Traceable permission management method, system and storage medium

Abstract

The application provides a traceable permission management method, system and storage medium. The method comprises the following steps: intercepting permission data in business data; storing the permission data in a stack structure corresponding to the business data in a permission database; intercepting a permission record viewing request corresponding to a business data initiated by an administrator; and obtaining the stack structure of the business data in the permission database. The application can not only realize traceable permission authorization, but also efficiently manage and control the query permission, thereby optimizing the permission management.

Description

Technical Field

[0001] This application relates to the field of business data management, specifically to traceable access control methods, systems, and storage media. Background Technology

[0002] Currently, the permission frameworks available on the market include Apache Shiro and Spring Security.

[0003] Apache Shiro is a Java security (authorization) framework. Shiro can perform authentication, authorization, encryption, session management, web integration, caching, and more.

[0004] SpringSecurity is a powerful and highly customizable authentication and access control framework based on the Spring framework. It is practically the standard for securing Spring-based applications.

[0005] In actual development, both Apache Shiro and Spring Security permission frameworks have been widely praised by developers. However, neither of these frameworks provides a history of permission authorization, making it impossible to accurately trace the detailed records of user permission authorization, i.e., it is impossible to know who granted what permission to the user, when, and in what way. Consequently, a series of unnecessary disputes may arise due to the inability to trace the source of user permissions. Summary of the Invention

[0006] In view of the above problems, this application provides a traceable permission management method, system and storage medium to achieve traceable permission authorization and optimize permission management.

[0007] To achieve the above objectives, the inventors provide a traceable access control method, comprising:

[0008] Intercept permission data within business data;

[0009] A stack structure that stores the permission data into the corresponding business data in the permission database;

[0010] Intercept requests initiated by the administrator to view permission records for a specific business data item;

[0011] Obtain the stack structure of the business data in the permission database.

[0012] Unlike existing technologies, the above technical solution filters out permission data from business data.

[0013] And by using a stack structure for storage, the 30 permission data corresponding to each permission change can be pushed onto the bottom of the stack in chronological order, thus highlighting the latest permission changes without affecting existing permission data; and

[0014] It can record the entire process of permission changes in chronological order for traceability. Therefore, the above technical solution provides an additional permission tracking function to meet the need to query the source of permission authorization, facilitate user management and tracking of user permission usage, and optimize permission management.

[0015] In some embodiments, the permission data stored in the stack structure further includes the authorized user, permission owner, operation time, and operation behavior;

[0016] The permission record viewing request includes the authorized user, permission holder, query time limit, and operation.

[0017] Optional query criteria for the behavior;

[0018] The stack structure of the business data in the access permission database includes:

[0019] Based on the query conditions in the permission record viewing request, the permission data in the stack structure 40 of the business data is calculated to obtain the query result.

[0020] Furthermore, if all optional query conditions in the permission record viewing request are empty, the stack structure of the business data in the permission database is obtained, and all permission data in it is returned as the query result.

[0021] Furthermore, the method also includes:

[0022] 45. When permission data is pushed onto the stack, the permission results for the corresponding stack structure are calculated from the bottom of the stack to the top of the stack.

[0023] Store the association between the permission results and the corresponding business data.

[0024] Furthermore, the method also includes:

[0025] Intercept permission query requests for corresponding business data initiated by the administrator;

[0026] Based on the aforementioned relationship, the permission result corresponding to the business data is returned.

[0027] 50. Further, the method also includes:

[0028] Intercept user-initiated query requests for corresponding business data;

[0029] Based on the association relationship, obtain the permission result corresponding to the business data;

[0030] The user's data query permissions are determined based on the permission results;

[0031] Return the data corresponding to the data query request based on the data query permissions.

[0032] 55. Further, the authorized users include users, roles, and groups; the operational behaviors include new...

[0033] Add and delete.

[0034] The above embodiments can support the quick and accurate location and retrieval of specific items in the stack structure according to query conditions, making it convenient for users to query efficiently; and can support the retrieval of all permission authorization records for any business data.

[0035] By automatically calculating the permission results of the stack structure each time the stack structure data changes, and associating them with the corresponding business data (60 items), the system can efficiently and effectively handle subsequent permission query requests initiated by the administrator.

[0036] It can quickly return the current permission results of business data, and efficiently and quickly determine the user's query permissions to return data when the user initiates a query request, thus achieving efficient management of query permissions.

[0037] To achieve the above objectives, the inventors also provide a traceable access control system, including...

[0038] Limited to managing interceptors, permission log viewers, and permission databases;

[0039] The permission management interceptor described in 65 is used to intercept permission data in business data; and to store the...

[0040] The stack structure of permission data to corresponding business data in the permission database;

[0041] The permission record viewer is used to intercept permission record viewing requests initiated by the administrator for a corresponding business data; and to obtain the stack structure of the business data in the permission database.

[0042] Unlike existing technologies, the permission management system described in the above technical solution filters out 70 permission data points from business data and stores them using a stack structure. This allows each permission to be processed in a specific order.

[0043] The permission data corresponding to each permission change is pushed onto the bottom of the stack. This highlights the latest permission change without affecting existing permission data, and also records the permission change process completely in chronological order for traceability. Therefore, the permission management system in this application implements an additional permission tracking function to meet query requirements.

[0044] To meet the needs of permission authorization sources, facilitate user management and track user permission usage, permission management has been optimized.

[0045] In some implementations, the system further includes a permission calculation interceptor;

[0046] The permission calculation interceptor is used to calculate the permission result of the corresponding stack structure from the bottom to the top of the stack when permission data is pushed onto the stack; to store the association relationship between the permission result and the corresponding business data; to intercept the permission query request for a business data initiated by the administrator; and to return the permission result corresponding to the business data according to the association relationship.

[0047] To achieve the above objectives, the inventors also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is capable of implementing the steps included in the above-described traceable access control method.

[0048] The above description of the invention is merely an overview of the technical solution of this application. In order to enable those skilled in the art to better understand the technical solution of this application and to implement it based on the description and drawings, and to make the above-mentioned objectives and other objectives, features and advantages of this application easier to understand, the following description is provided in conjunction with the specific embodiments and drawings of this application. Attached Figure Description

[0049] The accompanying drawings are only used to illustrate the principles, implementation methods, applications, features, and effects of specific embodiments of this application and other related content, and should not be considered as limitations on this application.

[0050] In the accompanying drawings of the instruction manual:

[0051] Figure 1 This is a flowchart illustrating a traceable access control method according to an embodiment of this application;

[0052] Figure 2 This is a schematic diagram of the data structure of the stack structure in a specific example of this application;

[0053] Figure 3 This is a flowchart illustrating a traceable access control method according to an embodiment of this application;

[0054] Figure 4 This is a schematic diagram of the process for querying business permissions according to an embodiment of this application;

[0055] Figure 5 This is a flowchart illustrating the process of controlling query permissions in one embodiment of this application;

[0056] Figure 6This is a functional diagram of a traceable access control system according to an embodiment of this application. Detailed Implementation

[0057] To illustrate the possible application scenarios, technical principles, implementable specific solutions, and achievable objectives and effects of this application in detail, the following description, in conjunction with the listed specific embodiments and accompanying drawings, provides a detailed explanation. The embodiments described herein are merely illustrative of the technical solutions of this application and are therefore intended to limit the scope of protection of this application.

[0058] 105. The reference to "embodiment" in this document means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The term "embodiment" appearing in various places in the specification does not necessarily refer to the same embodiment, nor does it specifically limit its independence or connection with other embodiments. In principle, in this application, as long as there is no technical contradiction or conflict, the technical features mentioned in each embodiment can be combined in any way to form a corresponding 110 implementable technical solution.

[0059] Unless otherwise defined, the technical terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the use of related terms herein is merely for the purpose of describing particular embodiments and is not intended to limit this application.

[0060] In the description of this application, the term "and / or" is a 115 expression used to describe the logical relationship between objects, indicating that three relationships can exist, such as A and / or B, meaning: A exists, B exists, and...

[0061] All three cases, A and B, exist simultaneously. Additionally, in this article, the character " / " generally indicates an "OR" logical relationship between the preceding and following objects.

[0062] In this application, terms such as “first” and “second” are used only to distinguish one entity or operation from another, and do not necessarily require or imply any actual quantity, hierarchy or order relationship between these entities or operations.

[0063] Without further limitations, the use of terms such as “comprising,” “including,” “having,” or other similar expressions in this application is intended to cover non-exclusive inclusion, which does not exclude the presence of additional elements in a process, method, or product that includes the stated elements, such that a process, method, or product that includes a series of elements may include not only those defined elements but also other elements not expressly listed, or elements inherent to such process, method, or product.

[0064] Consistent with the interpretation in the Examination Guidelines, in this application, "greater than," "less than," and "exceeds" are used.

[0065] The expressions “etc.” are understood to exclude the number itself; while expressions such as “above,” “below,” and “within” are understood to include the number itself.

[0066] Furthermore, in the description of the embodiments of this application, "multiple" means two or more (including two), and similar expressions related to "multiple" as 130 are also understood in this way, such as "multiple groups", "multiple times", etc., unless otherwise explicitly specified.

[0067] In the description of the embodiments of this application, the space-related expressions used, such as "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "vertical," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential," indicate the orientation or positional relationship based on the orientation or positional relationship shown in the specific embodiments or drawings. They are only for the purpose of describing the specific embodiments of this application or for the reader's understanding, and do not indicate or imply that the device or component referred to must have a specific position, a specific orientation, or be constructed or operated in a specific orientation. Therefore, they should not be construed as limitations on the embodiments of this application.

[0068] Unless otherwise expressly specified or limited, the terms "installation," "connection," "linking," "fixing," and "setting," as used in the description of the embodiments of this application, should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral setting; it can be a mechanical connection, an electrical connection, or a communication connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be the internal connection of two components or the interaction between two components. For those skilled in the art to which this application pertains, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0069] Please see Figure 1 This embodiment provides a traceable permission management method. In addition to implementing existing basic permission functions such as permission authentication, permission authorization, permission encryption, session management, web integration, and session caching, this method specifically extends these functions with permission traceability capabilities to achieve traceable permission authorization.

[0070] The method in this embodiment may include the following steps:

[0071] S1: Intercept permission data in business data;

[0072] Specifically, it will intercept all business data generated by data management and filter out permission data from it.

[0073] In some specific implementations, after filtering out permission data from a single piece of business data, the process further includes:

[0074] S2: Analyze and process the intercepted permission data, forming it into a unified format before storage. Using a unified format for stored permission data makes the data content clearer and facilitates management.

[0075] As a specific example, the unified format includes information such as authorized user, permission holder, operation time, and operation behavior.

[0076] 160 The method described in this embodiment further includes:

[0077] S3: A stack structure that stores uniformly formatted permission data into the corresponding business data in the permission database;

[0078] In other words, for each piece of business data, a stack structure will be created in the permission database to independently store all permission data corresponding to that business data. Furthermore, the permission data stored in the stack structure is in a uniform format, specifically including the authorized user, permission holder, operation time, and operation behavior. Preferably, it also includes automatically assigned serial numbers based on the order of operation to unify the data in the stack structure and facilitate management and use.

[0079] Specifically, this embodiment uses a stack structure to store permission data in the permission database, thereby enabling the tracking and computation of permission data. A stack structure is a restricted linear list.

[0080] Following the Last-In-First-Out (LIFO) principle, insertion and deletion operations are specifically restricted to one end of the stack, i.e., the top of the stack. The opposite end is called the bottom of the stack. Inserting a new element into a stack is called pushing onto the stack, or pushing onto the stack.

[0081] Pushing an element onto a stack and popping it from the stack are both operations. In a stack-based permission database, each permission change results in the corresponding permission data being pushed onto the stack, becoming the new top element. This does not affect existing permission data. Therefore, permission data stored in a stack structure is automatically ordered chronologically.

[0082] The data is arranged in order, with the most recently defined permission data at the top of the stack, which can be directly retrieved and used. As a specific example, the data structure diagram of the stack structure is shown below. Figure 2 As shown.

[0083] In some specific implementations, the above steps will be achieved by defining a unified permission management interceptor.

[0084] S4: Intercept the administrator's request to view the permission record of the corresponding business data;

[0085] In other words, when an administrator initiates a request to view the permission record of a corresponding business data, the request will be blocked by port 180.

[0086] S5: Obtain the stack structure of the business data in the permission database;

[0087] In other words, based on the intercepted permission records, the request is viewed to obtain the stack structure in the permission database corresponding to its business data.

[0088] In some specific implementations, the permission record viewing request includes optional query conditions such as authorized user, permission holder, query time limit, and operation behavior.

[0089] The optional query conditions refer to the option to choose at least one of the above conditions as an additional condition when recording call permission; alternatively, one can choose to record call permission without any of the above query conditions, i.e., to call all data in the stack structure corresponding to the business data. The authorized user,

[0090] This refers to the user who grants the permission; the permission holder refers to the user, role, or group that possesses the permission; the query time limit refers to a time span corresponding to the authorization period, as a specific example.

[0091] For example, you can set it up like checking bank card transaction details, providing options for "today", "7 days", "one month", etc.

[0092] Other optional query timeframes include "within three months" and "custom start and end times";

[0093] The operations include adding and deleting permissions.

[0094] Accordingly, obtaining the stack structure of the business data in the permission database includes: 195 calculating the permission data in the stack structure of the business data according to the query conditions in the permission record viewing request, and obtaining the query result.

[0095] In one specific implementation, when the optional query conditions in the permission record viewing request are not all empty, i.e., the request contains query conditions selected by the administrator, the specific calculation process includes: if the query...

[0096] If a query time limit is specified, the corresponding permission data is retrieved from the stack structure according to the query time limit. For example, if the query time limit for query 200 is limited to "one month", and the permission data in the stack structure is arranged in chronological order, the permission data within the most recent "one month" can be retrieved through the "operation time" record in the permission data. Then, the retrieved permission data is filtered according to other query conditions to obtain permission data that meets all query conditions, and returned to the administrator.

[0097] In another specific implementation, if all optional query conditions in the permission record viewing request are empty (i.e., the request does not contain query conditions), then the specific calculation process includes: obtaining the stack structure of the business data in the permission database, and directly returning all the permission data in it as the query result.

[0098] As can be seen, this embodiment provides the administrator with the function of viewing all permission data or specified permission data corresponding to any specified business data. It enables the administrator to easily view the full record of the permission authorization process for each business data, the permission authorization status within a specific time limit, the authorization time of the specific permission owner, the time of permission removal, and other detailed permission records, thereby realizing the traceability of permission authorization status.

[0099] In some specific implementations, the above steps will be achieved by defining a unified permission calculation interceptor.

[0100] As another embodiment of this application, it extends the above embodiment, enabling traceable authorization of permissions in 215, while also supporting administrators to efficiently query and obtain the current permission results of any business data.

[0101] Please see Figure 3 In other words, after step S3 described in the above embodiments, the method further includes:

[0102] SS4: When any permission data is pushed onto the stack, calculate and obtain the permission result corresponding to the stack structure;

[0103] SS5: Stores the relationship between the calculated permission results and the corresponding business data in the stack structure. This allows users to directly manage and query permissions and quickly obtain permission results through the relationship.

[0104] In some specific implementations, the permission result can be calculated and obtained in the following manner, that is, SS4 may specifically include:

[0105] When any permission data is pushed onto the stack, the corresponding stack structure calculates the permission result from the bottom to the top of the stack.

[0106] 225 Specifically, each permission data can be extracted sequentially from the top of the stack structure and arranged as needed. Then, the data from the bottom of the stack to the top of the stack can be analyzed and calculated to obtain the permission result.

[0107] In other specific embodiments, the permission result can also be calculated and obtained in the following manner, that is, SS4 can specifically include:

[0108] When a certain stack structure is "pushed onto the stack", the corresponding permission result of the stack structure is directly called. Then, based on the permission result and the permission data "pushed onto the stack", the new permission result is quickly calculated.

[0109] By using the above method, the process of analyzing and calculating each permission data from the bottom of the stack can be eliminated each time, thus allowing for more efficient and faster calculation of new permission results.

[0110] As can be seen, as long as the data in the stack structure changes, the permission result calculation is initiated, and the new result is associated with the business data, making it easy to quickly retrieve the corresponding permission result by specifying the business data.

[0111] The permission result is derived from the analysis and calculation of all permission data in the stack structure, involving every user who currently holds permissions. For example, the following permission result is obtained after calculation: the permission holders include user 2 and group 1, and the corresponding authorized users are user XX and user YY, respectively.

[0112] In some specific implementations, the above steps will be achieved by defining a unified permission calculation interceptor.

[0113] like Figure 4 The diagram shown is a schematic representation of a business permission query process according to an embodiment of this application. Specifically, this embodiment further includes the following steps:

[0114] SS6: Intercept permission query requests initiated by the administrator for data related to a specific business function;

[0115] SS7: Based on the aforementioned relationship, return the permission result corresponding to the business data.

[0116] As can be seen, when an administrator wants to know the current valid permission authorization status of a certain business data, they can quickly find out by initiating a permission query request.

[0117] In some specific implementations, the above steps will be achieved by defining a unified permission log viewer.

[0118] Please see Figure 5 , Figure 5This is a flowchart illustrating the process of controlling query permissions in a traceable permission management method according to an embodiment of this application. Based on the above embodiment, it can quickly return query request data that conforms to the user's permissions.

[0119] This embodiment, based on the steps included in the traceable permission management method provided in the above embodiments, further includes:

[0120] SSS6: Intercepts user-initiated query requests for corresponding business data;

[0121] In other words, when a user invokes the data query function, the query request initiated by the user will be intercepted.

[0122] SSS7: Based on the association relationship, obtain the permission result corresponding to the business data;

[0123] In other words, by combining with the permission database, the current valid permission authorization status of business data can be obtained.

[0124] SSS8: Determine the user's data query permissions based on the permission results;

[0125] SSS9: Return the data corresponding to the data query request based on the data query permissions.

[0126] In other words, when a user invokes the query function, the system will return the data that the user is authorized to view by combining the permission results of the corresponding business data in the permission database.

[0127] In some specific implementations, the above steps will be achieved by defining a unified permission log viewer.

[0128] Please see Figure 6 This is a functional diagram of a traceable access control system 265 provided by this application based on the above embodiments.

[0129] The traceable permission management system includes a permission management interceptor, a permission record viewer, and a permission database;

[0130] The permission management interceptor is used to intercept permission data in business data; and a stack structure for storing the permission data to the corresponding business data in the permission database;

[0131] The permission record viewer described in 270 is used to intercept permission record viewing requests initiated by the administrator for a corresponding business data; and to obtain the stack structure of the business data in the permission database.

[0132] In some specific implementations, the system further includes a permission calculation interceptor;

[0133] The permission calculation interceptor is used to calculate the permission result of the corresponding stack structure from the bottom to the top of the stack when permission data is pushed onto the stack; and to store the association relationship between the permission result and the corresponding business data; 275 and to intercept permission query requests for corresponding business data initiated by the administrator; based on the association relationship,

[0134] Return the permission result corresponding to the aforementioned business data.

[0135] In some other specific embodiments, the permission data stored in the stack structure includes authorized users, permission owners, operation time, and operation behavior;

[0136] The permission record viewing request includes optional query conditions such as authorized user, permission owner, query time limit, and operation behavior; wherein, the authorized user includes user, role, and group; the operation behavior includes adding and deleting.

[0137] The permission record viewer is specifically used to calculate the permission data in the stack structure of the business data according to the query conditions in the permission record viewing request, and obtain the query results.

[0138] If all optional query conditions in the permission record viewing request are empty, the stack structure of the business data in the permission 285 database is obtained, and all permission data in it is returned as the query result.

[0139] In some other specific embodiments, the permission calculation interceptor is also used to calculate the permission result of the corresponding stack structure from the bottom of the stack to the top of the stack when permission data is pushed onto the stack; and to store the association between the permission result and the corresponding business data.

[0140] Based on the above, in some specific embodiments, the permission record viewer is also used to intercept permission query requests for corresponding business data initiated by the administrator; and to return the permission result corresponding to the business data according to the association relationship.

[0141] In some other specific embodiments, the permission calculation interceptor is also used to intercept a user's query request for corresponding business data; and to obtain the permission result corresponding to the business data based on the association relationship; and to determine the user's data query permission based on the permission result; and to return the data corresponding to the data query request based on the data query permission.

[0142] In this embodiment, the basic process implemented based on the above functional modules is as follows: First, the data sent by the data management function is intercepted by the permission management interceptor, the permission data in the business data is intercepted and analyzed, and the analyzed permission data is saved to the permission database; Second, when a user calls the data query function, it will be intercepted by the permission calculation interceptor, and by combining the permission data in the permission database, the data that the last user can view is returned; In addition, the administrator can also view the detailed permission process data of each piece of data through the permission record viewer, and can see when, where, and by whom the permissions were granted to others, which is convenient for tracking the authorization records of the data.

[0143] In this embodiment, the basic functions of each module are summarized as follows:

[0144] Access Control Interceptor: The access control interceptor is the core component of access control. It intercepts all business data generated by data management, analyzes and records permissions based on the permission data in the business data, and finally saves them to the permission database.

[0145] Permission Calculation Interceptor: As another core component of permission control, the permission calculation interceptor carries the core logic of permission calculation. It intercepts all requests for business data and ultimately returns the business data that the user has permission to view.

[0146] Permissions Log Viewer: As an auxiliary function of permission control, the Permissions Log Viewer provides detailed permission data records for users with management permissions, allowing administrators to track user permission usage.

[0147] Based on the above embodiments, this application also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the program is capable of implementing the steps included in the traceable permission management method described in any of the above embodiments. The specific steps are not repeated here; please refer to the descriptions in the above embodiments for details.

[0148] Finally, it should be noted that although the above embodiments have been described in the text and drawings of this application, this should not limit the scope of patent protection of this application. Any technical solutions that are based on the essential concept of this application and utilize the content described in the text and drawings of this application, resulting in equivalent structural or procedural substitutions or modifications, as well as the direct or indirect application of the technical solutions of the above embodiments to other related technical fields, are all included within the scope of patent protection of this application.

Claims

1. A traceable rights management method, characterized by, The method comprises: intercepting permission data in business data; storing the permission data into a stack structure corresponding to the business data in a permission database; intercepting a permission record viewing request initiated by an administrator corresponding to a piece of business data; obtaining the stack structure of the piece of business data in the permission database; The method further comprises: when permission data is stacked, calculating a permission result corresponding to the stack structure from the bottom of the stack to the top of the stack; storing the association between the permission result and the corresponding business data; intercepting a permission query request initiated by an administrator corresponding to a piece of business data; according to the association, returning the permission result corresponding to the piece of business data.

2. The traceable rights management method of claim 1, wherein, The permission data stored in the stack structure includes authorized users, permission owners, operation times and operation behaviors; The permission record viewing request includes optional query conditions of authorized users, permission owners, query time limits and operation behaviors; The method further comprises: according to the query conditions in the permission record viewing request, calculating the permission data in the stack structure of the piece of business data to obtain a query result.

3. A traceable rights management method according to claim 2, characterized in that, If all the optional query conditions in the permission record viewing request are empty, the stack structure of the piece of business data in the permission database is obtained, and all the permission data in the stack structure is returned as a query result.

4. The traceable rights management method of claim 1, wherein, The method further comprises: intercepting a data query request initiated by a user corresponding to a piece of business data; according to the association, obtaining the permission result corresponding to the piece of business data; determining the data query permission of the user according to the permission result; according to the data query permission, returning data corresponding to the data query request.

5. The traceable rights management method of claim 2, wherein, The authorized users include users, roles and groups; the operation behaviors include adding and deleting.

6. A traceable rights management system, characterized in that The system comprises a permission management interceptor, a permission record viewer and a permission database; The permission management interceptor is used to intercept permission data in business data; and store the permission data into a stack structure corresponding to the business data in the permission database; The permission record viewer is used to intercept a permission record viewing request initiated by an administrator corresponding to a piece of business data; and obtain the stack structure of the piece of business data in the permission database; The system further comprises a permission calculation interceptor; The permission calculation interceptor is used to calculate a permission result corresponding to the stack structure from the bottom of the stack to the top of the stack when permission data is stacked; and store the association between the permission result and the corresponding business data; and intercept a permission query request initiated by an administrator corresponding to a piece of business data; according to the association, return the permission result corresponding to the piece of business data.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program, when executed by a processor, can implement the steps of the traceable permission management method according to any one of claims 1 to 5.

Images