Permission allocation method and device, computer device, and storage medium

Abstract

The application relates to a permission allocation method and device, computer equipment and a storage medium. The method comprises the following steps: in the case that a new tenant is settled, according to basic information of the new tenant, a target tenant group to which the new tenant belongs is determined from a plurality of tenant groups; according to a preset corresponding relationship between a tenant group and a permission grouping result, a target permission grouping result corresponding to the target tenant group is determined; the target permission grouping result comprises a plurality of permission combinations; the correlation degree between the permissions in each permission combination satisfies a preset condition; the target permission grouping result is sent to equipment corresponding to the new tenant; and the target permission grouping result is used to allocate each permission in the same permission combination to a role created by the new tenant. The method can improve the permission allocation efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a permission allocation method and device, computer equipment and storage medium. BACKGROUND

[0002] With the development of computer technology, many business scenarios begin to use online systems, which greatly improves the efficiency of business processing, such as online mall management background or enterprise financial management system. In these systems, tenants need to allocate operation permissions to each member to achieve resource isolation and operation isolation, ensure normal business operation, and reduce security risks.

[0003] In the traditional method, the administrator of the tenant needs to allocate each permission of each role under the tenant, which requires the administrator to have a clear understanding of each permission and to perform complex configuration operations, resulting in low efficiency of permission allocation. SUMMARY

[0004] Therefore, it is necessary to provide a permission allocation method and device, computer equipment, computer readable storage medium and computer program product that can improve efficiency in view of the above technical problems.

[0005] In a first aspect, the present application provides a permission allocation method. The method comprises:

[0006] In the case of a new tenant, according to the basic information of the new tenant, determine the target tenant group to which the new tenant belongs from a plurality of tenant groups;

[0007] According to the pre-set corresponding relationship between the tenant group and the permission grouping result, determine the target permission grouping result corresponding to the target tenant group; the target permission grouping result includes a plurality of permission combinations; the association degree between the permissions in each permission combination satisfies a preset condition;

[0008] Send the target permission grouping result to the device corresponding to the new tenant; the target permission grouping result is used to allocate each permission in the same permission combination to the role created by the new tenant.

[0009] In a second aspect, the present application further provides a permission allocation device. The device comprises:

[0010] A tenant grouping module is configured to, in the case of a new tenant, determine the target tenant group to which the new tenant belongs from a plurality of tenant groups according to the basic information of the new tenant;

[0011] The permission grouping module is configured to determine a target permission grouping result corresponding to the target tenant group according to a preset correspondence between the tenant group and the permission grouping result; the target permission grouping result includes a plurality of permission combinations; and a correlation degree between permissions in each of the permission combinations satisfies a preset condition.

[0012] The permission allocation module is configured to send the target permission grouping result to a device corresponding to the new tenant; and the target permission grouping result is used to allocate each permission in a same permission combination to a role created by the new tenant.

[0013] In one of the embodiments, the tenant grouping module is further configured to group each of the existing tenants according to basic information of each of the existing tenants, to obtain a plurality of tenant groups.

[0014] The permission grouping module is further configured to, for each of the tenant groups, calculate a first operation correlation degree between each of the permissions according to actual operation conditions of each of the existing tenants in the tenant group with respect to operations corresponding to each of the permissions; calculate a first allocation correlation degree between each of the permissions according to actual allocation conditions of each of the existing tenants in the tenant group with respect to each of the permissions; determine a target correlation degree between each of the permissions according to the first operation correlation degree and the first allocation correlation degree; and group each of the permissions according to the target correlation degree, to obtain a permission grouping result corresponding to the tenant group.

[0015] In one of the embodiments, the permission grouping module is further configured to calculate a second operation correlation degree between each of the permissions according to actual operation conditions of each of the existing tenants in the plurality of tenant groups with respect to operations corresponding to each of the permissions; calculate a second allocation correlation degree between each of the permissions according to actual allocation conditions of each of the existing tenants in the plurality of tenant groups with respect to each of the permissions; and determine a target correlation degree between each of the permissions according to the first operation correlation degree, the first allocation correlation degree, the second operation correlation degree, and the second allocation correlation degree.

[0016] In one of the embodiments, the basic information includes basic information in a plurality of dimensions; and the tenant grouping module is further configured to determine, according to the basic information of each of the existing tenants in each of the dimensions, an initial tenant group to which each of the existing tenants is divided in each of the dimensions; and determine an existing tenant whose initial tenant groups in each of the dimensions are consistent as belonging to a same tenant group.

[0017] In one of the embodiments, the tenant is a tenant in a management background of an online mall; and the basic information in each of the dimensions includes at least two of a member quantity, a shop quantity, a total quantity of goods, and a recent increment of goods of the tenant.

[0018] In one of the embodiments, the permission grouping module is further configured to determine, for each of the tenant groups, a time interval between any two operations performed by each of the existing tenants in the tenant group according to actual operation conditions of the operations corresponding to each of the permissions by each of the existing tenants in the tenant group; calculate a first operation correlation degree between two permissions corresponding to the two operations according to the time interval of the two operations; determine a proportion of assigning any two permissions to a same role by each of the existing tenants in the tenant group according to actual assignment conditions of the permissions by each of the existing tenants in the tenant group; and calculate a first assignment correlation degree between the two permissions according to the proportion corresponding to the two permissions.

[0019] In one of the embodiments, the permission grouping module is further configured to divide the permissions with the target correlation degree greater than or equal to a preset threshold into a same permission combination to obtain a plurality of permission combinations included in the permission grouping result corresponding to the tenant group.

[0020] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the computer program is executed by the processor to make the processor perform the steps of the permission assignment method described in the embodiments of the present application.

[0021] In a fourth aspect, the present application further provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by a processor to make the processor perform the steps of the permission assignment method described in the embodiments of the present application.

[0022] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and the computer program is executed by a processor to make the processor perform the steps of the permission assignment method described in the embodiments of the present application.

[0023] The permission allocation method, device, computer device, storage medium and computer program product can, in the case of a new tenant, determine a target tenant group to which the new tenant belongs from a plurality of tenant groups according to basic information of the new tenant, determine a target permission grouping result corresponding to the target tenant group according to a preset correspondence between the tenant groups and the permission grouping results, the target permission grouping result including a plurality of permission combinations, the degrees of association between the permissions in each permission combination satisfying a preset condition, and then send the target permission grouping result to a device corresponding to the new tenant, the target permission grouping result being used to allocate each permission in a same permission combination included in the target permission grouping result to a role created by the new tenant, so that the target permission grouping result corresponding to the target tenant group to which the new tenant belongs can be quickly determined, and each permission in a same permission combination included in the target permission grouping result can be allocated to the role created by the new tenant, without allocating the permissions to the role one by one, thereby greatly improving the permission allocation efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 An application environment diagram of a permission allocation method in an embodiment;

[0025] Figure 2 A flowchart of a permission allocation method in an embodiment;

[0026] Figure 3 A schematic diagram of an overall flow of a permission allocation method in an embodiment;

[0027] Figure 4 A structural block diagram of a permission allocation device in an embodiment;

[0028] Figure 5 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0029] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0030] The permission allocation method provided by the embodiments of the present application can be applied to, for example, Figure 1The application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. The server 104 can execute the permission allocation method in the embodiments of the present application to determine the corresponding target permission grouping result in the case of new tenants moving in, and send the target permission grouping result to the terminal 102 corresponding to the new tenant. Among them, the terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart TV, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0031] In some embodiments, as shown in Figure 2 , a permission allocation method is provided, which is applied to Figure 1 The server 104 in the above-mentioned system as an example, including the following steps:

[0032] Step 202, in the case of new tenants moving in, according to the basic information of the new tenant, determine the target tenant group to which the new tenant belongs from the multiple tenant groups.

[0033] Among them, the tenant is a collective or organization using the system. For example: the enterprise using the online mall management background is the tenant. The tenant newly moved in after obtaining multiple tenant groups and the permission grouping results corresponding to each tenant group is the new tenant. The basic information is the information used to reflect the basic characteristics of the tenant.

[0034] In some embodiments, the new tenant can estimate the basic information and then input it into the system. The server can obtain the basic information input by the new tenant, and determine the target tenant group to which the new tenant belongs from the multiple tenant groups according to the basic information of the new tenant.

[0035] In some embodiments, the basic information can include basic information in multiple dimensions. The server can determine the initial tenant group to which the new tenant is divided in each dimension according to the basic information of the new tenant in each dimension, and then determine the target tenant group to which the new tenant belongs from the multiple tenant groups according to the initial tenant group to which the new tenant is divided in each dimension. The initial tenant group to which each tenant in the target tenant group is divided in each dimension is consistent with the new tenant.

[0036] For example, assuming that the basic information includes basic information in four dimensions of A, B, C, and D, the new tenant is divided into an initial tenant group A1 in the dimension of A, an initial tenant group B4 in the dimension of B, an initial tenant group C2 in the dimension of C, and an initial tenant group D5 in the dimension of D, the server can determine a target tenant group to which the new tenant belongs from the plurality of tenant groups, and each tenant in the target tenant group satisfies being divided into the initial tenant group A1 in the dimension of A, being divided into the initial tenant group B4 in the dimension of B, being divided into the initial tenant group C2 in the dimension of C, and being divided into the initial tenant group D5 in the dimension of D.

[0037] In some embodiments, in a case where the tenant is a tenant in an online mall management background, the basic information in each dimension includes at least two of a member quantity, a store quantity, a total quantity of goods, and a recent increment of goods of the tenant. The member quantity refers to a quantity of members in a collective or organization corresponding to the tenant.

[0038] In some embodiments, the server can group each existing tenant according to the basic information of each existing tenant in advance to obtain a plurality of tenant groups. The existing tenant is a tenant that has settled in after a period of operation of the system.

[0039] In step 204, a target tenant group corresponding target permission grouping result is determined according to a preset corresponding relationship between the tenant group and the permission grouping result. The target permission grouping result includes a plurality of permission combinations. The association degree between the permissions in each permission combination satisfies a preset condition.

[0040] Each permission grouping result includes a plurality of permission combinations. Each permission combination includes a plurality of permissions. The permission refers to the permission to perform a specific operation in the system. For example, the permission can include the permission to configure goods, the permission to review goods, or the permission to put goods on shelves.

[0041] In some embodiments, the association degree between each permission in each permission combination is greater than or equal to a preset threshold.

[0042] In some embodiments, the server can calculate the target association degree between each permission according to the actual operation of each tenant in each tenant group to the operation corresponding to each permission and the actual allocation of each tenant to each permission for each tenant group in advance, and then group each permission according to the target association degree to obtain the permission grouping result corresponding to the tenant group.

[0043] In some embodiments, the server can calculate the target correlation degree between each permission according to the actual operation of each tenant in the tenant group for the operation corresponding to each permission and the actual allocation of each tenant in the tenant group for each permission, and the actual operation of each tenant in the plurality of tenant groups for the operation corresponding to each permission and the actual allocation of each tenant in the plurality of tenant groups for each permission, and then group the permissions according to the target correlation degree to obtain the permission grouping result corresponding to the tenant group.

[0044] Step 206, sending the target permission grouping result to the device corresponding to the new tenant; the target permission grouping result is used to allocate each permission in the same permission combination to the role created by the new tenant.

[0045] The role refers to a virtual identity with certain operation permissions created by the tenant in the system. The tenant can assign the role identity in the system to the member. For example, the role of auditor has the commodity audit permission and the commodity on-shelf permission in the system, and the tenant can assign the role of auditor to a certain employee (i.e. member), so that the employee can perform the commodity audit and commodity on-shelf operations in the system.

[0046] For example, in the target permission grouping result, the commodity configuration permission and the commodity modification permission belong to the same permission combination, and the commodity audit permission and the commodity on-shelf permission belong to another permission combination, then the device corresponding to the new tenant can allocate the commodity configuration permission and the commodity modification permission to the role A created by the new tenant, and allocate the commodity audit permission and the commodity on-shelf permission to the role B created by the new tenant.

[0047] The above permission allocation method, in the case of a new tenant, determines the target tenant group to which the new tenant belongs from a plurality of tenant groups according to the basic information of the new tenant, determines the target permission grouping result corresponding to the target tenant group according to the pre-set corresponding relationship between the tenant group and the permission grouping result, the target permission grouping result includes a plurality of permission combinations, and the correlation degree between the permissions in each permission combination meets the preset condition, and then sends the target permission grouping result to the device corresponding to the new tenant, the target permission grouping result is used to allocate each permission in the same permission combination to the role created by the new tenant, which realizes quickly determining the target permission grouping result corresponding to the target tenant group to which the new tenant belongs, so that each permission in the same permission combination in the target permission grouping result can be allocated to the role created by the new tenant, without allocating each permission to the role one by one, greatly improving the permission allocation efficiency. In addition, the plurality of tenant groups are pre-divided, and the permission grouping result is allocated according to the target tenant group to which the new tenant belongs, which can adapt to the needs of different tenants and improve the accuracy of permission allocation.

[0048] In some embodiments, in a case where a new tenant is to be accommodated, before determining a target tenant group to which the new tenant belongs from a plurality of tenant groups according to basic information of the new tenant, the method further comprises: grouping each existing tenant according to the basic information of each existing tenant to obtain the plurality of tenant groups; for each tenant group, calculating a first operation correlation degree between each permission according to actual operation conditions of each existing tenant in the tenant group for operations corresponding to each permission; calculating a first allocation correlation degree between each permission according to actual allocation conditions of each existing tenant in the tenant group for each permission; determining a target correlation degree between each permission according to the first operation correlation degree and the first allocation correlation degree; and grouping the permissions according to the target correlation degree to obtain a permission grouping result corresponding to the tenant group.

[0049] The first operation correlation degree is used to measure the correlation degree between the permissions from the aspect of actual operation conditions. The first allocation correlation degree is used to measure the correlation degree between the permissions from the aspect of actual allocation conditions.

[0050] In some embodiments, various operations, various resources, and allow and prohibit identifiers in the system can be collected as permission data to obtain various permissions in the system. For example, the operations include reading, writing, and deleting, etc. The resources include goods, etc. One piece of permission data can be to allow deleting goods A.

[0051] In some embodiments, an initialization permission grouping scheme can be formulated according to business experience, and the initialization permission grouping scheme is sent to the devices of the existing tenants. The existing tenants can combine the initialization permission grouping scheme and allocate and adjust the permissions of each role according to actual needs. After a period of time, the basic information of each existing tenant in the period of time is collected, each existing tenant is grouped, and a plurality of tenant groups are obtained. Then, the usage habits of the existing tenants in each tenant group in the period of time are used to group the permissions to obtain a permission grouping result corresponding to each tenant group. The usage habits can include actual operation conditions of the tenants for operations corresponding to each permission and actual allocation conditions for each permission, etc. The granularity of grouping the permissions in the initialization permission grouping scheme can be relatively coarse, for example, the permissions can be grouped according to the business modules to which the permissions belong to obtain the initialization permission grouping scheme.

[0052] In some embodiments, the server can determine the target correlation degree between each permission according to the product of the first operation correlation degree and the first allocation correlation degree. In other embodiments, the server can weight the first operation correlation degree and the first allocation correlation degree respectively, and then determine the product of each weighted result as the target correlation degree between each permission.

[0053] In some embodiments, the server can divide the permissions with a target correlation greater than or equal to a preset threshold into the same permission combination, and obtain the multiple permission combinations included in the permission grouping result corresponding to the tenant group.

[0054] In the above embodiments, the multiple tenant groups are obtained by grouping the existing tenants according to the basic information of each existing tenant, and the first operation correlation between the permissions and the first allocation correlation between the permissions are calculated according to the actual operation of each existing tenant in the tenant group on the operations corresponding to the permissions and the actual allocation of each existing tenant in the tenant group on the permissions, respectively. The target correlation between the permissions can be accurately determined according to the actual operation and the actual allocation of each tenant in the tenant group, so that the permissions can be accurately grouped to obtain the accurate permission grouping result corresponding to each permission group, and the permission grouping result is more in line with the use habits of the tenants in the corresponding tenant group, thereby improving the accuracy of the permission grouping. In addition, the multiple tenant groups are divided according to the basic information of the tenants, and the permission grouping result corresponding to each tenant group is determined, which can adapt to the needs of different tenants and further improve the accuracy of the permission allocation.

[0055] In some embodiments, the method further comprises: calculating a second operation correlation between the permissions according to the actual operation of each existing tenant in the multiple tenant groups on the operations corresponding to the permissions; calculating a second allocation correlation between the permissions according to the actual allocation of each existing tenant in the multiple tenant groups on the permissions; and determining the target correlation between the permissions according to the first operation correlation and the first allocation correlation comprises: determining the target correlation between the permissions according to the first operation correlation, the first allocation correlation, the second operation correlation and the second allocation correlation.

[0056] The second operation correlation is used to measure the correlation between the permissions from the aspect of the actual operation. The second allocation correlation is used to measure the correlation between the permissions from the aspect of the actual allocation.

[0057] In some embodiments, the server can determine the time interval between any two operations performed by each existing tenant in the multiple tenant groups according to the actual operation of each existing tenant in the multiple tenant groups on the operations corresponding to the permissions, and calculate the second operation correlation between the two permissions corresponding to the two operations according to the time interval of the two operations.

[0058] In some embodiments, the server can determine the second operation correlation between the two permissions corresponding to the two operations according to the inverse of the mean of the time interval of the two operations performed by each existing tenant in the multiple tenant groups.

[0059] In some embodiments, the server can determine the proportion of the two permissions being assigned to the same role according to the actual assignment of each existing tenant in the plurality of tenant groups to each permission, and calculate the first assignment correlation between the two permissions according to the proportion corresponding to the two permissions.

[0060] In some embodiments, the server can determine the proportion of the two permissions being assigned to the same role according to the ratio between the number of tenants in the plurality of tenant groups assigning the two permissions to the same role and the total number of tenants in the plurality of tenant groups.

[0061] In some embodiments, the plurality of tenant groups can be all tenant groups, or a part of the tenant groups.

[0062] In some embodiments, the server can determine the target correlation between the permissions according to the product of the first operation correlation, the first assignment correlation, the second operation correlation and the second assignment correlation.

[0063] In other embodiments, the server can weight the first operation correlation, the first assignment correlation, the second operation correlation and the second assignment correlation respectively, and then determine the product of the weighted results as the target correlation between the permissions. For example: for permissions i and j, the corresponding first operation correlation is T1 ij , the second operation correlation is T2 ij , the first assignment correlation is P1 ij , and the second assignment correlation is P2 ij , then the target correlation is (T1 ij *w1)*(T2 ij *w2)*(P1 ij *w3)*(P2 ij *w4). Wherein, w1, w2, w3, w4 are the weights of the weights.

[0064] In the above embodiments, in addition to using the actual operation and assignment of the tenants in the tenant group to calculate the first operation correlation and the first assignment correlation, the actual operation and assignment of the tenants in the plurality of tenant groups are also used to calculate the second operation correlation and the second assignment correlation, so that the target correlation can be accurately determined by combining the usage habits of the tenants in other tenant groups in addition to the usage habits of the tenants in the tenant group, and the accuracy of the permission grouping can be improved.

[0065] As shown in FIG. 1 Figure 3 , it is a whole flowchart of the permission assignment method in the embodiments of the present application, which includes the following steps:

[0066] At step 302, the existing tenants are grouped according to the basic information of each existing tenant, to obtain a plurality of tenant groups.

[0067] At step 304, the first operation correlation degree, the first allocation correlation degree, the second operation correlation degree and the second allocation correlation degree between the permissions are calculated for each tenant group respectively.

[0068] At step 306, the target correlation degree between the permissions is determined according to the first operation correlation degree, the first allocation correlation degree, the second operation correlation degree and the second allocation correlation degree.

[0069] At step 308, the permissions are grouped according to the target correlation degree, to obtain a permission grouping result corresponding to the tenant group.

[0070] At step 310, in the case that a new tenant is settled, the target tenant group to which the new tenant belongs is determined from the plurality of tenant groups according to the basic information of the new tenant.

[0071] At step 312, the target permission grouping result corresponding to the target tenant group is determined according to the pre-set corresponding relationship between the tenant group and the permission grouping result.

[0072] At step 314, the target permission grouping result is sent to the device corresponding to the new tenant; the target permission grouping result is used to allocate each permission in the same permission combination contained in the target permission grouping result to the role created by the new tenant.

[0073] In some embodiments, the basic information includes basic information in a plurality of dimensions; grouping the existing tenants according to the basic information of each existing tenant to obtain a plurality of tenant groups includes: determining the initial tenant groups to which each existing tenant is divided in each dimension according to the basic information of each existing tenant in each dimension; and determining the existing tenants whose initial tenant groups in each dimension are consistent as belonging to the same tenant group.

[0074] For example, assuming that the basic information includes basic information in A, B, C and D dimensions, the initial tenant groups divided in the A dimension include A1, A2 and A3, the initial tenant groups divided in the B dimension include B1, B2 and B3, the initial tenant groups divided in the C dimension include C1, C2 and C3, and the initial tenant groups divided in the D dimension include D1, D2 and D3, assuming that tenant a and tenant b are both divided into the initial tenant group A1 in the A dimension, the initial tenant group B3 in the B dimension, the initial tenant group C2 in the C dimension, and the initial tenant group D1 in the D dimension, the server can divide tenant a and tenant b into the same tenant group.

[0075] In some embodiments, the server can determine, for each dimension, an initial tenant group to which the tenant belongs according to a numerical range to which the basic information under the dimension belongs.

[0076] In the above embodiments, the tenant is grouped according to the basic information under each dimension, which can fully consider the various basic information of the tenant, thereby achieving more accurate grouping of the tenant, and thus being able to adapt to the needs of different tenants to group the permissions of different tenant groups.

[0077] In some embodiments, the tenant is a tenant in an online mall management background; and the basic information under each dimension includes at least two of a member quantity of the tenant, a shop quantity, a total quantity of goods, and a recent goods increment.

[0078] In some embodiments, the server can determine, according to the member quantity of each existing tenant, a first initial tenant group to which each existing tenant is divided in the member quantity dimension; determine, according to the shop quantity of each existing tenant, a second initial tenant group to which each existing tenant is divided in the shop quantity dimension; determine, according to the total quantity of goods of each existing tenant, a third initial tenant group to which each existing tenant is divided in the total quantity of goods dimension; determine, according to the recent goods increment of each existing tenant, a fourth initial tenant group to which each existing tenant is divided in the recent goods increment quantity dimension; and finally determine the tenants that are consistent in the first initial tenant group, the second initial tenant group, the third initial tenant group, and the fourth initial tenant group as belonging to the same tenant group.

[0079] In the above embodiments, in the scenario of the online mall management background, the tenant can be grouped according to at least two of the member quantity, the shop quantity, the total quantity of goods, and the recent goods increment of the tenant, thereby fully considering the basic information of the tenant in multiple dimensions, and improving the accuracy of tenant grouping.

[0080] In some embodiments, the server can determine the time interval between the two operations corresponding to the two permissions according to the actual operation of each existing tenant in the tenant group on the operations corresponding to the two permissions, and then calculate the first operation correlation degree between the two permissions corresponding to the two operations according to the reciprocal of the mean value of the time interval.

[0081] In some embodiments, the server can determine the mean value of the time interval between the two operations corresponding to the two permissions for each tenant in the tenant group, and then calculate the first operation correlation degree between the two permissions corresponding to the two operations according to the reciprocal of the mean value of the time interval.

[0082] In some embodiments, the server can calculate the first operation correlation degree and the first allocation correlation degree between each two permissions respectively, and then determine the target correlation degree corresponding to the two permissions according to the first operation correlation degree and the first allocation correlation degree. If the target correlation degree is greater than or equal to a preset threshold, the two permissions are divided into the same permission combination.

[0083] For example, for the two permissions i and j, the server can determine the time interval between the operations corresponding to the permissions i and j according to the actual operation of each existing tenant in the tenant group on the operations corresponding to the permissions i and j, and then determine the first operation correlation degree between the permissions i and j according to the reciprocal of the mean value of the time interval between the operations corresponding to the permissions i and j. According to the actual allocation of the permissions i and j by each existing tenant in the tenant group, the proportion of the tenants in the tenant group who allocate the permissions i and j to the same role is determined, and the first allocation correlation degree between the permissions i and j is calculated according to the proportion.

[0084] In the above embodiments, for each tenant group, the time interval between any two operations performed by each existing tenant in the tenant group is determined according to actual operation conditions of the operations corresponding to each permission by each existing tenant in the tenant group, the first operation correlation degree between the two permissions corresponding to the two operations is calculated according to the time interval between the two operations, because the shorter the time interval between the two operations is, the greater the correlation degree between the corresponding permissions is, so the first operation correlation degree can be accurately determined according to the time interval between the operations. The proportion of assigning any two permissions to the same role by each existing tenant in the tenant group is determined according to actual assignment conditions of the permissions by each existing tenant in the tenant group, the first assignment correlation degree between the two permissions is calculated according to the proportion of assigning the two permissions to the same role, because the greater the proportion of assigning the two permissions to the same role is, the greater the correlation degree between the two permissions is, so the first assignment correlation degree can be accurately determined according to the proportion of assigning the two permissions to the same role, and then the target correlation degree can be accurately determined based on the first operation correlation degree and the first assignment correlation degree, thereby improving the accuracy of permission grouping.

[0085] In some embodiments, grouping the permissions according to the target correlation degree to obtain the permission grouping result corresponding to the tenant group includes: dividing the permissions with the target correlation degree greater than or equal to a preset threshold into the same permission combination, so that the permission grouping result corresponding to the tenant group includes a plurality of permission combinations.

[0086] In the above embodiments, the permissions with the target correlation degree greater than or equal to the preset threshold are divided into the same permission combination, which can make the correlation degree between the permissions in the same permission combination greater, thereby improving the accuracy of permission grouping, so that the permissions in the same permission combination can be conveniently assigned to the role created by the new tenant, and the permission assignment efficiency is improved.

[0087] It should be understood that, although each step in the flowchart involved in each of the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each of the above embodiments can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0088] Based on the same inventive concept, the embodiments of the present application also provide a permission allocation apparatus for implementing the above-mentioned permission allocation method. The solution provided by the apparatus is similar to the solution described in the above-mentioned method, and therefore the specific limitations in one or more permission allocation apparatus embodiments provided below can refer to the limitations of the permission allocation method described above, which will not be described here again.

[0089] In some embodiments, as shown in Figure 4 A permission allocation apparatus 400 is provided, comprising a tenant grouping module 402, a permission grouping module 404, and a permission allocation module 406, wherein:

[0090] The tenant grouping module 402 is configured to, in the case of a new tenant moving in, determine a target tenant group to which the new tenant belongs from a plurality of tenant groups according to basic information of the new tenant.

[0091] The permission grouping module 404 is configured to determine a target permission grouping result corresponding to the target tenant group according to a pre-set corresponding relationship between the tenant groups and the permission grouping results; the target permission grouping result comprises a plurality of permission combinations; and the correlation degree between the permissions in each permission combination satisfies a preset condition.

[0092] The permission allocation module 406 is configured to send the target permission grouping result to a device corresponding to the new tenant; and the target permission grouping result is used to allocate each permission in a same permission combination to a role created by the new tenant.

[0093] In some embodiments, the tenant grouping module 402 is further configured to group each existing tenant according to the basic information of the existing tenant, to obtain the plurality of tenant groups. The permission grouping module 404 is further configured to, for each tenant group, calculate a first operation correlation degree between each permission according to actual operation conditions of each existing tenant in the tenant group with respect to operations corresponding to each permission; calculate a first allocation correlation degree between each permission according to actual allocation conditions of each existing tenant in the tenant group with respect to each permission; determine a target correlation degree between each permission according to the first operation correlation degree and the first allocation correlation degree; and group the permissions according to the target correlation degree, to obtain a permission grouping result corresponding to the tenant group.

[0094] In some embodiments, the permission grouping module 404 is further configured to calculate a second operation correlation degree between each permission according to actual operation conditions of each existing tenant in the plurality of tenant groups with respect to operations corresponding to each permission; calculate a second allocation correlation degree between each permission according to actual allocation conditions of each existing tenant in the plurality of tenant groups with respect to each permission; and determine a target correlation degree between each permission according to the first operation correlation degree, the first allocation correlation degree, the second operation correlation degree, and the second allocation correlation degree.

[0095] In some embodiments, the basic information includes basic information in multiple dimensions; the tenant grouping module 402 is further configured to determine, according to the basic information of each existing tenant in each dimension, an initial tenant group to which each existing tenant is divided in each dimension; and determine the existing tenants in the initial tenant groups in each dimension as belonging to the same tenant group.

[0096] In some embodiments, the tenant is a tenant in an online mall management background; and the basic information in each dimension includes at least two of a member quantity, a store quantity, a total quantity of goods, and a recent goods increment of the tenant.

[0097] In some embodiments, the permission grouping module 404 is further configured to, for each tenant group, determine, according to actual operation conditions of each existing tenant in the tenant group for operations corresponding to each permission, a time interval between any two operations performed by each existing tenant in the tenant group; calculate a first operation correlation degree between two permissions corresponding to the two operations according to the time interval between the two operations; determine, according to actual allocation conditions of each existing tenant in the tenant group for each permission, a proportion of allocating any two permissions to the same role by each existing tenant in the tenant group; and calculate a first allocation correlation degree between the two permissions according to the proportion corresponding to the two permissions.

[0098] In some embodiments, the permission grouping module 404 is further configured to divide the permissions with a target correlation degree greater than or equal to a preset threshold into the same permission combination to obtain a plurality of permission combinations included in the permission grouping result corresponding to the tenant group.

[0099] The above permission allocation apparatus, in the case of a new tenant entering, determines a target tenant group to which the new tenant belongs from a plurality of tenant groups according to basic information of the new tenant, determines a target permission grouping result corresponding to the target tenant group according to a preset correspondence between the tenant groups and the permission grouping results, the target permission grouping result including a plurality of permission combinations, the correlation degrees between the permissions in each permission combination satisfying a preset condition, and then sends the target permission grouping result to a device corresponding to the new tenant, the target permission grouping result being used to allocate each permission in the same permission combination included in the target permission grouping result to a role created by the new tenant, which realizes quick determination of a target permission grouping result corresponding to a target tenant group to which the new tenant belongs, so that each permission in the same permission combination included in the target permission grouping result can be allocated to a role created by the new tenant, without allocating each permission to the role one by one, greatly improving the permission allocation efficiency.

[0100] The modules in the above permission allocation apparatus can be implemented by software, hardware, or a combination thereof, in whole or in part. The modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in the computer device in software form, so as to be invoked and executed by a processor to perform operations corresponding to the modules.

[0101] In one embodiment, a computer device, which can be a server, has an internal structure as shown in Figure 5 The computer device includes a processor, a memory, and a network interface connected by a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store data. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program, when executed by the processor, implements a permission allocation method.

[0102] Those skilled in the art can understand that Figure 5 The structure shown in the above embodiment is only a block diagram of part of the structure related to the scheme of the present application, and does not limit the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0103] In one embodiment, a computer device is provided, which includes a memory and a processor. The memory stores a computer program. The processor, when executing the computer program, implements the steps in the above method embodiments.

[0104] In one embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program, when executed by a processor, implements the steps in the above method embodiments.

[0105] In one embodiment, a computer program product is provided, which includes a computer program. The computer program, when executed by a processor, implements the steps in the above method embodiments.

[0106] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0107] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0108] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0109] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A permission allocation method, characterized in that, The method includes: When a new tenant moves in, the target tenant group to which the new tenant belongs is determined from multiple tenant groups based on the new tenant's basic information. Based on the pre-set correspondence between tenant groups and permission grouping results, the target permission grouping result corresponding to the target tenant group is determined; the target permission grouping result includes multiple permission combinations; the correlation between permissions within each permission combination meets preset conditions; The target permission grouping result is sent to the device corresponding to the new tenant; the target permission grouping result is used to assign each permission in the same permission combination to the role created by the new tenant.

2. The method according to claim 1, characterized in that, Before determining the target tenant group to which the new tenant belongs from multiple tenant groups based on the new tenant's basic information when a new tenant joins the community, the method further includes: Based on the basic information of each existing tenant, the existing tenants are grouped to obtain multiple tenant groups; For each tenant group, the first operation correlation degree between each permission is calculated based on the actual operation of each existing tenant in the tenant group for each permission. Based on the actual allocation of each permission to each existing tenant in the tenant group, calculate the first allocation correlation degree between each permission; Based on the first operation correlation degree and the first allocation correlation degree, determine the target correlation degree between each permission; Based on the target relevance, each permission is grouped to obtain the permission grouping result corresponding to the tenant group.

3. The method according to claim 2, characterized in that, The method further includes: Based on the actual operation of each existing tenant in the multiple tenant groups for each permission, calculate the second operation correlation degree between each permission; Based on the actual allocation of each permission to each existing tenant in the multiple tenant groups, calculate the second allocation correlation degree between each permission; The step of determining the target correlation between each permission based on the first operation correlation and the first allocation correlation includes: Based on the first operation correlation degree, the first allocation correlation degree, the second operation correlation degree, and the second allocation correlation degree, the target correlation degree between each permission is determined.

4. The method according to claim 2, characterized in that, The basic information includes basic information across multiple dimensions; the process of grouping existing tenants based on their basic information to obtain multiple tenant groups includes: Based on the basic information of each existing tenant under each dimension, determine the initial tenant group to which each existing tenant is assigned under each dimension. Existing tenants that are assigned to the same initial tenant group across all dimensions are identified as belonging to the same tenant group.

5. The method according to claim 4, characterized in that, The tenant is a tenant in the online mall management backend; the basic information under each dimension includes at least two of the following: the number of tenant members, the number of stores, the total number of products, and the recent increase in products.

6. The method according to claim 2, characterized in that, The step of calculating the first operation correlation degree between each permission for each tenant group, based on the actual operation of each existing tenant in the tenant group for each permission, includes: For each tenant group, based on the actual operation of each existing tenant in the tenant group for each permission, the time interval between any two operations performed by each existing tenant in the tenant group is determined. Based on the time interval between any two operations, calculate the first operation correlation degree between the two permissions corresponding to the two operations; The step of calculating the first allocation correlation degree between various permissions based on the actual allocation of each existing tenant in the tenant group for each permission includes: Based on the actual allocation of each permission by each existing tenant in the tenant group, determine the proportion of each existing tenant in the tenant group that assigns any two permissions to the same role. Calculate the first allocation correlation degree between the two permissions based on the ratio corresponding to any two permissions.

7. The method according to claim 2, characterized in that, The step of grouping each permission according to the target relevance to obtain the permission grouping result corresponding to the tenant group includes: Permissions with a target correlation degree greater than or equal to a preset threshold are grouped into the same permission combination to obtain multiple permission combinations contained in the permission grouping result corresponding to the tenant group.

8. A permission allocation device, characterized in that, The device includes: The tenant grouping module is used to determine the target tenant group to which the new tenant belongs from multiple tenant groups based on the new tenant's basic information when a new tenant joins the site. The permission grouping module is used to determine the target permission grouping result corresponding to the target tenant group based on the pre-set correspondence between tenant groups and permission grouping results; the target permission grouping result includes multiple permission combinations; the correlation between permissions within each permission combination meets preset conditions; The permission allocation module is used to send the target permission grouping result to the device corresponding to the new tenant; the target permission grouping result is used to allocate each permission in the same permission combination to the role created by the new tenant.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images