change information; changing the authorities corresponding to the proxy identity identifier by using the access control list according to the corresponding authority change information.

3. The method of claim 1, wherein, the method further comprises the following steps: acquiring an entity user authority change request sent through an authority management interface in the entity user terminal; the entity user authority change request comprises an entity user identifier and corresponding authority change information; According to corresponding permission change information, an access control list is used to change a corresponding permission of an entity user identifier.

4. An apparatus for controlling rights, characterized by The method comprises the following steps: An interface module is configured to acquire a proxy permission setting request sent by an entity user terminal. The proxy permission setting request comprises a personal user identifier, at least one permission set identifier, and an entity user identifier. The interface module is further configured to acquire a permission set generation request sent through a permission set setting interface of the entity user terminal. A permission control module is configured to determine at least one selected permission in the permission set setting interface, wherein the at least one selected permission is in the corresponding permission of the entity user identifier. The permission control module is further configured to determine the permissions in the at least one permission set identifier as the corresponding permission of the proxy identifier according to the proxy permission setting request, and determine the corresponding permission of the proxy identifier as the corresponding permission of the personal user according to the association relationship between the proxy identifier and the personal user identifier. A storage module is configured to generate a proxy identifier for the personal user identifier according to the proxy permission setting request, and store the proxy identifier and the personal user identifier in a database in association. The storage module is specifically configured to store the entity user identifier and the proxy identifier in the database in association. The interface module is further configured to acquire an access request sent by the personal user terminal, wherein the access request comprises authentication mode information. An authentication module is configured to determine the corresponding permission of the proxy identifier according to an access control list if it is determined that the access request comprises the proxy identifier, and perform proxy-level authentication on the access request according to the corresponding permission of the proxy identifier.

5. An electronic device, comprising: If it is determined that the proxy-level authentication is passed, it is determined to perform an access operation according to the access request. If it is determined that the access request does not comprise the proxy identifier, the authentication module performs user-level authentication on the access request according to a personal general basic permission. If it is determined that the user-level authentication is passed, it is determined to perform the access operation according to the access request. If it is determined according to the authentication mode information that the access request will be subjected to secondary authentication, it is determined to determine an entity user identifier having an association relationship with the proxy identifier.

6. A computer-readable storage medium, characterized in that, The authentication module determines the corresponding permission of the entity user according to an access control list and the entity user identifier, and performs root-level authentication on the access request according to the corresponding permission of the entity user. The method comprises the following steps: A processor, a memory, and a transceiver connected in communication with the processor; The memory stores computer execution instructions; and the transceiver is configured to transmit and receive data. The processor executes the computer execution instructions stored in the memory to implement the method according to any one of claims 1-3. The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method according to any one of claims 1-3.

Images