Permission configuration method and apparatus, storage medium, and electronic device

Abstract

The application discloses a permission configuration method and device, a storage medium and an electronic device. It relates to the field of financial technology or other fields, and the method comprises the following steps: obtaining role change information of a target object to be configured with permission, wherein the role change information comprises change information of a department to which the target object belongs and / or change information of a job level of the target object; obtaining a permission configuration strategy corresponding to the target object from a target permission policy tree according to the role change information, wherein the target permission policy tree is used for storing permission information corresponding to each department in a plurality of departments of a target enterprise and permission information of each job level in a plurality of job levels of the target enterprise; and configuring the target object with permission based on the permission configuration strategy. The application solves the technical problem of low permission configuration efficiency caused by manual allocation of permission in the prior art.

Description

Technical Field

[0001] This application relates to the field of financial technology or other fields, and more specifically, to a permission configuration method, apparatus, storage medium and electronic device. Background Technology

[0002] Currently, most enterprises configure employee permissions manually through office maintenance personnel. However, for large enterprises, due to the large number of employees with different roles, departments, and projects, their permission needs vary. This leads to insufficient manpower and inefficiency when configuring permissions manually for a large number of employees. Furthermore, if enterprises want to implement granular permission management, they need to invest significant manpower to maintain employee permissions, resulting in high labor costs. In addition, the larger the enterprise, the more complex its personnel structure, and the large-scale allocation of permissions increases the risk of data leakage.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a permission configuration method, apparatus, storage medium, and electronic device to at least solve the technical problem of low permission configuration efficiency caused by manually assigning permissions in the prior art.

[0005] According to one aspect of this application, a permission configuration method is provided, comprising: obtaining role change information of a target object whose permissions are to be configured, wherein the role change information includes change information of the department to which the target object belongs and / or change information of the job level of the target object; obtaining a permission configuration policy corresponding to the target object from a target permission policy tree based on the role change information, wherein the target permission policy tree is used to store permission information corresponding to each department among multiple departments of the target enterprise, and permission information corresponding to each job level among multiple job levels of the target enterprise; and configuring permissions for the target object based on the permission configuration policy.

[0006] Furthermore, before obtaining the permission configuration policy corresponding to the target object from the target permission policy tree based on the role change information, the permission configuration method also includes: obtaining department permission information, wherein the department permission information includes at least the permission information of the first permission that meets the office needs of the target company's employees, the permission information of the second permission of each of the multiple departments of the target company, and the permission information of the third permission of each of the multiple job levels corresponding to each department, wherein the permission scope of the first permission is smaller than the permission scope of the second permission, and the permission scope of the second permission is smaller than the permission scope of the third permission; generating an initial permission policy tree based on the department permission information, wherein the initial permission policy tree includes at least a first node, a second node, and a third node.

[0007] Furthermore, after generating the initial permission policy tree based on the department permission information, the permission configuration method also includes: updating the first node in the initial permission policy tree based on the permission information of the first permission, updating the second node in the initial permission policy tree based on the permission information of the second permission, and updating the third node in the initial permission policy tree based on the permission information of the third permission, to obtain the target permission policy tree.

[0008] Furthermore, configuring permissions for the target object based on the permission configuration policy includes: determining the first permission group where the target object is currently located based on role change information; deleting the domain account corresponding to the target object from the first permission group; determining the target permission group corresponding to the target object based on the permission configuration policy; and adding the domain account corresponding to the target object to the target permission group to configure permissions for the target object.

[0009] Furthermore, the permission configuration method also includes: after configuring permissions for the target object based on the permission configuration policy, obtaining a permission configuration instruction, wherein the permission configuration instruction is used to configure target permissions for the target object, the target permission being the permission requested by the target object to access data corresponding to other departments, other departments being departments within the target enterprise other than the department to which the target object belongs, and the permission configuration instruction carrying the permission information of the target permission; adding the target object to a target list according to the permission configuration instruction, wherein the target list is used to prevent the target permission requested by the target object from being judged as an abnormal permission; determining a second permission group based on the permission information of the target permission, wherein the second permission group is the permission group corresponding to other departments; and adding the domain account corresponding to the target object to the second permission group to realize the configuration of target permissions for the target object.

[0010] Furthermore, after configuring permissions for the target object based on the permission configuration strategy, the permission configuration method includes: obtaining the current permission information and role information of the target object at preset intervals, wherein the current permission information is the permission information that the target object has at the current moment, and the role information of the target object includes at least the department information of the department to which the target object belongs and the job level information of the target object; detecting whether the target object has abnormal permissions based on the current permission information and role information, wherein abnormal permissions are permissions in the current permission information that do not match the role information.

[0011] Furthermore, based on the current permission information and role information, the detection of whether the target object has abnormal permissions includes: obtaining the current permission configuration policy corresponding to the target object from the target permission policy tree based on the role information; comparing whether the current permission information is the same as the permission information in the current permission configuration policy; if the current permission information is the same as the permission information in the current permission configuration policy, determining that the target object does not have abnormal permissions; if the current permission information is different from the permission information in the current permission configuration policy, determining that the target object has abnormal permissions, and freezing the abnormal permissions, wherein the permission freezing is used to prevent the target object from continuing to use the abnormal permissions.

[0012] According to another aspect of this application, a permission configuration device is also provided, comprising: a first acquisition module, configured to acquire role change information of a target object whose permissions are to be configured, wherein the role change information includes change information of the department to which the target object belongs and / or change information of the job level of the target object; a second acquisition module, configured to acquire a permission configuration policy corresponding to the target object from a target permission policy tree based on the role change information, wherein the target permission policy tree is used to store permission information corresponding to each of the multiple departments of the target enterprise and permission information corresponding to each of the multiple job levels of the target enterprise; and a configuration module, configured to configure permissions for the target object based on the permission configuration policy.

[0013] According to another aspect of this application, a computer-readable storage medium is also provided, in which a computer program is stored, wherein the computer program is configured to execute the above-described permission configuration method at runtime.

[0014] According to another aspect of this application, an electronic device is also provided, the electronic device including one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the above-described permission configuration method at runtime.

[0015] In this application, the first step is to obtain the role change information of the target object whose permissions are to be configured. This role change information includes changes in the department to which the target object belongs and / or changes in the job level of the target object. Then, based on the role change information, the permission configuration policy corresponding to the target object is obtained from the target permission policy tree. This target permission policy tree stores the permission information corresponding to each department in the target company and the permission information corresponding to each job level in the target company. Finally, permissions are configured for the target object based on the permission configuration policy.

[0016] In the above process, by automatically obtaining the role change information of the target object, and obtaining the corresponding permission configuration policy of the target object from the target permission policy tree based on the role change information, the permission is automatically configured for the target object based on the permission configuration policy. There is no need to manually allocate permissions for the target object, thereby improving the efficiency of permission configuration, reducing human resource costs, and solving the technical problem of low permission configuration efficiency caused by manually allocating permissions in the existing technology. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a flowchart of an optional permission configuration method according to an embodiment of this application;

[0019] Figure 2 This is a schematic diagram of an optional permission configuration system according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of an optional target permission policy tree according to an embodiment of this application;

[0021] Figure 4 This is a schematic diagram of an optional permission configuration device according to an embodiment of this application;

[0022] Figure 5 This is a schematic diagram of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It should be noted that the permission configuration method, apparatus, storage medium and electronic device of this application can be used in the field of financial technology, as well as in other fields other than financial technology. The application fields of the permission configuration method, apparatus, storage medium and electronic device of this application are not limited.

[0026] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, if there is an interface between this system and the relevant user or organization, before obtaining the relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving the consent information from the aforementioned user or organization.

[0027] Example 1

[0028] According to an embodiment of this application, a method embodiment for permission configuration is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] For ease of description, some terms or nouns used in this embodiment are explained below:

[0030] Active Directory (AD) domain policy: A computer endpoint management policy. AD stands for Active Directory, and a domain is an independent unit operating within a Windows computer network. Domains are based on trust relationships, and computer management policies can be issued to each domain through a Domain Controller (DC) to achieve endpoint control. This enables shared management of network resources, mutual communication, and data transmission between different computer domains. The domain controller is a server maintained by enterprise office operations and maintenance personnel to manage domain users within its jurisdiction. Each domain user corresponds to an AD domain account.

[0031] Figure 1 This is a flowchart of an optional permission configuration method according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0032] Step S101: Obtain the role change information of the target object whose permissions are to be configured.

[0033] In an optional embodiment, a permission configuration system can serve as the execution subject of the permission configuration method in this application embodiment. For ease of description, the permission configuration system will be referred to as the system below. The permission configuration system includes, for example,... Figure 2 The system includes a database, a permission configuration module, a monitoring module, a logging module, and a message queue. The permission configuration module comprises a basic permission configuration unit and a special permission configuration unit. The monitoring module includes a scheduled task unit and a security check unit. The database stores information such as target object role changes, target permission policy trees, and special permission request information. The basic permission configuration unit automatically configures permissions when a target object's role changes. The special permission configuration unit automatically configures permissions when a target object requests special permissions such as cross-departmental permissions. The monitoring module periodically checks employee permissions, scanning and comparing for any abnormal permissions. The logging module records employee permission requests, administrator operation logs, and abnormal permission handling information for subsequent auditing. The message queue handles personnel special permission request approvals and abnormal permission processing.

[0034] In step S101, the role change information includes changes in the department to which the target object belongs and / or changes in the target object's job level. For example, the role change information may only be a change in the target object's department from department 1 to department 2; or the role change information may only be a change in the target object's job level from job level 1 to job level 2, wherein the authority scope of job level 2 is greater than that of job level 1; or the role change information may be a change in both the target object's department from department 1 to department 2 and the target object's job level from job level 1 to job level 2.

[0035] Optionally, the system can periodically retrieve the target object's current role information from the database and determine whether the target object's role information has changed by comparing the current role information with historical role information. When the system determines that the target object's role information has changed, it can automatically obtain the role change information.

[0036] It should be noted that the system determines whether the target object's role information has changed by periodically monitoring whether the target object's role information has changed. This enables the system to automatically obtain the target object's role change information when the target object's role information changes, thus preparing data for configuring permissions for the target object based on the role change information.

[0037] Step S102: Obtain the permission configuration policy corresponding to the target object from the target permission policy tree based on the role change information.

[0038] In step S102, the target permission policy tree is used to store the permission information corresponding to each department among multiple departments of the target enterprise, and the permission information corresponding to each job level among multiple job levels of the target enterprise. For example, as Figure 3 The target permission policy tree shown stores the permission information corresponding to Department 1, Department 2, ... Department n in the Department Permission 1 node, Department Permission 2 node, ... Department n node, respectively; and the Job Level Permission 1 node, Job Level Permission 1 node, and Job Level Permission 3 node store the permission information corresponding to each job level, respectively.

[0039] For example, when the role change information is that the target object's department changes from department 1 to department 2, the system can obtain the corresponding permission information for department 2 from the target permission policy tree based on the information for department 2, and determine the permission configuration policy based on the permission information for department 2. Optionally, when the role change information is only that the target object's department changes from department 1 to department 2, the system can also obtain the target object's current job level, obtain the permission information for department 2 corresponding to the current job level from the target permission policy tree based on the current job level, obtain the corresponding permission information for department 2 from the target permission policy tree based on the information for department 2, and determine the permission configuration policy based on the permission information for the current job level and the permission information for department 2.

[0040] Step S103: Configure permissions for the target object based on the permission configuration policy.

[0041] In step S103, the system can determine the target permission group corresponding to the target object through the permission configuration policy, and add the domain account corresponding to the target object to the target permission group to configure permissions for the target object. For example, the system determines that the permission group corresponding to the target object is permission group A through the permission information in the permission configuration policy. At this time, the system adds the AD domain account corresponding to the target object to permission group A to configure the permissions corresponding to permission group A for the target object.

[0042] Based on the scheme defined in steps S101 to S103 above, it can be understood that in this embodiment of the application, firstly, the role change information of the target object to be configured with permissions is obtained, wherein the role change information includes the change information of the department to which the target object belongs and / or the change information of the job level of the target object; then, the permission configuration policy corresponding to the target object is obtained from the target permission policy tree according to the role change information, wherein the target permission policy tree is used to store the permission information corresponding to each department in the multiple departments of the target enterprise, and the permission information of each job level in the multiple job levels of the target enterprise; finally, permissions are configured for the target object based on the permission configuration policy.

[0043] It is noteworthy that in the above process, by automatically obtaining the role change information of the target object and obtaining the corresponding permission configuration policy of the target object from the target permission policy tree based on the role change information, the permission is automatically configured for the target object based on the permission configuration policy. There is no need to manually assign permissions to the target object, thereby improving the efficiency of permission configuration, reducing human resource costs, and solving the technical problem of low permission configuration efficiency caused by manually assigning permissions in the prior art.

[0044] Optionally, the permission configuration method provided in this application embodiment further includes: before obtaining the permission configuration policy corresponding to the target object from the target permission policy tree based on role change information, the system may obtain department permission information, wherein the department permission information includes at least the permission information of the first permission that meets the office needs of the target company's employees, the permission information of the second permission of each of the multiple departments of the target company, and the permission information of the third permission of each of the multiple job levels corresponding to each department, wherein the permission scope of the first permission is smaller than the permission scope of the second permission, and the permission scope of the second permission is smaller than the permission scope of the third permission; then an initial permission policy tree is generated based on the department permission information, wherein the initial permission policy tree includes at least a first node, a second node, and a third node.

[0045] In this embodiment, the first node in the initial permission policy tree is... Figure 3 The basic permission node shown is the second node. Figure 3The shown nodes are Department Permission 1, Department Permission 2, ..., Department Permission n. The third node is... Figure 3 The diagram shows a hierarchy permission node (1), hierarchy permission node (2), hierarchy permission node (3), etc. The system can generate an initial permission policy tree based on the permission information of the first permission (meeting the office needs of the target company's employees), the permission information of the second permission (each of the target company's multiple departments), and the permission information of the third permission (each of the multiple job levels within each department). The second permission is the minimum permission required to meet the office needs of the department's employees, and its permission information includes the minimum permission information required to meet the target company's employees' office needs (i.e., the first permission information). The third permission has different scopes for different job levels within each department; higher job levels have wider scopes, and higher job level permission information includes the permission information of lower job levels. For example, as... Figure 3 As shown, the job level corresponding to the job level permission node 2 is higher than the job level corresponding to the job level permission node 1. Therefore, the permission range of the job level permission node 2 is greater than the permission range of the job level permission node 1.

[0046] It should be noted that the system generates an initial permission policy tree by using the permission information of the first permission that meets the office needs of the target company's employees, the permission information of the second permission of each department in the target company, and the permission information of the third permission of each job level in each department, in order to prepare data for the subsequent generation of the target permission policy tree.

[0047] Furthermore, after generating an initial permission policy tree based on departmental permission information, the system can update the first node in the initial permission policy tree based on the permission information of the first permission, update the second node in the initial permission policy tree based on the permission information of the second permission, and update the third node in the initial permission policy tree based on the permission information of the third permission, thereby obtaining the target permission policy tree.

[0048] For example, the system can insert the permission information of the first permission. Figure 3 The system updates the basic permission nodes (i.e., the first node) in the initial permission policy tree; the system can then insert the permission information for the second permission into the tree. Figure 3 The system updates the second node in the initial permission policy tree, from the department permission 1 node, department permission 2 node... department permission n node (i.e., the second node); the system then inserts the permission information of the third permission into the second node. Figure 3 In the shown job level permission 1 node, job level permission 2 node... (i.e. the third node), the third node in the initial permission policy tree is updated to obtain the target permission policy tree.

[0049] It should be noted that the system updates the nodes in the initial permission policy tree based on the permission information of the first permission, the second permission, and the third permission to obtain the target permission policy tree, thus preparing data for determining the permission configuration policy based on the target permission policy tree.

[0050] Optionally, the permission configuration method provided in this application embodiment further includes: the system determines the first permission group where the target object is currently located based on role change information; then deletes the domain account corresponding to the target object from the first permission group; then determines the target permission group corresponding to the target object based on the permission configuration policy; and finally adds the domain account corresponding to the target object to the target permission group to configure permissions for the target object.

[0051] In this embodiment, the system can be implemented using Windows-based Active Directory (AD) domain policies, where the domain account corresponding to the target object can be an AD domain account. For example, when configuring document permissions for employees, the system can set different permission groups (e.g., AD domain groups) for each shared folder on the document server based on different permission information. When an employee's department information changes from department 1 to department 2, the system's basic permission configuration unit can delete the AD domain account from the first permission group where the employee was in department 1 and add the employee to the target permission group corresponding to department 2, thereby configuring permissions for the target object.

[0052] Optionally, when the system detects a new employee, it automatically assigns the new employee an Active Directory (AD) domain account and adds the new employee's AD domain account to the basic permission group to meet the new employee's basic office needs. When the system detects an employee leaving the company, it automatically removes the departing employee's AD domain account from its permission group to reduce the risk of corporate information security leaks.

[0053] It should be noted that the system manages access permissions through different Active Directory domain groups by deleting the domain account corresponding to the target object from the first permission group where the target object is currently located and adding the domain account corresponding to the target object to the target permission group. This enables precise distribution of permissions, improves the efficiency of permission configuration, and solves the technical problem of low permission configuration efficiency caused by manually allocating permissions in the existing technology.

[0054] In one optional embodiment, after configuring permissions for a target object based on a permission configuration policy, the system obtains a permission configuration instruction. This instruction is used to configure target permissions for the target object. The target permissions are the permissions requested by the target object to access data corresponding to other departments. Other departments are departments within the target enterprise other than the department to which the target object belongs. The permission configuration instruction carries the permission information of the target permissions. Then, based on the permission configuration instruction, the target object is added to a target list. This target list is used to prevent the target object's requested target permissions from being judged as abnormal permissions. Next, a second permission group is determined based on the permission information of the target permissions. This second permission group is the permission group corresponding to other departments. Finally, the domain account corresponding to the target object is added to the second permission group to complete the configuration of target permissions for the target object.

[0055] In this embodiment, when a target object needs to apply for cross-project team data access permissions or cross-department data access permissions, the target object can submit a permission application request to [email address]. Figure 2 In the message queue, a request is made to access data from other departments. The administrator approves the permission request submitted by the target object. After approval, the system generates a permission configuration instruction to configure the target permission for the target object. Then, the special permission configuration unit of the system obtains and responds to the permission configuration instruction to add the target object to the target list. Then, the special permission configuration unit determines the second permission group corresponding to the other departments that the target object requests to access based on the permission information of the target permission. Finally, the system adds the domain account of the target object to the second permission group to complete the configuration of the target permission for the target object.

[0056] Optionally, when a target object first requests temporary sharing permissions or permissions for special confidential files, the administrator can set up a new permission group, generate a special permission group, and add the target object's AD domain account to the special permission group to achieve the allocation of temporary sharing permissions or permissions for special confidential files. This special permission group can be maintained in the system subsequently.

[0057] It should be noted that when a target requests permission to access data from other departments or access specially confidential documents, the system can automatically configure permissions for the target after approval, achieving precise permission configuration. By adding the target to the target list, the system avoids the target's permissions being judged as abnormal and thus unable to be used.

[0058] In another optional embodiment, after configuring permissions for the target object based on the permission configuration policy, the system obtains the target object's current permission information and the target object's role information at preset intervals. The current permission information is the permission information that the target object has at the current moment, and the target object's role information includes at least the department information of the department to which the target object belongs and the target object's job level information. Then, based on the current permission information and role information, the system detects whether the target object has abnormal permissions. Abnormal permissions are permissions in the current permission information that do not match the role information.

[0059] In this embodiment, the system obtains the current permission information and role information of the target object from the database at preset intervals through a timed task unit, and sends the above information to the system's security check unit. The security check unit initiates a check task to detect the current permission information and role information to determine whether the target object has abnormal permissions.

[0060] It should be noted that the system periodically checks current permission information and role information to detect whether the target object has abnormal permissions, and mitigates the risk of abnormal permissions that the target object may have, thereby reducing the risk of leakage of enterprise data information.

[0061] Furthermore, the system can obtain the current permission configuration policy corresponding to the target object from the target permission policy tree based on the role information; then compare the current permission information with the permission information in the current permission configuration policy; if the current permission information is the same as the permission information in the current permission configuration policy, it is determined that the target object does not have abnormal permissions; if the current permission information is different from the permission information in the current permission configuration policy, it is determined that the target object has abnormal permissions, and the abnormal permissions are frozen. The permission freezing process is used to prevent the target object from continuing to use the abnormal permissions.

[0062] In this embodiment, the system can obtain the current permission configuration policy corresponding to the target object from the target permission policy tree based on role information. The system determines whether the target object has abnormal permissions by comparing whether the current permission information of the target object is the same as the permission information in the current permission configuration policy. If the current permission information is the same as the permission information in the current permission configuration policy, it is determined that the target object does not have abnormal permissions. If the current permission information is different from the permission information in the current permission configuration policy, the system determines that the target object has abnormal permissions, freezes the abnormal permissions, and notifies the administrator to verify the abnormal permissions.

[0063] It should be noted that the system determines whether a target object has abnormal permissions by comparing its current permission information with the permission information in the current permission configuration policy. It can accurately determine whether there is any abnormal permission information in the target object's current permission information. When it is determined that the target object has abnormal permissions, it freezes the abnormal permissions in a timely manner to prevent the target object from continuing to use the abnormal permissions. This mitigates the risk of abnormal permissions that the target object may have and reduces the risk of leakage of enterprise data information.

[0064] Therefore, the permission configuration method provided in this application can automatically obtain the target object's role change information and retrieve the corresponding permission configuration policy from the target permission policy tree based on the role change information. Permissions are automatically configured for the target object based on the permission configuration policy, eliminating the need for manual permission allocation. This improves permission configuration efficiency, reduces labor costs, and solves the technical problem of low permission configuration efficiency caused by manual permission allocation in existing technologies. When a target object requests permission to access data from other departments or access special confidential documents, permissions can be automatically configured for the target object after approval, achieving precise permission configuration. By comparing the target object's current permission information with the permission information in the current permission configuration policy, it can determine whether the target object has abnormal permissions, accurately identifying whether abnormal permissions exist in the target object's current permission information. When abnormal permissions are determined, the abnormal permissions are promptly frozen to prevent the target object from continuing to use them, mitigating the risk of potential abnormal permissions and reducing the risk of enterprise data leakage.

[0065] Example 2

[0066] According to an embodiment of this application, an embodiment of a permission configuration device is provided, wherein... Figure 4 A schematic diagram of an optional permission configuration device according to an embodiment of this application is shown below. Figure 4 As shown, the device includes:

[0067] The first acquisition module 401 is used to acquire the role change information of the target object whose permissions are to be configured, wherein the role change information includes the change information of the department to which the target object belongs and / or the change information of the target object's job level;

[0068] The second acquisition module 402 is used to acquire the permission configuration policy corresponding to the target object from the target permission policy tree based on the role change information. The target permission policy tree is used to store the permission information corresponding to each department in the multiple departments of the target enterprise, and the permission information corresponding to each job level in the multiple job levels of the target enterprise.

[0069] Configuration module 403 is used to configure permissions for target objects based on permission configuration policies.

[0070] It should be noted that the first acquisition module 401, the second acquisition module 402 and the configuration module 403 mentioned above correspond to steps S101 to S103 in the above embodiments. The examples and application scenarios implemented by the three modules and the corresponding steps are the same, but are not limited to the content disclosed in the above embodiment 1.

[0071] Optionally, the permission configuration device further includes: a third acquisition module, used to acquire department permission information before acquiring the permission configuration policy corresponding to the target object from the target permission policy tree based on role change information, wherein the department permission information includes at least the permission information of the first permission that meets the office needs of the target company's employees, the permission information of the second permission of each of the multiple departments of the target company, and the permission information of the third permission of each of the multiple job levels corresponding to each department, wherein the permission scope of the first permission is smaller than the permission scope of the second permission, and the permission scope of the second permission is smaller than the permission scope of the third permission; and a first generation module, used to generate an initial permission policy tree based on the department permission information, wherein the initial permission policy tree includes at least a first node, a second node, and a third node.

[0072] Optionally, the permission configuration device further includes: an update module, used to update the first node in the initial permission policy tree based on the permission information of the first permission, update the second node in the initial permission policy tree based on the permission information of the second permission, and update the third node in the initial permission policy tree based on the permission information of the third permission, after generating the initial permission policy tree based on the department permission information, to obtain the target permission policy tree.

[0073] Optionally, the configuration module includes: a first determining unit, used to determine the first permission group currently occupied by the target object based on role change information; a first deleting unit, used to delete the domain account corresponding to the target object from the first permission group; a second determining unit, used to determine the target permission group corresponding to the target object based on the permission configuration policy; and a first adding unit, used to add the domain account corresponding to the target object to the target permission group, so as to configure permissions for the target object.

[0074] Optionally, the permission configuration device further includes: a fourth acquisition module, used to acquire a permission configuration instruction after configuring permissions for a target object based on a permission configuration policy, wherein the permission configuration instruction is used to configure target permissions for the target object, the target permissions being the permissions requested by the target object to access data corresponding to other departments, other departments being departments within the target enterprise other than the department to which the target object belongs, and the permission configuration instruction carrying permission information of the target permissions; a first addition module, used to add the target object to a target list according to the permission configuration instruction, wherein the target list is used to prevent the target permissions requested by the target object from being judged as abnormal permissions; a first determination module, used to determine a second permission group based on the permission information of the target permissions, wherein the second permission group is the permission group corresponding to other departments; and a second addition module, used to add the domain account corresponding to the target object to the second permission group to realize the configuration of target permissions for the target object.

[0075] Optionally, the permission configuration device further includes: a fifth acquisition module, used to acquire the current permission information and role information of the target object at preset intervals after configuring permissions for the target object based on the permission configuration policy, wherein the current permission information is the permission information that the target object has at the current moment, and the role information of the target object includes at least the department information of the department to which the target object belongs and the job level information of the target object; and a detection module, used to detect whether the target object has abnormal permissions based on the current permission information and role information, wherein abnormal permissions are permissions in the current permission information that do not match the role information.

[0076] Optionally, the detection module includes: a first acquisition unit, used to acquire the current permission configuration policy corresponding to the target object from the target permission policy tree based on role information; a comparison unit, used to compare whether the current permission information is the same as the permission information in the current permission configuration policy; a third determination unit, used to determine that the target object does not have abnormal permissions when the current permission information is the same as the permission information in the current permission configuration policy; and a fourth determination unit, used to determine that the target object has abnormal permissions when the current permission information is different from the permission information in the current permission configuration policy, and to freeze the abnormal permissions, wherein the permission freezing is used to prevent the target object from continuing to use the abnormal permissions.

[0077] Example 3

[0078] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, in which a computer program is stored, wherein the computer program is configured to execute the above-described permission configuration method at runtime.

[0079] Example 4

[0080] According to another aspect of the embodiments of this application, an electronic device is also provided, wherein, Figure 5 This is a schematic diagram of an optional electronic device according to an embodiment of this application, such as... Figure 5 As shown, the electronic device includes one or more processors; and a memory for storing one or more programs, which, when executed by one or more processors, enable the one or more processors to run the programs, wherein the programs are configured to execute the aforementioned permission configuration method at runtime.

[0081] like Figure 5 As shown, this application embodiment provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps:

[0082] Obtain the role change information of the target object whose permissions are to be configured, including changes in the department to which the target object belongs and / or changes in the job level of the target object; obtain the permission configuration policy corresponding to the target object from the target permission policy tree based on the role change information, wherein the target permission policy tree is used to store the permission information corresponding to each department in the target enterprise and the permission information corresponding to each job level in the target enterprise; configure permissions for the target object based on the permission configuration policy.

[0083] Optionally, the processor, when executing the program, further implements the following steps: before obtaining the permission configuration policy corresponding to the target object from the target permission policy tree based on the role change information, obtaining department permission information, wherein the department permission information includes at least the permission information of the first permission that meets the office needs of the target company's employees, the permission information of the second permission of each of the multiple departments of the target company, and the permission information of the third permission of each of the multiple job levels corresponding to each department, wherein the permission scope of the first permission is smaller than the permission scope of the second permission, and the permission scope of the second permission is smaller than the permission scope of the third permission; generating an initial permission policy tree based on the department permission information, wherein the initial permission policy tree includes at least a first node, a second node, and a third node.

[0084] Optionally, when the processor executes the program, it also performs the following steps: after generating an initial permission policy tree based on the department permission information, it updates the first node in the initial permission policy tree based on the permission information of the first permission, updates the second node in the initial permission policy tree based on the permission information of the second permission, and updates the third node in the initial permission policy tree based on the permission information of the third permission, thereby obtaining the target permission policy tree.

[0085] Optionally, when the processor executes the program, it also performs the following steps: determining the first permission group where the target object is currently located based on the role change information; deleting the domain account corresponding to the target object from the first permission group; determining the target permission group corresponding to the target object based on the permission configuration policy; and adding the domain account corresponding to the target object to the target permission group to configure permissions for the target object.

[0086] Optionally, the processor, when executing the program, further implements the following steps: after configuring permissions for the target object based on the permission configuration policy, obtaining a permission configuration instruction, wherein the permission configuration instruction is used to configure target permissions for the target object, the target permission being the permission requested by the target object to access data corresponding to other departments, other departments being departments within the target enterprise other than the department to which the target object belongs, and the permission configuration instruction carrying permission information of the target permission; adding the target object to a target list according to the permission configuration instruction, wherein the target list is used to prevent the target permission requested by the target object from being judged as an abnormal permission; determining a second permission group based on the permission information of the target permission, wherein the second permission group is the permission group corresponding to other departments; adding the domain account corresponding to the target object to the second permission group to realize the configuration of target permissions for the target object.

[0087] Optionally, when the processor executes the program, it also performs the following steps: after configuring permissions for the target object based on the permission configuration policy, it obtains the current permission information and role information of the target object at preset intervals, wherein the current permission information is the permission information that the target object has at the current moment, and the role information of the target object includes at least the department information of the department to which the target object belongs and the job level information of the target object; based on the current permission information and role information, it detects whether the target object has abnormal permissions, wherein abnormal permissions are permissions in the current permission information that do not match the role information.

[0088] Optionally, when the processor executes the program, it also implements the following steps: obtaining the current permission configuration policy corresponding to the target object from the target permission policy tree based on the role information; comparing whether the current permission information is the same as the permission information in the current permission configuration policy; if the current permission information is the same as the permission information in the current permission configuration policy, determining that the target object does not have abnormal permissions; if the current permission information is different from the permission information in the current permission configuration policy, determining that the target object has abnormal permissions, and freezing the abnormal permissions, wherein the permission freezing is used to prevent the target object from continuing to use the abnormal permissions.

[0089] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0090] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0091] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0092] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0093] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0094] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0095] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A permission configuration method, characterized in that, include: Obtain the role change information of the target object whose permissions are to be configured, wherein the role change information includes the change information of the department to which the target object belongs and / or the change information of the job level of the target object; Based on the role change information, the permission configuration policy corresponding to the target object is obtained from the target permission policy tree. The target permission policy tree is used to store the permission information corresponding to each of the multiple departments of the target enterprise and the permission information corresponding to each of the multiple job levels of the target enterprise. Configure permissions for the target object based on the permission configuration policy; Before retrieving the permission configuration policy corresponding to the target object from the target permission policy tree based on the role change information, the method further includes: Obtain department permission information, wherein the department permission information includes at least the permission information of the first permission to meet the office needs of the employees of the target enterprise, the permission information of the second permission of each of the multiple departments of the target enterprise, and the permission information of the third permission of each of the multiple job levels corresponding to each department, wherein the permission range of the first permission is smaller than the permission range of the second permission, and the permission range of the second permission is smaller than the permission range of the third permission. An initial permission policy tree is generated based on the department permission information, wherein the initial permission policy tree includes at least a first node, a second node, and a third node; After generating an initial permission policy tree based on the department permission information, the method further includes: The first node in the initial permission policy tree is updated based on the permission information of the first permission, the second node in the initial permission policy tree is updated based on the permission information of the second permission, and the third node in the initial permission policy tree is updated based on the permission information of the third permission, so as to obtain the target permission policy tree. After configuring permissions for the target object based on the permission configuration policy, the method further includes: Obtain permission configuration instructions, wherein the permission configuration instructions are used to configure target permissions for the target object, the target permissions are the permissions requested by the target object to access data corresponding to other departments, the other departments are departments within the target enterprise other than the department to which the target object belongs, and the permission configuration instructions carry permission information of the target permissions; The target object is added to the target list according to the permission configuration instruction, wherein the target list is used to prevent the target object from being judged as an abnormal permission; A second permission group is determined based on the permission information of the target permission, wherein the second permission group is the permission group corresponding to the other departments; Add the domain account corresponding to the target object to the second permission group to configure the target permission for the target object.

2. The method according to claim 1, characterized in that, Configure permissions for the target object based on the permission configuration policy, including: Based on the role change information, determine the first permission group currently occupied by the target object; Remove the domain account corresponding to the target object from the first permission group; The target permission group corresponding to the target object is determined based on the permission configuration policy; Add the domain account corresponding to the target object to the target permission group to configure the permissions for the target object.

3. The method according to claim 1, characterized in that, After configuring permissions for the target object based on the permission configuration policy, the method includes: At preset intervals, the current permission information and role information of the target object are obtained. The current permission information is the permission information that the target object has at the current moment. The role information of the target object includes at least the department information of the department to which the target object belongs and the job level information of the target object. Based on the current permission information and the role information, it is detected whether the target object has abnormal permissions, wherein the abnormal permissions are permissions in the current permission information that do not match the role information.

4. The method according to claim 3, characterized in that, Detecting whether the target object has abnormal permissions based on the current permission information and the role information includes: Based on the role information, obtain the current permission configuration policy corresponding to the target object from the target permission policy tree; Compare whether the current permission information is the same as the permission information in the current permission configuration policy; When the current permission information is the same as the permission information in the current permission configuration policy, it is determined that the target object does not have the abnormal permission; When the current permission information is different from the permission information in the current permission configuration policy, it is determined that the target object has the abnormal permission, and the abnormal permission is frozen. The permission freezing process is used to prevent the target object from continuing to use the abnormal permission.

5. A permission configuration device, characterized in that, include: The first acquisition module is used to acquire role change information of the target object whose permissions are to be configured, wherein the role change information includes change information of the department to which the target object belongs and / or change information of the job level of the target object; The second acquisition module is used to acquire the permission configuration policy corresponding to the target object from the target permission policy tree based on the role change information. The target permission policy tree is used to store the permission information corresponding to each of the multiple departments of the target enterprise and the permission information corresponding to each of the multiple job levels of the target enterprise. The configuration module is used to configure permissions for the target object based on the permission configuration policy; The device further includes: a third acquisition module, used to acquire departmental permission information before acquiring the permission configuration policy corresponding to the target object from the target permission policy tree based on role change information, wherein the departmental permission information includes at least the permission information of the first permission that meets the office needs of the target company's employees, the permission information of the second permission of each of the multiple departments of the target company, and the permission information of the third permission of each of the multiple job levels corresponding to each department, wherein the permission range of the first permission is smaller than the permission range of the second permission, and the permission range of the second permission is smaller than the permission range of the third permission; and a first generation module, used to generate an initial permission policy tree based on the departmental permission information, wherein the initial permission policy tree includes at least a first node, a second node, and a third node; The device further includes: an update module, used to update the first node in the initial permission policy tree based on the permission information of the first permission, update the second node in the initial permission policy tree based on the permission information of the second permission, and update the third node in the initial permission policy tree based on the permission information of the third permission, after generating the initial permission policy tree based on the department permission information, to obtain the target permission policy tree. The device further includes: a fourth acquisition module, used to acquire a permission configuration instruction after configuring permissions for a target object based on a permission configuration policy, wherein the permission configuration instruction is used to configure target permissions for the target object, the target permissions being the permissions requested by the target object to access data corresponding to other departments, other departments being departments within the target enterprise other than the department to which the target object belongs, and the permission configuration instruction carrying permission information of the target permissions; a first addition module, used to add the target object to a target list according to the permission configuration instruction, wherein the target list is used to prevent the target permissions requested by the target object from being judged as abnormal permissions; a first determination module, used to determine a second permission group based on the permission information of the target permissions, wherein the second permission group is the permission group corresponding to other departments; and a second addition module, used to add the domain account corresponding to the target object to the second permission group to realize the configuration of target permissions for the target object.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the permission configuration method according to any one of claims 1 to 4 at runtime.

7. An electronic device, characterized in that, The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to be configured to run the programs, wherein the programs are configured to execute the permission configuration method as described in any one of claims 1 to 4 at runtime.

Images