Rights management method and device

Abstract

An embodiment of the present application provides a permission management method and device. The method includes: determining at least one target permission point configured for a target role. Obtaining indication information corresponding to each target permission point, the indication information includes a permission value used to represent the target permission point. Merging processing is performed based on the permission values ​​corresponding to each target permission point, and a first compressed permission value corresponding to the target permission point is determined. The first compressed permission value includes an indication bit corresponding to each target permission point, and the indication bit with a first preset value is used to indicate that the target role has the permission of the target permission point corresponding to the indication bit. Based on the first compressed permission value, the first target permission data associated with the target role is generated and stored. The technical solution of the present application can realize permission configuration for the target role and effectively save system storage space.

Description

[0001] This application is a divisional application of the invention patent application with application number 202311387119.4 filed on October 25, 2023 and invention name “Authorization Management Method and Device”. Technical Field

[0002] The present application relates to the field of terminal technology, and in particular to a permission management method and device. Background Art

[0003] With the continuous development of computer technology, many platforms currently provide account-based services, that is, users can register an account on the platform, and then log in to the account on the platform to use the corresponding services.

[0004] Usually, account-based services have a permission management system to clarify the system permissions of each account. For example, the system can generate different roles based on the combination of different permission points, and then the account can apply for the required role to obtain the corresponding permissions. At present, the relevant technology usually stores the identifiers of each permission point for the role association to generate the corresponding role.

[0005] However, in order to effectively distinguish different permission points, as the number of permission points increases, the byte size occupied by the permission point identifier will naturally increase. Therefore, based on such an implementation method, storing the identifier of the permission point corresponding to each role separately will result in a large occupation of system memory. Summary of the invention

[0006] The embodiments of the present application provide a method and device for rights management, which are applied in the field of terminal technology.

[0007] In a first aspect, an embodiment of the present application provides a rights management method. The method includes:

[0008] Determine at least one target permission point configured for the target role;

[0009] Acquire indication information corresponding to each of the target permission points, wherein the indication information includes an authority value used to represent the target permission point, the authority value includes an indication bit corresponding to the target permission point, and the value of the indication bit in the authority value is a first preset value;

[0010] Performing a merging process according to the authority values ​​corresponding to each of the target authority points, determining a first compressed authority value corresponding to the target authority point, wherein the first compressed authority value includes an indication bit corresponding to each of the target authority points, and the value of each of the indication bits in the first compressed authority value is the first preset value, and the indication bit having the first preset value is used to indicate that the target role has the authority of the target authority point corresponding to the indication bit;

[0011] According to the first compressed authority value, first target authority data associated with the target role is generated and stored.

[0012] In this implementation, when configuring the target authority point for the target role, the authority values ​​corresponding to each target authority point are merged to obtain a compressed authority value, wherein the compressed authority value has a smaller data volume on the one hand, and includes the indication bits corresponding to each target authority point on the other hand. Therefore, each target authority point can be identified by one bit. Therefore, according to the first compressed authority value, the first target authority data associated with the target role is generated and stored, which can effectively realize the authority configuration for the target role and save the system storage space to a great extent.

[0013] In some implementations, the indication information further includes a level value, and the level value is used to indicate the authority level corresponding to the target authority point;

[0014] For multiple permission points in any one of the permission levels, positions of the indication bits in the permission values ​​corresponding to the respective permission points are different.

[0015] In this implementation, by setting the level value, fewer bits can be used to represent the permission point, thereby further saving system storage space.

[0016] In some implementations, the merging of the authority values ​​corresponding to the target authority points to determine the first compressed authority value corresponding to the target authority point includes:

[0017] For any of the level values, determining, in the indication information corresponding to each of the target authority points, a plurality of indication information including the level value;

[0018] A bitwise OR operation is performed on the permission values ​​in the plurality of indication information including the level value to obtain a first compressed permission value corresponding to the level value.

[0019] In this implementation, the permission values ​​of the same permission level can be merged to obtain compressed permission values ​​corresponding to each level value, so as to greatly reduce the number of associated records between roles and permission points, and further reduce the occupancy of system storage space.

[0020] In some implementations, generating and storing first target permission data associated with the target role according to the first compressed permission value includes:

[0021] For any of the level values, determining the level value and the first compression authority value corresponding to the level value as a piece of associated data;

[0022] Determine a set of each of the associated data as first target permission data associated with the target role;

[0023] The target role and the first target permission data are associated and stored.

[0024] In some implementations, determining at least one target authority point configured for the target role includes:

[0025] In response to an operation on at least one selection control of the permission configuration interface, the permission points corresponding to the respective selection controls are determined as target permission points configured for the target role.

[0026] In this implementation, by performing a selection operation in the permission configuration interface, the selection and configuration of the target permission point can be simply and effectively achieved.

[0027] In some implementations, the method further includes:

[0028] In response to an operation on at least one selection control of the permission configuration interface, determining the permission points corresponding to the respective selection controls as first permission points, and determining second compressed permission values ​​corresponding to the respective first permission points according to the indication information corresponding to the respective first permission points;

[0029] In response to an operation on a role selection control of the permission configuration interface, a selected role from at least one generated role is determined as a role to be operated, and second target permission data associated with the role to be operated is acquired;

[0030] In response to an operation on the operation selection control of the permission configuration interface, a target operation is determined, wherein the target operation is any one of the following: taking a union, taking a difference, and taking an intersection;

[0031] The target operation is performed according to the second compressed permission value corresponding to the first permission point and the second target permission data to generate the first target permission data associated with the target role.

[0032] In this implementation, the first target permission data of the target role can be derived based on the generated role to be operated. In this way, the user only needs to select a small number of permission points of the role to be operated in the permission configuration interface to perform the first permission point of the target operation, which can effectively save the repeated operations to be performed by the operator.

[0033] In some implementations, when the target operation is to take a union, performing the target operation according to the second compressed permission value corresponding to the first permission point and the second target permission data to generate the first target permission data associated with the target role includes:

[0034] for each of the indication information corresponding to each of the first permission points and any first-level values ​​included in the second target permission data, performing bitwise OR processing according to a second compressed permission value corresponding to the first-level value and a third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value; and

[0035] for any second-level value included only in the indication information corresponding to each of the first permission points, determining the second compressed permission value corresponding to the second-level value as the fourth compressed permission value corresponding to the second-level value; and

[0036] For any third-level value included only in the second target authority data, determining the third compressed authority value corresponding to the third-level value in the second target authority data as the fourth compressed authority value corresponding to the third-level value;

[0037] The first target permission data associated with the target role is generated based on each of the first-level values ​​and the fourth compressed authority values ​​corresponding to each of the first-level values, each of the second-level values ​​and the fourth compressed authority values ​​corresponding to each of the second-level values, and each of the third-level values ​​and the fourth compressed authority values ​​corresponding to each of the third-level values.

[0038] In this implementation, the first permission point and the permission point configured for the role to be operated can be effectively unioned through bitwise OR processing, thereby realizing the permission configuration of the target role. In this process, the user only needs to select the first permission point, and there is no need to repeat a large number of permission point selection operations. Therefore, it can effectively save user operations and improve production efficiency.

[0039] In some implementations, when the target operation is a difference set, performing the target operation according to the first compressed permission values ​​corresponding to the respective level values ​​and the second target permission data to generate the first target permission data associated with the target role includes:

[0040] For any first-level values ​​included in both the indication information corresponding to each of the first permission points and the second target permission data, performing bitwise exclusive OR processing according to the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value; and

[0041] For any second-level value included only in the second target authority data, determining the third compressed authority value corresponding to the second-level value in the second target authority data as the fourth compressed authority value corresponding to the second-level value;

[0042] The first target permission data associated with the target role is generated according to each of the first-level values ​​and the fourth compressed permission values ​​corresponding to each of the first-level values, and each of the second-level values ​​and the fourth compressed permission values ​​corresponding to each of the second-level values.

[0043] In this implementation, the first permission point and the permission point configured for the role to be operated can be effectively unioned through bitwise XOR processing, thereby realizing the permission configuration of the target role. In this process, the user only needs to select the first permission point, and there is no need to repeat a large number of permission point selection operations. Therefore, it can effectively save user operations and improve production efficiency.

[0044] In some implementations, when the target operation is to take an intersection, performing the target operation according to the first compressed permission values ​​corresponding to the respective level values ​​and the second target permission data to generate the first target permission data associated with the target role includes:

[0045] For any first-level values ​​included in both the indication information corresponding to each of the first permission points and the second target permission data, performing bitwise AND processing according to the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value;

[0046] The first target permission data associated with the target role is generated according to each of the first-level values ​​and the fourth compressed permission values ​​corresponding to each of the first-level values.

[0047] In this implementation, the first permission point and the permission point configured for the role to be operated can be effectively unioned through bitwise AND processing, thereby realizing the permission configuration of the target role. In this process, the user only needs to select the first permission point, and there is no need to repeat a large number of permission point selection operations. Therefore, it can effectively save user operations and improve production efficiency.

[0048] In some implementations, the plurality of authority points in each of the authority levels are of the same category, and the categories of the authority points are pre-divided.

[0049] By setting multiple permission points in each permission level to the same category, that is, dividing and using the permission levels according to the classification results of the permission points, multi-category and multi-level permission isolation can be effectively implemented, which can not only meet business needs, but also ensure that the permission points at each level do not conflict with each other.

[0050] In some implementations, the authority value includes K bytes, the level value includes L bytes, and K and L are integers greater than or equal to 1.

[0051] In some implementations, the value type of the authority value is a long integer, and the value type of the level value is an integer or a short integer.

[0052] In some implementations, the method further includes:

[0053] In response to a role assignment request sent based on a first account, a first role indicated by the role assignment request is associated with the first account.

[0054] In some implementations, the method further includes:

[0055] In response to a login request sent based on the first account, parsing the first role associated with the first account;

[0056] Obtaining first target permission data associated with the first role;

[0057] Parsing the first target permission data to determine at least one associated permission point for which the first role has permission;

[0058] According to the at least one associated authority point, interface data corresponding to each of the associated authority points is sent to the login device corresponding to the first account, so that the login device corresponding to the first account displays the system interface corresponding to the first account according to the interface data.

[0059] In this implementation, the first target permission data of the role of each account can be effectively verified, so that the corresponding system resources can be sent to each account according to the permission points configured for it, so as to display the corresponding system interface for different accounts according to their corresponding roles, so as to implement orderly permission management for the system.

[0060] In a second aspect, an embodiment of the present application provides a rights management device. The device includes:

[0061] A determination module, used to determine at least one target permission point configured for a target role;

[0062] an acquisition module, configured to acquire indication information corresponding to each of the target permission points, wherein the indication information includes an authority value for indicating the target permission point, the authority value includes an indication bit corresponding to the target permission point, and the value of the indication bit in the authority value is a first preset value;

[0063] The determination module is further used to perform a merging process according to the authority values ​​corresponding to the target authority points, and determine a first compressed authority value corresponding to the target authority point, wherein the first compressed authority value includes an indication bit corresponding to each of the target authority points, and the value of each indication bit in the first compressed authority value is the first preset value, and the indication bit with the first preset value is used to indicate that the target role has the authority of the target authority point corresponding to the indication bit;

[0064] A processing module is used to generate and store first target permission data associated with the target role according to the first compressed permission value.

[0065] In some implementations, the indication information further includes a level value, and the level value is used to indicate the authority level corresponding to the target authority point;

[0066] For multiple permission points in any one of the permission levels, positions of the indication bits in the permission values ​​corresponding to the respective permission points are different.

[0067] In some implementations, the determining module is specifically configured to:

[0068] For any of the level values, determining, in the indication information corresponding to each of the target authority points, a plurality of indication information including the level value;

[0069] A bitwise OR operation is performed on the permission values ​​in the plurality of indication information including the level value to obtain a first compressed permission value corresponding to the level value.

[0070] In some implementations, the determining module is specifically configured to:

[0071] For any of the level values, determining the level value and the first compression authority value corresponding to the level value as a piece of associated data;

[0072] Determine a set of each of the associated data as first target permission data associated with the target role;

[0073] The target role and the first target permission data are associated and stored.

[0074] In some implementations, the determining module is specifically configured to:

[0075] In response to an operation on at least one selection control of the permission configuration interface, the permission points corresponding to the respective selection controls are determined as target permission points configured for the target role.

[0076] In some implementations, the processing module is further configured to:

[0077] In response to an operation on at least one selection control of the permission configuration interface, determining the permission points corresponding to the respective selection controls as first permission points, and determining second compressed permission values ​​corresponding to the respective first permission points according to the indication information corresponding to the respective first permission points;

[0078] In response to an operation on a role selection control of the permission configuration interface, a selected role from at least one generated role is determined as a role to be operated, and second target permission data associated with the role to be operated is acquired;

[0079] In response to an operation on the operation selection control of the permission configuration interface, a target operation is determined, wherein the target operation is any one of the following: taking a union, taking a difference, and taking an intersection;

[0080] The target operation is performed according to the second compressed permission value corresponding to the first permission point and the second target permission data to generate the first target permission data associated with the target role.

[0081] In some implementations, when the target operation is to take a set union, the processing module is specifically configured to:

[0082] for each of the indication information corresponding to each of the first permission points and any first-level values ​​included in the second target permission data, performing bitwise OR processing according to a second compressed permission value corresponding to the first-level value and a third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value; and

[0083] for any second-level value included only in the indication information corresponding to each of the first permission points, determining the second compressed permission value corresponding to the second-level value as the fourth compressed permission value corresponding to the second-level value; and

[0084] For any third-level value included only in the second target authority data, determining the third compressed authority value corresponding to the third-level value in the second target authority data as the fourth compressed authority value corresponding to the third-level value;

[0085] The first target permission data associated with the target role is generated based on each of the first-level values ​​and the fourth compressed authority values ​​corresponding to each of the first-level values, each of the second-level values ​​and the fourth compressed authority values ​​corresponding to each of the second-level values, and each of the third-level values ​​and the fourth compressed authority values ​​corresponding to each of the third-level values.

[0086] In some implementations, when the target operation is a difference set, the processing module is specifically configured to:

[0087] For any first-level values ​​included in both the indication information corresponding to each of the first permission points and the second target permission data, performing bitwise exclusive OR processing according to the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value; and

[0088] For any second-level value included only in the second target authority data, determining the third compressed authority value corresponding to the second-level value in the second target authority data as the fourth compressed authority value corresponding to the second-level value;

[0089] The first target permission data associated with the target role is generated according to each of the first-level values ​​and the fourth compressed permission values ​​corresponding to each of the first-level values, and each of the second-level values ​​and the fourth compressed permission values ​​corresponding to each of the second-level values.

[0090] In some implementations, when the target operation is to obtain an intersection, the processing module is specifically configured to:

[0091] For any first-level values ​​included in both the indication information corresponding to each of the first permission points and the second target permission data, performing bitwise AND processing according to the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value;

[0092] The first target permission data associated with the target role is generated according to each of the first-level values ​​and the fourth compressed permission values ​​corresponding to each of the first-level values.

[0093] In some implementations, the plurality of authority points in each of the authority levels are of the same category, and the categories of the authority points are pre-divided.

[0094] In some implementations, the authority value includes K bytes, the level value includes L bytes, and K and L are integers greater than or equal to 1.

[0095] In some implementations, the value type of the authority value is a long integer, and the value type of the level value is an integer or a short integer.

[0096] In some implementations, the processing module is further configured to:

[0097] In response to a role assignment request sent based on a first account, a first role indicated by the role assignment request is associated with the first account.

[0098] In some implementations, the processing module is further configured to:

[0099] In response to a login request sent based on the first account, parsing the first role associated with the first account;

[0100] Obtaining first target permission data associated with the first role;

[0101] Parsing the first target permission data to determine at least one associated permission point for which the first role has permission;

[0102] According to the at least one associated authority point, interface data corresponding to each of the associated authority points is sent to the login device corresponding to the first account, so that the login device corresponding to the first account displays the system interface corresponding to the first account according to the interface data.

[0103] In a third aspect, an embodiment of the present application provides a terminal device, comprising: a processor and a memory; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, so that the terminal device executes the method of the first aspect.

[0104] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the method of the first aspect is implemented.

[0105] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed, the computer executes the method of the first aspect.

[0106] In a sixth aspect, an embodiment of the present application provides a chip, the chip including a processor, the processor being used to call a computer program in a memory to execute the method described in the first aspect.

[0107] It should be understood that the second to sixth aspects of the present application correspond to the technical solutions of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] Figure 1 A schematic diagram of the interface of the application market provided in the embodiment of the present application;

[0109] Figure 2 Schematic diagram of the component configuration interface of the recommended position provided in the embodiment of the present application Figure 1 ;

[0110] Figure 3 Schematic diagram of the configuration interface of the recommended position management of the embodiment of the present application Figure 2 ;

[0111] Figure 4 Schematic diagram of the configuration interface of the recommended position management provided in the embodiment of the present application Figure 3 ;

[0112] Figure 5 Schematic diagram of the system interface of different permission points provided in the embodiment of the present application Figure 1 ;

[0113] Figure 6 Schematic diagram of the system interface of different permission points provided in the embodiment of the present application Figure 2 ;

[0114] Figure 7 Schematic diagram of the permission configuration interface provided in the embodiment of the present application Figure 1 ;

[0115] Figure 8 A flowchart of a rights management method provided in an embodiment of the present application;

[0116] Fig. 9 A schematic diagram of implementing the authority value provided in the embodiment of the present application;

[0117] Fig.10 A schematic diagram of the combination of authority values ​​provided in the embodiment of the present application;

[0118] Fig.11 A schematic diagram of the level values ​​and authority values ​​provided in the embodiments of the present application;

[0119] Fig.12 A schematic diagram of the classification of the authority points provided in the embodiment of the present application;

[0120] Fig.13 Schematic diagram of the implementation of determining the target role provided in the embodiment of the present application Figure 1 ;

[0121] Fig.14 Schematic diagram of the permission configuration interface provided in the embodiment of the present application Figure 2 ;

[0122] Fig.15 Schematic diagram of the permission configuration interface provided in the embodiment of the present application Figure 3 ;

[0123] Fig.16 Schematic diagram of the implementation of determining the target role provided in the embodiment of the present application Figure 2 ;

[0124] Fig.17 Schematic diagram of the implementation of determining the target role provided in the embodiment of the present application Figure 3 ;

[0125] Fig.18 Schematic diagram of the implementation of determining the target role provided in the embodiment of the present application Figure 4 ;

[0126] Fig.19 A schematic diagram of the structure of the rights management device provided in the embodiment of the present application;

[0127] Fig. 20 A schematic diagram of the hardware structure of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0128] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0129] In the embodiments of the present application, "at least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0130] It should be noted that the "at..." in the embodiment of the present application can be the instant when a certain situation occurs, or a period of time after a certain situation occurs, and the embodiment of the present application does not specifically limit this. In addition, the display interface provided in the embodiment of the present application is only an example, and the display interface can also include more or less content.

[0131] In order to better understand the technical solution of the present application, the relevant technologies involved in the present application are further introduced in detail below.

[0132] With the continuous development of computer technology, various systems or platforms have emerged. Currently, many platforms provide account-based services, that is, users can register an account on the platform, and then users can log in to their registered account on the platform to use the corresponding services.

[0133] Typically, account-based services have a permission management system. In one possible implementation, the permission management system can configure corresponding roles for each account. Each role can operate and enjoy different functions, services, menus, and data, thereby achieving effective management and control of system permissions for each account.

[0134] In the present application, the minimum granularity for identifying system functions is called a permission point, which can also be understood as the minimum granularity for configuring system permissions. For example, each menu in the platform interface can be understood as a permission point, or each operation control in the platform interface can be understood as a permission point, or a table or data in the platform can be understood as a permission point. The specific division method of the permission points can be determined according to actual needs. All system resources that can be used as permission configuration objects can be used as permission points in this application. This embodiment does not limit the specific implementation method of the permission points.

[0135] Then in the implementation method introduced above, the role can be understood as a collection of permission points, where the role can be, for example, a super administrator, an ordinary administrator, an ordinary user, etc., or the role can also be a first-level member, a second-level member, a third-level member, etc. The specific division of roles and the specific content of the permission points corresponding to each role can be selected and set according to actual needs, and this embodiment does not limit this.

[0136] Also, an account can be understood as a collection of roles. Usually, an account only corresponds to one role. In some special cases, an account corresponds to multiple roles. Therefore, by generating roles based on permission points and then assigning roles to accounts, you can effectively implement permission management for accounts.

[0137] Combine the following Figures 1 to 4 Taking the management of recommended positions in the application market as an example, the relationship between permission points, roles, and accounts is introduced illustratively. Figure 1 This is a schematic diagram of the interface of the application market provided in the embodiment of the present application. Figure 2 Schematic diagram of the component configuration interface of the recommended position provided in the embodiment of the present application Figure 1 , Figure 3 Schematic diagram of the configuration interface of the recommended position management of the embodiment of the present application Figure 2 , Figure 4 Schematic diagram of the configuration interface of the recommended position management provided in the embodiment of the present application Figure 3 .

[0138] In the terminal device, the application market is an application that provides users with the functions of downloading and updating applications, so users can search for the target application they need in the application market. For the target application that the user is looking for, the application market can not only provide relevant information about the target application itself, but also display at least one recommended application in the details page of the target application.

[0139] like Figure 1As shown, assuming that the current target application is application X, multiple recommended applications can be displayed in the details page corresponding to application X. Furthermore, the details page of application X can specifically include two recommendation positions: details page-introduction and details page-game recommendation.

[0140] For details, please refer to the "Details Page-Introduction" of the recommended position. Figure 1 In (a), the recommendation position of "Details Page - Introduction" may include three components, namely component 101 of "Related Recommendations", component 102 of "Guess You Like" and component 103 of "Other Applications from the Same Developer". Some recommended applications may be included in each component, and the user may click the "Install" control of the recommended application in the corresponding component to download and install the recommended application.

[0141] And the recommended position "Details Page-Game Recommendation" can be referred to Figure 1 In (b), in the recommendation position of "Details Page - Game Recommendation", it can be understood that there is only one "Everyone is playing" component 104, and the component 104 also includes some recommended applications, and for each recommended application, the corresponding game information is displayed, such as the game size, the number of game downloads, etc. Similarly, the user can click the "Install" control of the recommended application to download and install the recommended application.

[0142] against Figure 1 In the scenarios described above, it is important to understand that all components included in the recommendation section "Details Page - Introduction" and components included in the recommendation section "Details Page - Game Recommendation" can be configured in the background. It is through a series of background configurations that the corresponding component display effects in the app market are achieved.

[0143] The following can be combined Figures 2 to 4 This section explains the background configuration implementation of the two recommendation positions: details page-introduction and details page-game recommendation.

[0144] First combine Figure 2 Explain the recommended position of "Details Page-Introduction". Figure 2 As shown in (a) in FIG. 1 , in the background configuration interface of the recommended position, multiple menus may be included on the left, such as the five menus of “Module A”, “Module B”, “Module C”, “Module D”, and “Module E”, as well as Figure 2 Also shown are multiple submenus included after the menu "B module" is expanded, for example, the four submenus include "B1 module", "B2 module", "B3 module" and "recommended position management".

[0145] Among them, the configuration interface corresponding to the "Recommendation Position Management" submenu can include relevant data for recommendation position management. It can be understood that the configuration interface corresponding to the "Recommendation Position Management" submenu is actually the place for the associated configuration of various recommendation scenarios in the application market introduced above.

[0146] like Figure 2 As shown in (a) in the figure, a recommendation position table consisting of configured recommendation positions can be displayed in the configuration interface, wherein each row of the recommendation position table corresponds to a configured recommendation position, and the data of each row may include the recommendation position ID, the recommendation position name, the component associated with the recommendation position, the recommendation start time, the recommendation end time, the operator, and the current status of the recommendation position. And reference Figure 2 There is an operation box in the last row of each recommendation position, which includes three controls: "Edit", "Delete" and "Disable".

[0147] For any row in the recommendation position table, the "Edit" control is used to open the editing interface corresponding to the recommendation position in that row, the "Delete" control is used to delete the recommendation position in that row and delete related configurations, and the "Disable" control is used to change the status of the recommendation position in that row to disabled.

[0148] exist Figure 2 In (a), the first row in the recommended position table corresponds to the recommended position "Details Page - Introduction" introduced in the above embodiment. Assuming that the edit control of the recommended position "Details Page - Introduction" in the first row is operated, for example, it can be displayed Figure 2 The component editing interface corresponding to the recommended position "Details Page - Introduction" shown in (b).

[0149] like Figure 2 As shown in (b) in the figure, in the component editing interface corresponding to the recommendation position "Details Page - Introduction", the editing module of "Component Configuration" may include area 201 on the left and area 202 on the right. Area 201 on the left may display a component list, which includes component IDs and component names corresponding to multiple components that can be added.

[0150] In a possible implementation, the operator can select the required components in the component list on the left and add them. The added components will be displayed in the 202 area on the right. The components displayed in the 202 area on the right are the components associated with the recommended position "Details Page - Introduction". Correspondingly, in the application of the application market, they will be displayed in the interface corresponding to the recommended position "Details Page - Introduction". And refer to Figure 2It can also be determined in (b) that the order of each added component can be edited, the added components can be deleted, etc. in the 202 area on the right. The operations performed in the 202 area on the right will affect the component content displayed in the interface corresponding to the recommended position of "Details Page-Introduction" in the application of the App Market.

[0151] Next, combine Figure 3 Explain the recommendation position of "Details Page-Recommendation". Figure 3 (a) shows the background configuration interface of the recommended position, which is the same as the above Figure 2 The same as (a) in the introduction, will not be repeated here.

[0152] exist Figure 3 In (a), the second row in the recommendation position table corresponds to the recommendation position "Details Page - Recommendation" introduced in the above embodiment. If the edit control of the recommendation position "Details Page - Recommendation" in the second row is operated, for example, it can be displayed Figure 3 The component editing interface corresponding to the recommendation position "Details Page - Recommendation" shown in (b).

[0153] like Figure 3 As shown in (b) in the component editing interface corresponding to the recommendation position of "Details Page - Recommendation", the editing module of "Component Configuration" may include a 301 area on the left and a 302 area on the right. A component list may be displayed in the 301 area on the left, which is similar to the above description.

[0154] In addition, the operator can select the required components in the component list on the left to add them. The added components will be displayed in the 302 area on the right. The components displayed in the 302 area on the right are the components associated with the recommendation position "Details Page - Recommendation". Correspondingly, in the application of the application market, they will be displayed in the interface corresponding to the recommendation position "Details Page - Recommendation". The relevant implementation method of the right area is the same as above. Figure 2 The introduction of (b) in is similar and will not be repeated here.

[0155] In this embodiment, in addition to editing, deleting, and modifying the status of configured recommendation positions, new recommendation positions can also be added. Figure 2 (a) and Figure 3 In the background configuration interface of the recommendation position shown in (a), there is also a "add" control, and the operator can operate the "add" control to add a new recommendation position.

[0156] You can refer to Figure 4 Understand the newly added recommendation positions, such as Figure 4As shown in (a) in the figure, if the operator operates the "Add" control in the background configuration interface, it can be displayed Figure 4 In the operation interface 401 for adding a recommendation position shown in (b), by clicking on the input box for the recommendation position name, for example, a list of recommendation positions can be displayed, and then a certain recommendation position can be selected from the list of recommendation positions. And by clicking on the input box for the associated component name, for example, a list of components can be displayed, and then one or more recommendation positions can be selected from the list of components. The operation interface 401 may also include more information input boxes, which are not shown in detail here. After all operations on the information input boxes in the current operation interface 401 are completed, for example, a new recommendation position can be created, and a new row will be added to the recommendation position table accordingly.

[0157] In summary, based on the above Figure 2 to Figure 4 It can be confirmed that the operator can perform a series of operations in the background configuration interface to achieve the relevant configuration of the recommendation position in the application market. However, it is understandable that not every operator can perform the above configuration, which may cause confusion in the management of the recommendation position in the application market. Therefore, the configuration operation introduced above is usually performed by a dedicated operator, which involves the introduction of the above embodiment, that different permissions should be assigned to different roles to achieve the corresponding permission allocation and management for the accounts in the system.

[0158] Currently, there are two common permission management models:

[0159] In one implementation, a submenu in the system interface is equivalent to a permission point. Figure 5 To understand, Figure 5 Schematic diagram of the system interface of different permission points provided in the embodiment of the present application Figure 1 .

[0160] like Figure 5 As shown in the figure, assuming that the "Recommendation Position Management" submenu permission point is currently assigned to role A, then after an account associated with role A logs into the system, the system interface will be as follows Figure 5 As shown in (a) in the figure, the "Recommendation Position Management" submenu will be displayed, and the operator who logs in to this account can then perform the relevant configuration of the recommendation position introduced above.

[0161] Also, assuming that the "Recommendation Position Management" submenu permission point is not currently assigned to role B, then after an account associated with role B logs into the system, the system interface will be as follows: Figure 5As shown in (b), the "Recommended Position Management" submenu will not be displayed, and the operator who logs into this account will not be able to perform the relevant configuration of the recommended position introduced above.

[0162] The implementation method currently introduced can effectively implement corresponding permission management for different accounts, but it is understandable that it directly uses a submenu as a permission point for permission configuration, which has the problem of too coarse permission granularity and poor security.

[0163] Therefore, there is another implementation method, in which every control (or interface) and every piece of data in the system can be used as a permission point. For example, the "Add" control, "Edit" control, "Delete" control, "Disable" control, and "Search" control in the background configuration interface introduced above can all be used as a configurable permission point. Even the recommended position table in the background configuration interface can be used as a configurable permission point to configure whether the corresponding role has the permission to view the table. Even more, the above Figure 5 In the editing interface of the newly added recommendation position in (b), the data of each recommendation position name specifically included in the drop-down list of the recommendation position name can also be used as a permission point to configure whether the corresponding role has the permission to pull the data of the corresponding recommendation position name.

[0164] Combine the following Figure 6 Taking two roles with different permissions as an example, the implementation method of this fine-grained division of permission points is explained. Figure 6 Schematic diagram of the system interface of different permission points provided in the embodiment of the present application Figure 2 .

[0165] like Figure 6 As shown in the figure, suppose there is a role C, which has all the permissions in the interface corresponding to the recommended position management submenu. Then, after an account associated with role C logs in to the system, the system interface will be as follows Figure 6 As shown in (a) in the figure, all the controls and data in the interface corresponding to the "Recommendation Position Management" submenu are fully displayed, so the operator who logs in to this account can perform the relevant configuration of the recommendation position introduced above.

[0166] Assume that there is a role D who only has the permission points related to read operations in the interface corresponding to the recommended position management submenu, and does not have any permission points related to write operations. In other words, role D is allowed to view the data in the background configuration interface, but is not allowed to modify the data in any form. Then, after an account associated with role C logs in to the system, its system interface, for example, Figure 6As shown in (b), in the interface corresponding to the "Recommendation Position Management" submenu, the recommendation position table and search controls are displayed because they are permission points related to read operations. However, the controls related to the write operation permission points such as "Edit", "Delete", "Disable", and "Create" introduced above are not displayed. Therefore, the operator logged in to this account can only view the relevant configuration of the recommendation position and cannot modify the data.

[0167] This permission management method can achieve finer-grained permission point division, thereby achieving more flexible permission management, and therefore has a wide range of applications.

[0168] Based on the content of the above embodiment, the implementation method of configuring permissions for roles is further introduced below.

[0169] It is understandable that based on the finer-grained division of authority points, the number of authority points in the system is usually very large, and in order to distinguish different authority points, it is necessary to assign a corresponding identifier to each authority point to achieve a unique indication of each authority point. Exemplarily, the mapping relationship between each identifier and the corresponding authority point can be stored in the system background.

[0170] Furthermore, when generating any role, the administrator usually collects the permission points required for the role offline, and then checks the permission points required for the role in turn in the permission configuration interface. After that, the system background records the mapping relationship between the role and the identifiers of the checked permission points, thereby generating the role.

[0171] Later, when the account needs to apply for a role, the user who applies for the role can send the role application to the system background based on his or her account. When the system background determines that the role can be assigned, it will record the association between the account and the role, so as to assign the applied role to the account. Accordingly, the account will obtain the corresponding system permissions. Then, after the user logs in to the system, he or she can operate or browse the system data corresponding to the various permissions he or she has in the system.

[0172] Combine the following Figure 7 This chapter describes the possible implementation methods of the permission configuration interface for generating roles. Figure 7 Schematic diagram of the permission configuration interface provided in the embodiment of the present application Figure 1 .

[0173] like Figure 7 As shown, in the permission configuration interface, a table consisting of relevant data of multiple optional permission points can be displayed, wherein the first row of the table is used to indicate the specific meaning of each column of data. Figure 7In the example, the first row in the table is: permission point category, permission point ID, permission point name, module.

[0174] Among them, "authority point category" is used to indicate that the meaning of the first column of data in the table is the authority point category. For example, multiple authority points in the system can be classified in advance, so that each authority point can be determined to belong to a category. For example, the categories divided for authority points can also have a hierarchical relationship, for example Figure 7 In the example, the category "function" is a subcategory under the category "page", where "page" can be understood as a first-level category, and "function" can be understood as a second-level category under the first-level category "page". In the actual implementation process, the specific category division method can be selected and set according to actual needs, and this embodiment does not limit this, as long as the classification and division of permission points can be implemented.

[0175] And, "Permission Point ID" is used to indicate that the second column of data in the table means the identifier of the permission point. Figure 7 In the example, the permission point identifier is the meaning of the permission point expressed by English words and / or English abbreviations. In the actual implementation process, the permission point identifier can also be any string composed of one or more of numbers, letters, and symbols. This embodiment does not limit this, as long as the permission point identifier can achieve the unique indication of the permission point. In a possible implementation, because in this embodiment, each interface (that is, an operable control) and each data in the system can be used as a permission point, the permission point ID here can also be understood as set for each interface or data, that is, the permissions are divided by identifying each interface or data as a string type ID.

[0176] And, "Permission Point Name" is used to indicate that the meaning of the third column of data in the table is the Chinese name of the permission point. This is mainly to help operators understand the specific role of each permission point and assist in selecting the permission points currently required.

[0177] And, "module" is used to indicate that the meaning of the fourth column data in the table is the system module to which the permission point belongs.

[0178] Based on the meaning of the data in each column in the table introduced above, Figure 7 For example, let's take the first permission point in the table (that is, the permission point corresponding to the second row in the table) as an example. For the first permission point, we can determine that its category is "Menu", its identifier is "SearchModule", its Chinese name is "Search Module", and its system module is Module 1. Figure 7 The other permission points in are similar and will not be described here.

[0179] And reference Figure 7 It can also be determined that for each row in the table, there is a selection control in front of it (i.e. Figure 7 The operator can select the rectangle in the permission configuration interface. Figure 7 You can use the search box shown to search for the required permission point, or browse the table of permission points to find the required target permission point. Then you can operate the selection control in front of the target permission point to select the target permission point.

[0180] For example, Figure 7 In the example, suppose that the permission configuration is to be performed for role A, and that the two target permission points with the permission point IDs "updateSearchWordConfStatus" and "querySearchWordConfList" are selected for role A. Then, suppose the configuration personnel clicks Figure 7 By clicking the "OK" control in the function, role A can be generated, and the mapping relationship between role A and the two permission point identifiers "updateSearchWordConfStatus" and "querySearchWordConfList" can be stored in the system background, thereby recording the permission points possessed by role A.

[0181] Then refer to Figure 7 It can be determined from the introduction that for each role, the system background needs to store the mapping relationship between the role and the corresponding permission point identifier. When there are many roles and many permission point identifiers that need to be associated with each role, the amount of data that the system background needs to store is relatively large. On this basis, in the current related technology, a string type ID is used as its identifier for each permission point. Assuming that the average size of a string type ID is 50 bytes, if for a certain role, it is necessary to associate and store the identifiers of 1,000 permission points for it, 50K of storage space is required. Therefore, there is a problem of waste of storage resources in the current implementation scheme.

[0182] In addition, the current implementation method still has the problem of not being able to distinguish data permissions, especially for buttons involving user privacy, which need to be isolated. Assuming that in a shopping scenario, for the order query interface, the administrator role can see sensitive information such as the purchaser's name and delivery address, but the ordinary operation role can only see general information such as the purchased goods, quantity, and amount.

[0183] Furthermore, based on the implementation scheme introduced above, if the administrator needs to grant role A the permission to add, delete, modify and check the recommended position management in the application market, and needs to grant role B the permission to read-only view the recommended position management in the application market, the administrator must operate each permission point identification one by one when constructing each role, which is time-consuming and labor-intensive, and seriously affects the production and operation efficiency. But in fact, compared with role A, role B only needs to remove the write permission, but the existing permission model cannot support the addition, deletion, and modification operations when the role is associated with the permission point, and complex operations such as union, intersection, and difference cannot be supported. It can only implement the configuration processing of the entire process for each role in turn, so there is still the problem of high permission management cost.

[0184] In response to the technical problems introduced above, the present application proposes the following technical concept: compared with using string type data as a permission point identifier, multiple bits can be used to represent the role's permissions, where one bit corresponds to one permission point, and the value of the bit is used to indicate whether the role has the corresponding permission. In this way, each permission point only needs to occupy one bit, which can greatly save system space, and the bits are convenient for performing the complex operations such as union, intersection, and difference introduced above, so it can also effectively solve the problem of high permission management costs.

[0185] Based on the above introduction, the permission management method provided by this application is described below in conjunction with specific embodiments. The execution subject of each embodiment in this application can be a local server, a cloud server, a processor, a chip, and other devices with data processing functions. It can be understood that the execution subject of each embodiment in this application is a device running the system background, which is used to process the various tasks to be performed by the system background, and naturally includes the permission management tasks provided by this application. On this basis, the specific execution subject can be selected and set according to actual needs.

[0186] Let's first combine Figures 8 to 10 Introduce the permission management method provided by this application. Figure 8 A flowchart of a rights management method provided in an embodiment of the present application, Fig. 9 A schematic diagram of implementing the authority value provided in the embodiment of the present application, Fig.10 A schematic diagram of the merger of permission values ​​provided in an embodiment of the present application.

[0187] like Figure 8 As shown, the method includes:

[0188] S801. Determine at least one target authority point configured for a target role.

[0189] In this embodiment, assuming that permissions are to be configured for a target role, at least one target permission point to be configured for the target role can be first determined. A permission point is an interface or a data in the system, and any relevant resource in the system that can be used as a permission configuration unit can be used as a permission point in this embodiment.

[0190] And, which target authority points are to be configured for the target role depends on the actual needs of the target role, so this embodiment also does not limit the specific content of at least one target authority point.

[0191] S802. Obtain indication information corresponding to each target authority point, where the indication information includes an authority value for indicating the target authority point, the authority value includes an indication bit corresponding to the target authority point, and the value of the indication bit in the authority value is a first preset value.

[0192] After determining the target permission point, in this embodiment, the indication information corresponding to each target permission point can be obtained. Exemplarily, the indication information corresponding to each target permission point can be stored in the system background, so the indication information corresponding to each target permission point can be directly obtained from the system background.

[0193] In this embodiment, the indication information of the target authority point includes an authority value for indicating the target authority point, and the authority value of each target authority point includes multiple bits, among which there is an indication bit corresponding to the target authority point, and in the authority value of the target authority point, the value of the corresponding indication bit is a first preset value, thereby realizing the indication of the authority value to the current target authority point.

[0194] In a possible implementation, the positions of the indication bits in the authority values ​​corresponding to different target authority points are different, so that the target authority points can be distinguished and represented.

[0195] Here, the representation method of the permission value of the permission point is explained. Assuming that there are t permission points at present, for example, t bits can be used to represent the t permission points, and t is an integer greater than or equal to 1. One bit corresponds to one permission point. For any permission point, the bit corresponding to the permission point is the first preset value, and the remaining bits except the bit corresponding to the permission point are the second preset value. The permission value formed by such bit values ​​is used to represent the permission point.

[0196] The first preset value is, for example, 1, and the second preset value is, for example, 0. Alternatively, the first preset value may be 0 and the second preset value may be 1, which is not limited in this embodiment, as long as the first preset value and the second preset value are one of 0 and 1 and are different.

[0197] For example, you can refer to Fig. 9 To understand the above content, assume that t is equal to 4, that is, there are currently 4 permission points, assuming that they are permission point A, permission point B, permission point C and permission point D. For example, 4 bits can be used to correspond to these 4 permission points respectively.

[0198] like Fig. 9 As shown, assuming that the first bit corresponds to the permission point A, and assuming that the first preset value is 1, then when the value of the first bit is 1 and the values ​​of the other bits are 0, a permission value of 0001 can be obtained, and the corresponding decimal representation is 1, so it can be determined that the permission value used to represent the permission point A is 1. It should be noted here that the i-th bit introduced in this embodiment is calculated from the right to the left, and i is an integer greater than or equal to 1.

[0199] And, assuming Fig. 9 The second bit in corresponds to permission point B, and assuming that the first preset value is 1, then when the value of the second bit is 1 and the values ​​of the remaining bits are 0, the permission value of 0010 can be obtained, and the corresponding decimal representation is 2. Therefore, it can be determined that the permission value used to represent permission point B is 2. Fig. 9 The permission points C and D in are similar. It can be determined that the permission value used to represent the permission point C is 4, and the permission value used to represent the permission point D is 8.

[0200] Therefore, in this embodiment, it can be implemented that one bit corresponds to one authority point, then the number of bits of the authority value can be equal to the number of authority points, so such an implementation method can save system storage space to a great extent.

[0201] S803, merging the authority values ​​corresponding to the target authority points to determine a first compressed authority value corresponding to the target authority point, wherein the first compressed authority value includes an indication bit corresponding to each target authority point, and the value of each indication bit in the first compressed authority value is a first preset value, and the indication bit having the first preset value is used to indicate that the target role has the authority of the target authority point corresponding to the indication bit.

[0202] After determining the indication information corresponding to each target permission point, there is an implementation method of directly associating and storing the target role with the indication information of each target permission point, which is similar to the implementation method of associating and storing the identification of each permission point corresponding to the role described above. However, if the indication information of each target permission point is stored separately for each role, then if there are a large number of target permission points configured for the target role and a large number of roles configured in the system, it will inevitably cause a large amount of storage space in the system to be occupied.

[0203] Therefore, in this embodiment, the authority values ​​corresponding to each target authority point are merged to obtain the first compressed authority value corresponding to the target authority point, and the first compressed authority value here refers to the multiple target authority points as a whole. The first compressed authority value includes the indication bits corresponding to each target authority point, and the value of each indication bit in the first compressed authority value is the first preset value, and the indication bit with the first preset value is used to indicate that the target role has the authority of the target authority point corresponding to the indication bit.

[0204] Exemplarily, in the present embodiment, in the authority value set for each target authority point, there is an indication bit corresponding to the target authority point, and the indication bits set for different target authority points will not conflict, so the authority values ​​corresponding to each target authority point can be merged to obtain an overall first compressed authority value.

[0205] In one possible implementation, the merging process introduced in this embodiment may be a bitwise OR process of the authority value, that is, for each bit, the authority values ​​corresponding to the multiple target authority points are "OR" processed at the value of the bit, thereby obtaining the merging result of the bit, and then the merging result of multiple bits constitutes the first compressed authority value.

[0206] For example, you can combine Fig.10 To understand, assuming that the above example is continued, among the four permission points, namely, permission point A, permission point B, permission point C and permission point D, assuming that permission point A and permission point D are determined as the target permission points configured for the target role, the target permission point A and the target permission point C can be merged according to their permission values.

[0207] Reference Fig.10, according to the permission value (0001) of the target permission point A and the permission value (1000) of the target permission point C, a bitwise OR process is performed, that is, the 1 and 0 of the first bit are OR-processed, and the merged result of the first bit is 1; and the 0 and 0 of the second bit are OR-processed, and the merged result of the second bit is 0; and the 0 and 0 of the third bit are OR-processed, and the merged result of the third bit is 0; and the 0 and 1 of the fourth bit are OR-processed, and the merged result of the fourth bit is 1. Therefore, it can be determined that the first compressed permission value obtained after the merger is 1001, and the corresponding decimal expression is 9.

[0208] exist Fig.10 In the first compressed authority value 1001 of the example, the first bit is the indication bit corresponding to the target authority point A, and the fourth bit is the indication bit corresponding to the target authority point D. Among them, the values ​​of the first bit and the fourth bit are both 1 (preset value), the first bit with a value of 1 is used to indicate that the target role has the authority of the target authority point A corresponding to the first bit, and the fourth bit with a value of 1 is used to indicate that the target role has the authority of the target authority point D corresponding to the fourth bit.

[0209] The merging operation described here is to perform bitwise OR processing on the permission value of the target permission point. It can be understood that when the first preset value is 1, the bitwise OR operation is performed, and when the first preset value is 0, the bitwise AND operation is performed. In the actual implementation process, the merging process can also be, for example, a bitwise addition process, and its specific implementation method can be expanded according to actual needs, as long as the permission values ​​of multiple target permission points can be merged into a first compressed permission value, and then the first compressed permission value can meet the conditions described above.

[0210] Therefore, referring to the current example, it can be understood that in this embodiment, when recording the corresponding target permission point for the target role, the permission values ​​of each target permission point will be further merged, so that multiple permission values ​​are merged into a first compressed permission value. In the first compressed permission value, each bit can indicate a permission point. Specifically, when the bit value in the first compressed permission value is the first preset value, it indicates that the target role has the permission of the permission point corresponding to the bit, otherwise, it indicates that the target role does not have the permission of the permission point corresponding to the bit.

[0211] Therefore, compared with the implementation method of storing the permission values ​​of each target permission point, the technical solution of the present application can save the storage space of the system to a great extent.

[0212] S804: Generate and store first target permission data associated with the target role according to the first compressed permission value.

[0213] After obtaining the first compressed permission value introduced above, the first target permission data associated with the target role can be generated according to the first compressed permission value, wherein the first target permission data is used to indicate each target permission point that the target role has permission. Exemplarily, the first compressed permission value can be directly used as the first target permission data. Alternatively, the first compressed permission value can be subjected to some data processing to obtain the first target permission data associated with the target role.

[0214] Afterwards, the system background can associate and store the target role and its corresponding first target permission data, thereby completing the construction of the target role and configuring the corresponding target permission points for the target role.

[0215] The permission management method provided by the embodiment of the present application includes: determining at least one target permission point configured for a target role. Obtaining indication information corresponding to each target permission point, the indication information includes a permission value for indicating the target permission point, the permission value includes an indication bit corresponding to the target permission point, and the value of the indication bit in the permission value is a first preset value. Performing merging processing according to the permission values ​​corresponding to each target permission point, determining a first compressed permission value corresponding to the target permission point, the first compressed permission value includes an indication bit corresponding to each target permission point, and the value of each indication bit in the first compressed permission value is a first preset value, and the indication bit with the first preset value is used to indicate that the target role has the permission of the target permission point corresponding to the indication bit. According to the first compressed permission value, generating and storing the first target permission data associated with the target role. The permission point is represented by the permission value, wherein the permission value of each permission point includes an indication bit corresponding to the permission point, and by setting the value of the indication bit to the first preset value, the permission value can be used to represent the target permission point. Furthermore, when configuring the target authority point for the target role, the authority values ​​corresponding to each target authority point will be further merged to obtain a compressed authority value, wherein the compressed authority value has a smaller data volume on the one hand, and includes the indication bits corresponding to each target authority point on the other hand. Therefore, based on a first compressed authority value, a unified indication of each target authority point can be achieved, and each target authority point can be identified by a bit. Therefore, according to the first compressed authority value, the first target authority data associated with the target role is generated and stored, which can effectively realize the authority configuration for the target role and save the system storage space to a great extent.

[0216] On the basis of the above introduction, the implementation method based on the permission value composed of multiple bits to represent the target permission point has achieved better results in terms of memory saving compared to the implementation method using a string as the permission point identifier introduced above. Assuming that the above logic continues to be used, that is, if there are t permission points at present, t bits are used to represent these t permission points, then as the number of permission points increases, the number of bits corresponding to the permission value will inevitably increase. Therefore, based on the above embodiment, the present application also proposes a further implementation scheme to further save system storage space.

[0217] Specifically, the reason why the number of bits corresponding to the permission value increases with the increase in the number of permission points is that the strategy adopted is to use one bit to represent one permission point, and the indication bits corresponding to different permission points cannot be the same, so as to avoid the situation where the same permission value corresponds to multiple permission points. If the number of bits corresponding to the permission value is controlled at a certain value, and then the permission points are divided into levels, then in different levels, the same bit can be reused to represent different permission points respectively in combination with different levels.

[0218] Therefore, in this embodiment, the indication information may also include a level value, and the level value is used to indicate the authority level corresponding to the target authority point.

[0219] The following can be combined Fig.11 Understand the permissions hierarchy. Fig.11 A schematic diagram of the level values ​​and authority values ​​provided in an embodiment of the present application.

[0220] like Fig.11 As shown, assuming that there are currently 8 permission points, namely permission point A to permission point H, and assuming that the number of bits of the fixed permission value is 4, then at least 2 levels need to be divided to achieve the indication of these 8 bits. And because only two levels need to be indicated, the number of bits of the level value is 1 to meet the requirements.

[0221] For specific examples, see Fig.11 For understanding, assuming that the number of bits of the level value is 1, the value of this bit can be 0 and 1. When the value is 0, the corresponding level value is 0, and when the value is 1, the corresponding level value is 1. The level value of 0 and the level value of 1 respectively indicate two permission levels.

[0222] For the first permission level, the permission values ​​of each permission point in the permission level are further analyzed. Assuming that the first bit in the current level corresponds to permission point A, and assuming that the first preset value is 1, then when the value of the first bit is 1 and the values ​​of the remaining bits are 0, a permission value of 0001 can be obtained, and the corresponding decimal representation is 1. Therefore, it can be determined that the permission value used to represent permission point A is 1. Then for permission point A, the level value is 0 and the permission value is 1, and the indication information of permission point A can be obtained as follows: Fig.11 (0,1) shown.

[0223] Similarly, for permission point B, the level value is 0 and the permission value is 2, then the indication information of permission point B is Fig.11 As shown in (0,2). For permission point C, the level value is 0 and the permission value is 4, the indication information of permission point C is Fig.11 As shown in (0,4). For permission point D, the level value is 0 and the permission value is 8, then the indication information of permission point D is Fig.11 (0,8) shown.

[0224] And, for the second permission level, further analyze the permission values ​​of each permission point in the permission level. Assuming that the first bit in the current level corresponds to permission point E, and assuming that the first preset value is 1, then when the value of the first bit is 1 and the values ​​of the remaining bits are 0, a permission value of 0001 can be obtained, and the corresponding decimal representation is 1, so it can be determined that the permission value used to represent permission point E is also 1. Then for permission point E, the level value is 1, and the permission value is 1, and the indication information of permission point E can be obtained as follows: Fig.11 (1,1) shown.

[0225] Similarly, for permission point F, the level value is 1 and the permission value is 2, then the indication information of permission point F is Fig.11 As shown in (1,2). For the permission point G, the level value is 1, the permission value is 4, and the indication information of the permission point G is Fig.11 As shown in (1,4). For permission point H, the level value is 1, the permission value is 8, and the indication information of permission point H is Fig.11 (1,8) shown.

[0226] based on Fig.11 It can be determined from the example introduced that multiplexing is achieved for the 4 bits used to constitute the permission value. For example, the first bit is used for both the corresponding permission point A (corresponding to the level value 0) and the corresponding permission point E (corresponding to the level value 1).

[0227] In this case, 8 permission points can be represented based on 5 bits, but if the levels are not divided, 8 bits are required to complete the representation. Therefore, by dividing the permission levels, the system storage space can be further saved.

[0228] It should also be noted that, for example, the number of bits of the permission value can be set to be fixed at t. When dividing the permission levels, there is an implementation method that when the number of permission points in a permission level is equal to t, the permission level of the next level is expanded. Taking t=4 as an example, for example, there is first a permission level with a level value of 0. When there are already 4 corresponding permission points in the permission level, the permission level with a level value of 1 is expanded.

[0229] Also, when the number of bits of the level value is insufficient to represent the required permission level, the number of bits of the level value can be expanded. For example, if the number of bits of the current fixed permission value is 4, then when the number of permission points is 16, at least 4 permission levels need to be divided. Then 1 bit is insufficient to represent 4 permission levels, so for example, the number of bits of the level value can be expanded to 2, and the level values ​​can be 00, 01, 10, 11, corresponding to 4 permission levels respectively.

[0230] The above introduction is a way of dividing the permission levels, that is, when the representation of permission points in one permission level is full, the next permission level will be expanded. This ensures that in the permission levels from small to large, the bits of the permission values ​​in each permission level except the last level are effectively utilized.

[0231] However, there is another way to divide the permission levels, which is to classify the permission points in the system according to actual needs, and then set different permission levels corresponding to the permission points of different categories, that is, multiple permission points in each permission level correspond to the same category. In this way, the permission points of a specific category can be quickly found through the level value, so as to achieve classified and orderly representation of a large number of permission points.

[0232] Assume that currently, according to the actual business needs of the system, permission points can be divided into permission points of operation type and permission points of data type. Then, for example, even-numbered level values ​​can be used to represent permission points of operation type, and odd-numbered level values ​​can be used to represent permission points of data type. Assume that the digital combination of level value N and permission value M is represented as (LevelN, LongM), then the permission point corresponding to the even-numbered level value can be represented as (Level2N, LongM), where 2N represents the level value and M represents the permission value; and the permission point corresponding to the odd-numbered level value can be represented as (Level2N+1, LongM), where 2N+1 represents the level value and M represents the permission value.

[0233] For example, you can combine Fig.12 To understand, Fig.12 A schematic diagram of the classification of authority points provided for an embodiment of the present application.

[0234] like Fig.12 As shown, the permission point set of the system can be divided into, for example, permission points of operation type and permission points of data type.

[0235] The operation type can be further subdivided into read type, add type, edit type, delete type, etc. Fig.12 In the example, in the indication information corresponding to the permission point of the operation type, the level value is an even number. Furthermore, based on the general principle of even numbers, for example, the level value setting rules of the sub-types such as read type, add type, edit type, and delete type can be further set. Fig.12 In the example, two read-type permission points with indication information (0,1) and (0,2) are schematically shown. In the indication information, the first value is the level value and the second value is the permission value. It can be determined that the level value of the read-type permission point is 0. The rest are similar, refer to Fig.12 What is certain is that the level value of the new type of permission point is 2, the level value of the edit type of permission point is 4, and the level value of the delete type of permission point is 6.

[0236] Alternatively, for example, the level values ​​of the read type permission points can be set to 0 and 2, the level values ​​of the add type permission points can be set to 4 and 6, the level value of the edit type permission points can be set to 8, and the level value of the delete type permission points can be set to 10.

[0237] And, the data type can be further subdivided into common permission type, first-level sensitive permission type, second-level sensitive permission type, third-level sensitive permission type, etc. Fig.12In the example, in the indication information corresponding to the permission point of the data type, the level values ​​are all odd numbers. Furthermore, based on the general principle of odd numbers, for example, the level value setting rules of the subdivided subtypes such as ordinary permission type, first-level sensitive permission type, second-level sensitive permission type, and third-level sensitive permission type can be further set. Fig.12 In the example, two permission points of the common permission type with indication information (1,1) and (1,2) are schematically shown. In the indication information, the first value is the level value and the second value is the permission value. It can be determined that the level value of the permission point of the common permission type is 1. The rest are similar, refer to Fig.12 What can be determined is that the level value of the permission point of the first-level sensitive permission type is 3, the level value of the permission point of the second-level sensitive permission type is 5, and the level value of the permission point of the third-level sensitive permission type is 7.

[0238] Alternatively, for example, the level values ​​of the permission points of the general permission type can be set to 1 and 3, the level values ​​of the permission points of the first-level sensitive permission type can be set to 5 and 7, the level value of the permission points of the second-level sensitive permission type can be set to 9, and the level value of the permission points of the third-level sensitive permission type can be set to 11. And for example, a rule can be set that in the permission points with data types, the larger the level value corresponding to the permission point, the more sensitive the data corresponding to the permission point is.

[0239] In the actual implementation process, the specific classification method of permission points, and the specific permission levels used for each classification to represent the various permission points under the classification, can be set with corresponding rules according to actual business needs, and this embodiment does not limit this.

[0240] Assume that the digital combination of the level value N and the authority value M used to represent the authority point is represented as (LevelN, LongM), and assume that there are C authority point categories currently divided, then for the corresponding method of the authority point classification and the corresponding authority level introduced above, for example, the following Table 1 can be abstracted:

[0241] Table 1

[0242] Permission categories Combination Example 1 (LevelC*N,LongM) (Level0,LongM), (LevelC,LongM) 2 (LevelC*N+1,LongM) (Level1,LongM),(LevelC+1,LongM) 3 (LevelC*N+2,LongM) (Level2,LongM),(LevelC+2,LongM) … P (LevelC*N+P-1,LongM) (LevelP-1,LongM),(LevelC+P-1,LongM) … C (Level C*N+C-1,LongM) (LevelC-1,LongM), (Level2C-1,LongM)

[0243] In the above Table 1, C is the number of divided permission point categories, P represents the Pth permission point category of C permission point categories, C is an integer greater than or equal to 1, and P is an integer greater than or equal to 1 and less than or equal to C.

[0244] Assuming that the above-mentioned even-numbered level values ​​and odd-numbered level values ​​are divided in Table 1, the number of divided permission point categories C is equal to 2. The combination of the first permission category is expressed as (Level2N, LongM), where 2N represents the level value and M represents the permission value. For example, (Level0, LongM) and (Level2, LongM) are examples of the digital combination of permission points under the current permission category.

[0245] And, the combination of the first permission category is expressed as (Level2N+1, LongM), where 2N+1 represents the level value and M represents the permission value. For example, (Level1, LongM) and (Level3, LongM) are examples of the digital combination of permission points under the current permission category.

[0246] In this embodiment, by setting multiple permission points in each permission level to the same category, that is, dividing and using the permission levels according to the classification results of the permission points, multi-category and multi-level permission isolation can be effectively implemented, which can not only meet business needs, but also ensure that the permission points at each level do not conflict with each other.

[0247] Based on the above introduction, the byte size of the permission value and the level value in the indication information is further explained here.

[0248] In the actual implementation process, encoding the corresponding indication information for the permission points in the system is actually completed in advance before the role configuration. Therefore, in a possible implementation method, the byte size of the permission value and the level value can be determined according to the actual number of permission points in the system to ensure that the byte size of the permission value and the level value is sufficient to encode the corresponding indication information of each permission point.

[0249] Therefore, the byte sizes of the permission value and the level value in the present application may be fixed, for example, the permission value includes K bytes, and the level value includes L bytes, where K and L are integers greater than or equal to 1. Exemplarily, K and L may be values ​​of any size determined according to the actual encoding requirements of the permission point value.

[0250] Alternatively, the value type of the permission value can be set to a long integer (long), and the value type of the level value can be set to an integer (int) or a short integer (short). In this way, the data types of the permission value and the level value can be pre-configured to fix the byte size of the permission value and the level value to a certain value. This implementation method of fixing the byte size of the permission value and the level value by the value type of the permission value and the level value can realize the determination of the byte size of the permission value and the level value according to the adaptability of different operating systems, and facilitates the storage of the permission value and the level value. And in this implementation method, the value type of the permission value and the value type of the level value can be selected according to actual needs. The above-mentioned permission value value type is long, and the value type of the level value is int or short. It is a more preferred implementation method, because usually there are more permission points that need to be represented in a permission level. Therefore, setting the value type of the permission value to long can achieve more bytes for the permission value.

[0251] In the actual implementation process, whether to flexibly set K and L according to actual needs, or to fix the byte size of the permission value and the level value by specifying the value type of the permission value and the level value, both implementation methods can be flexibly selected according to actual needs.

[0252] In summary, in the technical solution of the present application, a permission point can be represented by a digital combination of (level value (K bytes), permission value (L bytes)). When storing the same number of permission points for roles, the storage space required by the technical solution of the present application is a few hundredths of the storage space occupied by the permission point identification implementation method, so that storage space can be effectively saved. At the same time, in the present application, the permission values ​​of the same permission level can be merged to obtain compressed permission values ​​corresponding to each level value, so as to greatly reduce the number of associated records between roles and permission points, and can also further reduce the occupation of system storage space.

[0253] As described in the above embodiment, in this application, the authority values ​​corresponding to each target authority point are merged to obtain a first compressed authority value. When there is no authority hierarchy, the authority values ​​corresponding to each target authority point can be directly merged to obtain a first compressed authority value. However, when there are multiple authority levels, because the indication bits corresponding to the authority points in different authority levels are reused, they cannot be directly merged as a whole.

[0254] Combine the following Fig.13The specific implementation of the merging process of permission values ​​in the case of division into permission levels is further introduced in detail. Fig.13 Schematic diagram of the implementation of determining the target role provided in the embodiment of the present application Figure 1 .

[0255] like Fig.13 As shown, in this embodiment, the indication information corresponding to each target permission point is obtained, and the indication information includes both the permission value and the level value. Because the permission values ​​of the permission points in the same permission level do not conflict, in this embodiment, the permission values ​​of the target permission points corresponding to the same permission level in multiple target permission points can be merged to obtain the first compressed permission value corresponding to the permission level.

[0256] In the indication information corresponding to each of the multiple target authority points, there may be multiple level values. The processing for any level value is similar, so any one of them is used as an example for explanation below.

[0257] For any level value, in this embodiment, multiple indication information including the level value can be determined in the indication information corresponding to each target authority point, and then the authority values ​​in the multiple indication information including the level value can be bitwise ORed to obtain the first compressed authority value corresponding to the level value.

[0258] The current example is introduced by taking the implementation method where the value type of the permission value is long and the value type of the level value is short or int as an example. Those skilled in the art can understand that the byte sizes corresponding to the short, int and long types will have different results in different operating systems. The following embodiments are explained by taking the short type as 2 bytes, the int type as 4 bytes, and the long type as 8 bytes as an example. When the byte sizes corresponding to the short, int and long types are other implementation methods, the relevant implementation methods can replace the values ​​accordingly.

[0259] exist Fig.13 In the example, assume that there are four target permission points to be configured for the target role, namely permission point A, permission point B, permission point C, and permission point D.

[0260] In this embodiment, the value type of the permission value is long, which is 8 bytes, of which 1 byte is 8 bits, so the number of bits corresponding to the corresponding permission value is 64, and these 64 bits can be used to indicate 64 permission points. Also, the value type of the level value is short or int. When the value type of the level value is short, it is 2 bytes, which is 16 bits, and these 16 bits can indicate 65536 permission levels; when the value type of the level value is int, it is 4 bytes, which is 32 bits, and these 32 bits can indicate 4294967296 permission levels.

[0261] For authority point A, its authority value is Fig.13 The 8 bytes 0…00001 are shown in the figure. Fig.13 In this embodiment, the ellipsis is omitted by several 0s), the first bit of the 8 bytes is used to indicate the authority point A, and the decimal representation of the authority value of the corresponding authority point A is 1. And the level value of the authority point A is Fig.13 The 2 bytes (or 4 bytes) 0000…00 correspond to the decimal representation of the level value of the permission point A, so the indication information of the permission point A can be expressed as (0,1), where 0 is the level value of the permission point A and 1 is the permission value of the permission point A.

[0262] For permission point B, its permission value is Fig.13 The 5th bit of the 8 bytes 0…10000 is used to indicate the permission point B. The decimal representation of the permission value of the corresponding permission point B is 16. The level value of the permission point B is Fig.13 The 2 bytes (or 4 bytes) 0000…00 shown in the figure have a decimal representation of the level value of the corresponding permission point B, which is 0. Therefore, the indication information of the permission point B can be represented as (0,16), where 0 is the level value of the permission point B and 16 is the permission value of the permission point B.

[0263] For permission point C, its permission value is Fig.13 The 8 bytes 0…0010 are shown in the figure. The second bit of these 8 bytes is used to indicate the permission point C. The decimal representation of the permission value of the corresponding permission point C is 2. The level value of the permission point C is Fig.13 The 2 bytes (or 4 bytes) 0000…01 shown in the figure, the decimal representation of the level value of the corresponding permission point C is 1, so the indication information of the permission point C can be expressed as (1,2), where 1 is the level value of the permission point C, and 2 is the permission value of the permission point C.

[0264] For authority point D, its authority value is Fig.13 The 4th bit of the 8 bytes 0…1000 is used to indicate the permission point D. The decimal representation of the permission value of the corresponding permission point D is 8. The level value of the permission point D is Fig.13 The 2 bytes (or 4 bytes) 0000…01 shown in the figure, the decimal representation of the level value of the corresponding permission point D is 1, so the indication information of the permission point D can be expressed as (1,8), where 1 is the level value of the permission point D, and 8 is the permission value of the permission point D.

[0265] In targeting Fig.13 When merging the permission values ​​of the four permission points shown in the figure, only the same permission level can be merged. In the current example, there are two level values, 0 and 1, and these two level values ​​are processed separately.

[0266] For the level value 0, among the indication information corresponding to each of the four target permission points, multiple indication information including the level value 0 is first determined, namely, the indication information (0, 1) of permission point A and the indication information (0, 16) of permission point B. Then, the permission values ​​in the two indication information are bitwise ORed to obtain the first compressed permission value corresponding to the level value 0.

[0267] Reference Fig.13 It can be determined that the bits of the permission value in the indication information (0,1) are 8 bytes of 0…00001, and the bits of the permission value in the indication information (0,16) are 8 bytes of 0…10000. Then, the bits of these two permission values ​​are processed bit by bit, and we can get Fig.13 The first compression authority value of the 8 bytes 0…10001 shown corresponds to 17 in decimal.

[0268] And for the level value 1, the indication information corresponding to each of the four target permission points, first determine multiple indication information including the level value 1, that is, the indication information (1, 2) of the permission point C and the indication information (1, 8) of the permission point D. Then, perform a bitwise OR operation on the permission values ​​in the two indication information to obtain the first compressed permission value corresponding to the level value 1.

[0269] Reference Fig.13 It can be determined that the bits of the permission value in the indication information (1,2) are 8 bytes of 0...0010, and the bits of the permission value in the indication information (1,8) are 8 bytes of 0...1000. Then, the bits of these two permission values ​​are processed bit by bit, and we can get Fig.13The first compression authority value of the 8 bytes 0…1010 shown corresponds to 10 in decimal.

[0270] After determining the first compressed permission value corresponding to each level value, in this embodiment, for any level value, the level value and the first compressed permission value corresponding to the level value can be determined as a piece of associated data. Then, the set of each associated data is determined as the first target permission data associated with the target role; and the target role and the first target permission data are associated and stored.

[0271] For example, Fig.13 In the example of , the level value 0 and the corresponding first compression authority value 17 can be determined as a piece of associated data, that is, Fig.13 As shown in (0,17). And the level value 1 and the corresponding first compression authority value 10 are determined as a piece of associated data, that is, Fig.13 As shown in (1,10), the set of these two associated data is the first target permission data of the target role. After that, the target role and the target permission values ​​(0,17) and (1,10) are associated and stored to realize the permission configuration of the target role.

[0272] It should be noted that the example of this embodiment introduces the case where the first preset value is 1. When the first preset value is 1, the bitwise OR operation in this embodiment is performed. When the first preset value is 0, the bitwise AND operation is performed. It can be flexibly selected according to actual needs.

[0273] In this embodiment, the permission data of the target permission points of the same permission level are merged to obtain the first compressed permission values ​​corresponding to each level value, and then the level value and the corresponding first compressed permission value are used as an associated data, and then the collection of associated data is stored as the first target permission data and the target role in association with each other. In this way, for each permission level of the target role, only one first compressed permission value needs to be stored to indicate each permission point in the permission level, thereby effectively saving system storage space, and the combination of permission values ​​and level values ​​in the present application can represent a large number of permission points.

[0274] In conjunction with Table 2, an exemplary comparison is made below between the storage space occupied by the technical solution of the present application and the storage space occupied by the prior art when storing different numbers of permission points for the target role.

[0275] Table 2:

[0276] Number of target authority points (int, long) space occupied (short, long) space occupied String space 64 12 bytes 10 bytes 3200 bytes 1000 192 bytes 16 bytes 50000 bytes 10000 1884 bytes 1570 bytes 500000 bytes

[0277] Assume that 64 target permission points are to be associated and stored for the target role:

[0278] Method 1: If the level value is set to int type (4 bytes) and the permission value is set to long type (8 bytes), then the associated data corresponding to a permission level (including the level value and the first compressed permission value) is 12 bytes, of which the 8-byte first compressed permission value can indicate 64 target permission points. Therefore, only one permission level needs to be divided. Therefore, only one 12-byte associated data needs to be stored for the target role, occupying 12 bytes of storage space, to configure 64 target permission points.

[0279] Method 2: If the level value is set to short type (2 bytes) and the permission value is set to long type (8 bytes), then the associated data corresponding to a permission level (including the level value and the first compressed permission value) is 10 bytes, of which the 8-byte first compressed permission value can indicate 64 target permission points. Therefore, only one permission level needs to be divided. Therefore, only 1 10-byte associated data needs to be stored for the target role, occupying 10 bytes of storage space, to configure 64 target permission points.

[0280] Method 3: In the traditional solution, the permission point identification of each permission point is implemented in the form of a string. Assuming that the average size of a permission point identification is 50 bytes, 64 target permission points require 3200 bytes. In this implementation method, the permission point identification corresponding to each of the 64 target permission points needs to be associated and stored for the target role, which requires 3200 bytes of storage space to configure the 64 target permission points.

[0281] Assume that 1,000 target permission points are to be associated and stored for the target role:

[0282] Method 1: If the level value is set to int type (4 bytes) and the permission value is set to long type (8 bytes), then the associated data corresponding to a permission level (including the level value and the first compressed permission value) is 12 bytes, of which the 8-byte first compressed permission value can indicate 64 target permission points. Then 16 permission levels are required to indicate 1000 permission points (divide 1000 by 64 and round up). Therefore, only 16 12-byte associated data need to be stored for the target role, occupying 192 bytes of storage space to configure 1000 target permission points.

[0283] Method 2: If the level value is set to short type (2 bytes) and the permission value is set to long type (8 bytes), then the associated data corresponding to a permission level (including the level value and the first compressed permission value) is 10 bytes, of which the 8-byte first compressed permission value can indicate 64 target permission points. Then 16 permission levels are required to satisfy the indication of 1000 permission points (divide 1000 by 64 and round up). Therefore, only 16 10-byte associated data need to be stored for the target role, occupying 160 bytes of storage space, to configure 1000 target permission points.

[0284] Method 3: In the traditional solution, the permission point identification of each permission point is implemented in the form of a string. Assuming that the average size of a permission point identification is 50 bytes, 1000 target permission points require 50,000 bytes. In this implementation method, the permission point identification corresponding to each of the 1000 target permission points needs to be associated and stored for the target role, which requires 50,000 bytes of storage space to configure the 1000 target permission points.

[0285] Assume that 10,000 target permission points are to be associated and stored for the target role:

[0286] Method 1: If the level value is set to int type (4 bytes) and the permission value is set to long type (8 bytes), then the associated data corresponding to a permission level (including the level value and the first compressed permission value) is 12 bytes, of which the 8-byte first compressed permission value can indicate 64 target permission points. Then 157 permission levels are required to satisfy the indication of 10,000 permission points (divide 10,000 by 64 and round up). Therefore, only 157 12-byte associated data need to be stored for the target role, occupying 1,884 bytes of storage space, to configure 10,000 target permission points.

[0287] Method 2: If the level value is set to short type (2 bytes) and the permission value is set to long type (8 bytes), then the associated data corresponding to a permission level (including the level value and the first compressed permission value) is 10 bytes, of which the 8-byte first compressed permission value can indicate 64 target permission points. Then 157 permission levels are required to satisfy the indication of 10,000 permission points (divide 10,000 by 64 and round up). Therefore, only 157 10-byte associated data need to be stored for the target role, occupying 1,570 bytes of storage space, to configure 10,000 target permission points.

[0288] Method 3: In the traditional solution, the permission point identification of each permission point is implemented in the form of a string. Assuming that the average size of a permission point identification is 50 bytes, 10,000 target permission points require 500,000 bytes. In this implementation method, the permission point identification corresponding to each of the 10,000 target permission points needs to be associated and stored for the target role, which requires 500,000 bytes of storage space to implement the configuration of the 10,000 target permission points.

[0289] Based on the current example, it can be determined that in the technical solution of the present application, through the combination of K-byte permission values ​​and L-byte level values, it is possible to implement indication and configuration of a large number of permission points while occupying a smaller storage space.

[0290] It should also be noted that the above embodiment is introduced by taking the permission value as long type and the level value as int type or short type as an example. However, in the actual implementation process, the specific value types of the permission value and the level value can be selected according to actual needs. For example, the level value can be identified by only a single byte (8 bits). Even so, the level value can still represent 256 permission levels. Then, assuming that the permission value is still of long type (64 bits), such a combination can still store 16384 permission points. Therefore, in the technical solution of the present application, the specific number of bytes of the level value and the permission value can be flexibly set and adjusted according to actual needs.

[0291] Based on the above embodiments, Fig.14 A method for implementing the determination of target permission points configured for a target role is further described. Fig.14 Schematic diagram of the permission configuration interface provided in the embodiment of the present application Figure 2 .

[0292] like Fig.14 As shown in the figure, users can operate in the permission configuration interface to select the target permission point. Fig.14 It is certain that a table consisting of relevant data of multiple optional permission points can be displayed in the permission configuration interface, wherein the first row of the table is used to indicate the specific meaning of each column of data, and the Fig.14 In the example, the first row in the table is: permission point category, permission point name, module, and the specific meaning of each data is as mentioned above. Figure 7 For the introduction of Figure 7 The introduction of will not be repeated here.

[0293] exist Fig.14In the example, each permission point has a selection control in front of it, and the selection control is used to indicate the selection of the corresponding permission point. The operator who configures the permission can operate the selection control in the permission configuration interface. In this embodiment, in response to the operation of at least one selection control acting on the permission configuration interface, the permission point corresponding to each selection control is determined as the target permission point configured for the target role.

[0294] For example, Fig.14 In the example, assuming that the user operates the selection control corresponding to permission point A in the permission configuration interface, operates the selection control corresponding to permission point B, operates the selection control corresponding to permission point C, and operates the selection control corresponding to permission point D, then permission point A, permission point B, permission point C, and permission point D can be determined as the target permission points configured for the target role. Exemplarily, after the user operates the selection control for the target permission point, he can further select the "Confirm" control in the interface to trigger the confirmation action for the target permission point.

[0295] exist Fig.14 In the implementation method introduced, the target authority point selected for the target role is actually the authority point configured for the target role. Therefore, in this implementation method, the various level values ​​determined for the target authority point and the first compressed authority values ​​corresponding to each level value can be directly determined as the first target authority data associated with the target role.

[0296] If the above is used when configuring permissions for each role Fig.14 The introduction method means that multiple selection operations must be performed for each role. However, in the actual implementation process, it is possible that the permission points corresponding to two roles are only slightly different. If the roles with similar permission points are selected separately, Fig.14 The corresponding selection operations will result in a large number of repeated operations, resulting in low production efficiency of role configuration.

[0297] Therefore, in one possible implementation, the user can select only the permission points that are different from the existing roles in the permission configuration interface, and then perform related operations based on the target permission data of the existing roles, thereby quickly deriving the target permission data of the new role.

[0298] Combine the following Fig.15 This implementation is described below. Fig.15 Schematic diagram of the permission configuration interface provided in the embodiment of the present application Figure 3 .

[0299] like Fig.15As shown in (a) of FIG. 1 , a user can operate a selection control in the permission configuration interface. In this embodiment, in response to an operation on at least one selection control in the permission configuration interface, the permission point corresponding to each selection control is determined as a first permission point, where the first permission point can be understood as a permission point to be operated with the permission point of an existing role. For example, Fig.15 In the example (a) in FIG. 1 , the first authority point is authority point E.

[0300] In this embodiment, the second compressed permission value corresponding to the first permission point can also be determined according to the indication information corresponding to each first permission point. The second compressed permission value here refers to the first permission points as a whole. The implementation method of determining the compressed permission value of the permission point can refer to the introduction of the above embodiment, which will not be repeated here.

[0301] Furthermore, the permission configuration interface also includes a trigger control for "role derivation", which is used to trigger the display of the role derivation interface. Fig.15 (a) in the example may be displayed in the permission configuration interface in response to an operation of a trigger control for "role derivation". Fig.15 The character derived control of (b) further includes a character selection control (i.e. Fig.15 (b) in the "Select Role") and the operation selection control (i.e. Fig.15 (b) in the “Select an operation” section).

[0302] Among them, the role selection control may include a list of generated roles, and the user can operate the role selection control to select a role from multiple generated roles as the role to be operated. Specifically, in response to the operation of the role selection control acting on the permission configuration interface, a selected role from at least one generated role can be determined as the role to be operated. And because the role to be operated is an already generated role, the role to be operated has associated second target permission data, and the second target permission data is similar to the first target permission data introduced above, except that the second target permission data is for the role to be operated, while the first target permission data is for the target role. Therefore, in this embodiment, the second target permission data associated with the role to be operated can be obtained.

[0303] Furthermore, the operation selection control may include a list of multiple selectable operations, and the user may operate the operation selection control to select an operation from the multiple selectable operations as the target operation. The target operation may be any of the following: taking a union, taking a difference, and taking an intersection.

[0304] After completing the above operations, the target operation can be performed according to the second compressed permission value corresponding to the first permission point and the second target permission data, thereby generating the first target permission data associated with the target role.

[0305] Exemplarily, the background can respond to the user's operation on the "Submit" button in the role derivative control to trigger the execution of the operation of generating the first target permission data associated with the target role. Alternatively, it is also possible to directly display the role selection control and the operation selection control in the permission configuration interface instead of setting the role derivative control to trigger the display of the role derivative control, and when the user operates the "OK" control in the permission configuration interface to trigger the generation of the first target permission data of the target role, as long as the background detects that the user has operated the role selection control and the operation selection control, the first target permission data of the target role can be generated according to the content described in the current embodiment. In short, the specific setting method of the role selection control and the operation selection control in the interface can be selected and set according to actual needs.

[0306] Therefore, in this embodiment, the first target permission data of the target role can be derived based on the generated role to be operated. In this way, the user only needs to select a small number of permission points of the role to be operated in the permission configuration interface to perform the first permission point of the target operation, which can effectively save the repeated operations to be performed by the operator.

[0307] The following further introduces in detail the implementation method of generating the first target permission data associated with the target role under various possible implementation methods of the target operation.

[0308] First, the implementation method of the target operation of taking the union is explained.

[0309] It can be understood that when the target operation is to take the union, it means that the first permission point selected by the user in the permission configuration interface and each permission point configured for the role to be operated are all used as the target permission points configured for the target role.

[0310] At the same time, the indication information corresponding to each first permission point includes multiple level values, and the second target permission data of the role to be operated also includes multiple level values. Because the current operation is to take a union, each level value in these two parts of data must be processed.

[0311] Combine the following Fig.16 To understand, Fig.16 Schematic diagram of the implementation of determining the target role provided in the embodiment of the present application Figure 2 .

[0312] Assume that the currently determined role to be operated is role A, and the permissions configured for role A include: Fig.16 The authority points A, B, C and D shown in the figure, the indication information of each authority point of role A is shown in the figure, and the second target indication information of role A includes Fig.16 In the example shown in {(0,17),(1,10)}, Fig.16 The data of character A in the game are the same as above. Fig.13 The situation of the target role introduced in is similar and will not be described in detail here.

[0313] And, assuming that the first permission point selected by the current user in the permission configuration interface is permission point E, where the indication information of permission point E is (0,2), where 0 is the level value of permission point E, corresponding to Fig.16 The 2 bytes (or 4 bytes) 0000…00 shown in FIG. 1 and 2 are the authority values ​​of the authority point E, corresponding to Fig.16 00010, it can be understood that the second bit of the 8 bytes is used to indicate the permission point E. Because there is only one first permission point at present, the second compressed permission value corresponding to the first permission point only includes 1.

[0314] On this basis, the implementation method of determining the first target authority data is described below.

[0315] First, for any first-level value included in the indication information corresponding to each first permission point and the second target permission data, since the first-level value exists in both parts of the data, it is necessary to perform bitwise OR processing based on the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, so as to obtain the fourth compressed permission value corresponding to the first-level value.

[0316] When the preset value is 1, the bitwise OR operation can realize that any bit that is 1 in the second compressed authority value is also correspondingly 1 in the fourth compressed authority value, and any bit that is 1 in the third compressed authority value is also correspondingly 1 in the fourth compressed authority value, so that the union operation of the authority points corresponding to the first level value can be realized. When the preset value is 0, the bitwise OR operation can be replaced by the bitwise AND operation accordingly.

[0317] For example, Fig.16In the example, the level value 0 exists in both the indication information {0,2} corresponding to the first permission point E and the second target permission data {(0,17),(1,10)}, so the level value 0 is used as the first level value. Then, the second compressed permission value 2 corresponding to the first level value 0 and the third compressed permission value 17 corresponding to the first level value 0 in the second target permission data can be bitwise ORed to obtain the fourth compressed permission value 19 corresponding to the first level value 0.

[0318] For the specific implementation of bitwise OR processing, please refer to Fig.16 The content indicated in 1601 is understood, where the first level value 0 corresponds to the second compression authority value 2 Fig.16 The 8 bytes 0…00010 shown in FIG. 1 and the third compressed permission value 17 corresponding to the first level value 0 in the second target permission data correspond to Fig.16 The 8 bytes 0…10010 shown in the figure, then the result of the bitwise OR of these two 8 bytes of data is the 8 bytes 0…10011 shown in 1601, and the corresponding decimal number is 19.

[0319] Reference Fig.16 It can be understood that the fourth compressed authority value 19 corresponding to the first-level value 0 corresponds to the 8 bytes 0…10011, where the first bit is 1, indicating that the target role has the authority corresponding to authority point A, the second bit is 1, indicating that the target role has the authority corresponding to authority point E, and the fifth bit is 1, indicating that the target role has the authority corresponding to authority point B.

[0320] Secondly, for any second-level value included only in the indication information corresponding to the first permission point, that is, the second-level value only exists in the indication information corresponding to the first permission point, and does not exist in the second target permission data of the role to be operated. However, because the current union operation is to be performed, the second compressed permission value corresponding to the second-level value can be directly determined as the fourth compressed permission value corresponding to the second-level value. Fig.16 Not shown.

[0321] Finally, for any third-level value included only in the second target authority data, that is to say, the third-level value only exists in the second target authority data of the role to be operated, and does not exist in the indication information corresponding to the first authority point, but because of the current union operation to be performed, the third compressed authority value corresponding to the third level value in the second target authority data can be directly determined as the fourth compressed authority value corresponding to the third level value.

[0322] For example, Fig.16In the figure, the level value 1 only exists in the second compression authority value {(0,17),(1,10)}. Therefore, the third compression authority value 10 corresponding to the third level value 1 in the second target authority data can be determined as the fourth compression authority value corresponding to the third level value 1.

[0323] After completing the above-described processing, the first target permission data associated with the target role can be generated according to each first-level value and the fourth compressed permission value corresponding to each first-level value, each second-level value and the fourth compressed permission value corresponding to each second-level value, each third-level value and the fourth compressed permission value corresponding to each third-level value. The implementation method is similar to that described above. For any level value, the level value and the corresponding fourth compressed permission value can be used as a piece of associated data, and then a collection of multiple pieces of associated data is determined as the first target permission data associated with the target role.

[0324] Reference Fig.16 , the first target permission data finally generated for the target role includes {(0,19),(1,10)}, where the first target permission data indicates permission A, permission B, permission C, permission D and permission E. Therefore, based on the example currently introduced, it is possible to effectively achieve the union of the first permission point and the permission point configured for the role to be operated, thereby realizing the permission configuration of the target role. In this process, the user only needs to select permission E, and there is no need to repeatedly select permissions A to D. Therefore, it can effectively save user operations and improve production efficiency.

[0325] First, the implementation method of the target operation of taking the difference set is explained.

[0326] It can be understood that when the target operation is to take a difference set, it means that the first permission point selected in the permission configuration interface needs to be removed from the set consisting of various permission points configured for the role to be operated, so as to obtain the target permission point configured for the target role.

[0327] At the same time, the indication information corresponding to each first permission point includes multiple level values, and the second target permission data of the role to be operated also includes multiple level values. Because the current operation is to take a difference set, the level value corresponding to the second target permission data covers the level value corresponding to the first permission point. Therefore, you only need to pay attention to the level value corresponding to the second target permission data.

[0328] Combine the following Fig.17 To understand, Fig.17 Schematic diagram of the implementation of determining the target role provided in the embodiment of the present application Figure 3 .

[0329] Assume that the currently determined role to be operated is role A, and the permissions configured for role A include: Fig.17 The relevant data of the permission points A, B, C and D shown are the same as above. Fig.15 The introduction is similar and will not be repeated here.

[0330] Also, assuming that the first permission point selected by the current user in the permission configuration interface is permission point A, wherein the indication information of permission point A is (0,1). Since there is only one first permission point currently, the second compressed permission value corresponding to the first permission point also only includes 1.

[0331] On this basis, the implementation method of determining the first target authority data is described below.

[0332] First, for any first-level value included in the indication information corresponding to each first permission point and the second target permission data, since the first-level value exists in both parts of the data, it is necessary to perform bitwise XOR processing on the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, so as to obtain the fourth compressed permission value corresponding to the first-level value.

[0333] When the preset value is 1, bitwise XOR can achieve that the bit that is 1 in the second compressed authority value and also 1 in the third compressed authority value corresponds to 0 in the fourth compressed authority value, thus achieving the purpose of difference processing; and, the bit that is 0 in both the second compressed authority value and the third compressed authority value is still 0 in the fourth compressed authority value; and, the bit that is 0 in the second compressed authority value and 1 in the third compressed authority value is 1 in the fourth compressed authority value, thus ensuring that in the set consisting of the various authority points configured for the operation role, the remaining authority points except the first authority point are not affected.

[0334] And, when the preset value is 0, the bitwise XOR operation can be replaced by the bitwise XOR operation accordingly.

[0335] For example, Fig.17 In the example, the level value 0 exists in both the indication information {0,1} corresponding to the first permission point A and the second target permission data {(0,17),(1,10)}, so the level value 0 is used as the first level value. Then, the second compressed permission value 1 corresponding to the first level value 0 and the third compressed permission value 17 corresponding to the first level value 0 in the second target permission data can be subjected to bitwise XOR processing to obtain the fourth compressed permission value 16 corresponding to the first level value 0.

[0336] For the specific implementation of bitwise XOR processing, please refer to Fig.17 The content indicated in 1701 is understood, where the first level value 0 corresponds to the second compression permission value 1 Fig.17 The 8 bytes 0…00001 shown in FIG. 1 and the third compressed permission value 17 corresponding to the first level value 0 in the second target permission data correspond to Fig.17 The 8 bytes 0…10001 shown in the figure, then the result of the bitwise XOR of these two 8 bytes of data is the 8 bytes 0…10000 shown in 1701, and the corresponding decimal number is 16.

[0337] Reference Fig.17 It can be understood that the fourth compressed permission value 16 corresponding to the first-level value 0 corresponds to the 8 bytes 0...10000, of which the 5th bit is 1, indicating that the target role has the permission corresponding to permission point B, thereby eliminating permission point A.

[0338] Secondly, for any second-level value included only in the second target authority data, that is to say, the second-level value only exists in the second target authority data of the role to be operated, and does not exist in the indication information corresponding to the first authority point, but because the current difference operation does not affect this part of the data, the second compressed authority value corresponding to the second level value in the second target authority data can be directly determined as the fourth compressed authority value corresponding to the second level value.

[0339] For example, Fig.17 In the figure, the level value 1 only exists in the second compression authority value {(0,17),(1,10)}. Therefore, the second compression authority value 10 corresponding to the second level value 1 in the second target authority data can be determined as the fourth compression authority value corresponding to the second level value 1.

[0340] After completing the above-described processing, the first target permission data associated with the target role can be generated according to each first-level value and the fourth compressed permission value corresponding to each first-level value, each second-level value and the fourth compressed permission value corresponding to each second-level value. The implementation method is similar to the above-described method. For any level value, the level value and the corresponding fourth compressed permission value can be used as a piece of associated data, and then a collection of multiple pieces of associated data can be determined as the first target permission data associated with the target role.

[0341] Reference Fig.17, the first target permission data finally generated for the target role includes {(0,16),(1,10)}, where the first target permission data indicates permission B, permission C, and permission D. Therefore, based on the example currently introduced, it is possible to effectively take the difference between the first permission point and the permission point configured for the operation role, thereby realizing the permission configuration of the target role. In this process, the user only needs to select permission A, and there is no need to repeatedly select permission B, permission C, and permission D. Therefore, it can effectively save user operations and improve production efficiency.

[0342] Finally, the implementation method of the target operation of taking the intersection is explained.

[0343] It can be understood that when the target operation is to take the intersection, it means that it is necessary to determine the intersection part of the set composed of various permission points configured for the role to be operated and the first permission point selected in the permission configuration interface, so as to obtain the target permission point configured for the target role.

[0344] At the same time, the indication information corresponding to each first permission point includes multiple hierarchical values, and the second target permission data of the role to be operated also includes multiple hierarchical values. Because the current operation is to take the intersection, we only need to pay attention to the hierarchical values ​​that exist in the second target permission data and the indication information corresponding to each first permission point.

[0345] Combine the following Fig.18 To understand, Fig.18 Schematic diagram of the implementation of determining the target role provided in the embodiment of the present application Figure 4 .

[0346] Assume that the currently determined role to be operated is role A, and the permissions configured for role A include: Fig.18 The relevant data of the permission points A, B, C and D shown are the same as above. Fig.15 The introduction is similar and will not be repeated here.

[0347] Also, assuming that the first permission point selected by the current user in the permission configuration interface is permission point A, wherein the indication information of permission point A is (0,1). Since there is only one first permission point currently, the second compressed permission value corresponding to the first permission point also only includes 1.

[0348] On this basis, the implementation method of determining the first target authority data is described below.

[0349] First, for any first-level value included in the indication information corresponding to each first permission point and the second target permission data, since the first-level value exists in both parts of the data, it is necessary to perform bitwise AND processing based on the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, so as to obtain the fourth compressed permission value corresponding to the first-level value.

[0350] When the preset value is 1, the bitwise AND operation can realize that the bits that are 1 in the second compression authority value and the third compression authority value are 1 in the fourth compression authority value, and the remaining bits are 0 in the fourth compression authority value, thereby achieving the purpose of taking the intersection. And, when the preset value is 0, the bitwise AND operation can be replaced by a bitwise OR operation accordingly.

[0351] For example, Fig.18 In the example, the level value 0 exists in both the indication information {0,1} corresponding to the first permission point A and the second target permission data {(0,17),(1,10)}, so the level value 0 is used as the first level value. Then, the second compressed permission value 17 corresponding to the first level value 0 and the third compressed permission value 17 corresponding to the first level value 0 in the second target permission data can be processed bitwise AND to obtain the fourth compressed permission value 17 corresponding to the first level value 0.

[0352] For the specific implementation of bitwise AND processing, please refer to Fig.18 The content indicated in 1801 is understood, where the first level value 0 corresponds to the second compression permission value 1 Fig.18 The 8 bytes 0…00001 shown in FIG. 1 and the third compressed permission value 17 corresponding to the first level value 0 in the second target permission data correspond to Fig.18 The 8 bytes 0…10001 shown in , then the result of the bitwise AND of these two 8 bytes of data is the 8 bytes 0…00001 shown in 1801, and the corresponding decimal is 1.

[0353] Reference Fig.18 It can be understood that the fourth compressed authority value 1 corresponding to the first-level value 0 corresponds to the 8 bytes 0…00001, where the first bit is 1, indicating that the target role has the authority corresponding to authority point A, thereby achieving the purpose of taking the intersection of the authority point of role A and the first authority point.

[0354] After completing the above-described processing, the first target permission data associated with the target role can be generated according to each first-level value and the fourth compressed permission value corresponding to each first-level value. The implementation method is similar to the above description. For any level value, the level value and the corresponding fourth compressed permission value can be used as a piece of associated data, and then the set of multiple pieces of associated data is determined as the first target permission data associated with the target role.

[0355] Reference Fig.18 , the first target permission data finally generated for the target role includes {(0,1)}, wherein the first target permission data indicates permission A. Therefore, based on the example currently introduced, it is possible to effectively take the intersection of the first permission point and the permission point configured for the role to be operated, thereby realizing the permission configuration for the target role.

[0356] In the above example, permission A is configured for the target role, and then the user selects permission A as the first permission point, and then intersects with multiple permission points of the role to be operated, and finally configures permission A to the target role. This example looks like the first permission point selected by the user is intersected again, and then finally configured to the target role, which seems to be redundant. However, it should be noted here that the current example is a relatively simplified example made to facilitate the introduction of the processing logic of taking the intersection.

[0357] In the actual implementation process, when the user selects the first permission point in the permission configuration interface, for example, all permission points displayed in the current interface can be selected through the selection control of the first row of data, that is, all permission points displayed in the current permission configuration interface are determined as the first permission point, and then the intersection operation is performed based on the first permission point and multiple permission points of the role to be operated, so as to configure the permission point corresponding to the intersection to the target role.

[0358] Alternatively, when the user selects the first permission point in the permission configuration interface, an overall selection control can be set for each category of permission points. The user can, for example, use the selection control corresponding to the category to select all of the permission points of one or some categories. Then, what the user actually needs is the intersection of these selected first permission points and multiple permission points of the role to be operated. Therefore, the intersection operation can be performed based on the first permission point and the multiple permission points of the role to be operated, so as to configure the permission point corresponding to the intersection to the target role.

[0359] Therefore, through the operation of taking the intersection, the user only needs to perform selection operations on a few selection controls in the interface to achieve the derivation of the target role, thereby avoiding a large number of repeated selection operations, effectively saving user operations and improving production efficiency.

[0360] To sum up, in this embodiment, in the compressed authority value corresponding to each level value, each bit can indicate a permission point. Therefore, bit operations can be performed based on the compressed authority value of the existing role and the compressed authority value corresponding to the first authority point, thereby realizing operations such as taking the difference, taking the intersection, and taking the union between the authority point of the role to be operated and the first authority point, thereby quickly and efficiently deriving the first target authority value of the required target role.

[0361] Based on the contents of the above embodiments, after generating roles and storing target permission data of the roles, the system backend can respond to the application of the accounts and assign corresponding roles to the accounts, thereby realizing permission management in the system.

[0362] Therefore, in a possible implementation, in response to the role assignment request sent based on the first account, the first account may be associated with the first role indicated by the role assignment request.

[0363] Exemplarily, the role assignment request may carry the account information of the first account and the role identifier of the first role to be applied for by the first account. After receiving the role assignment request, the system backend may determine whether the first role can be assigned to the first account based on corresponding rules or instructions. If it is determined that the first role can be assigned, an association relationship between the first account and the first role may be established, thereby associating the first account with the first role.

[0364] Based on the introduction of the above embodiments, it can be determined that after accounts assigned different roles log in to the system, the specific content displayed in the system interface will also be different. Specifically, the system interface of each account will display the system resources of each permission point associated with the corresponding role. The system resources of the permission points that are not associated with the corresponding role will not be displayed in the system interface, so as to effectively implement the system's permission management.

[0365] In order to realize the different system interfaces for accounts of different roles as described above, it is necessary to ensure that when the system background receives the login request of the account, it needs to parse the specific permission points corresponding to each account, and then send the corresponding resources.

[0366] Therefore, in a possible implementation, the system background in this embodiment can also receive a login request sent by the first account, and then process the login request to resolve the first role associated with the first account. Exemplarily, the first role associated with the first account has data records in the background, which can be directly queried.

[0367] Furthermore, target permission data associated with each role is also stored in the background, so in this embodiment, the first target permission data associated with the first role can be obtained;

[0368] Afterwards, the first target permission data can be parsed to determine at least one associated permission point to which the first role has permission. It can be understood that the first target permission data includes multiple associated data, each of which includes a level value and a compressed permission value. The level value is used to indicate the permission level corresponding to the compressed level value, and the compressed permission value is K bits, where the K bits correspond to the K permission points in the current permission level, and the permission point corresponding to the bit with a preset value in these K bits is the associated permission point to which the current role has permission. According to this parsing method, the background can analyze and determine at least one associated permission point to which the current first role has permission.

[0369] Afterwards, according to at least one associated permission point, the interface data corresponding to each associated permission point is sent to the login device corresponding to the first account, so that the login device corresponding to the first account displays the system interface corresponding to the first account according to each interface data. In this way, it is possible to effectively display the corresponding system interface according to the corresponding roles for different accounts, so as to realize the permission management for the system in an orderly manner.

[0370] The rights management method of the embodiment of the present application has been described above, and the device for executing the above rights management method provided by the embodiment of the present application is described below. Those skilled in the art can understand that the method and the device can be combined and referenced with each other, and the relevant device provided by the embodiment of the present application can execute the steps in the above rights management method.

[0371] Fig.19 This is a schematic diagram of the structure of the rights management device provided in the embodiment of the present application. Fig.19 As shown, the device 190 includes: a determination module 1901, an acquisition module 1902, and a processing module 1903;

[0372] A determination module 1901 is used to determine at least one target authority point configured for a target role;

[0373] an acquisition module 1902, configured to acquire indication information corresponding to each of the target permission points, wherein the indication information includes an authority value used to represent the target permission point, the authority value includes an indication bit corresponding to the target permission point, and the value of the indication bit in the authority value is a first preset value;

[0374] The determination module 1901 is further used to perform a merging process according to the authority values ​​corresponding to each of the target authority points, and determine a first compressed authority value corresponding to the target authority point, wherein the first compressed authority value includes an indication bit corresponding to each of the target authority points, and the value of each indication bit in the first compressed authority value is the first preset value, and the indication bit with the first preset value is used to indicate that the target role has the authority of the target authority point corresponding to the indication bit;

[0375] The processing module 1903 is used to generate and store first target permission data associated with the target role according to the first compressed permission value.

[0376] In some implementations, the indication information further includes a level value, and the level value is used to indicate the authority level corresponding to the target authority point;

[0377] For multiple permission points in any one of the permission levels, positions of the indication bits in the permission values ​​corresponding to the respective permission points are different.

[0378] In some implementations, the determining module 1901 is specifically configured to:

[0379] For any of the level values, determining, in the indication information corresponding to each of the target authority points, a plurality of indication information including the level value;

[0380] A bitwise OR operation is performed on the permission values ​​in the plurality of indication information including the level value to obtain a first compressed permission value corresponding to the level value.

[0381] In some implementations, the determining module 1901 is specifically configured to:

[0382] For any of the level values, determining the level value and the first compression authority value corresponding to the level value as a piece of associated data;

[0383] Determine a set of each of the associated data as first target permission data associated with the target role;

[0384] The target role and the first target permission data are associated and stored.

[0385] In some implementations, the determining module 1901 is specifically configured to:

[0386] In response to an operation on at least one selection control of the permission configuration interface, the permission points corresponding to the respective selection controls are determined as target permission points configured for the target role.

[0387] In some implementations, the processing module 1903 is further configured to:

[0388] In response to an operation on at least one selection control of the permission configuration interface, determining the permission points corresponding to the respective selection controls as first permission points, and determining second compressed permission values ​​corresponding to the respective first permission points according to the indication information corresponding to the respective first permission points;

[0389] In response to an operation on a role selection control of the permission configuration interface, a selected role from at least one generated role is determined as a role to be operated, and second target permission data associated with the role to be operated is acquired;

[0390] In response to an operation on the operation selection control of the permission configuration interface, a target operation is determined, wherein the target operation is any one of the following: taking a union, taking a difference, and taking an intersection;

[0391] The target operation is performed according to the second compressed permission value corresponding to the first permission point and the second target permission data to generate the first target permission data associated with the target role.

[0392] In some implementations, when the target operation is to take a set union, the processing module 1903 is specifically configured to:

[0393] for each of the indication information corresponding to each of the first permission points and any first-level values ​​included in the second target permission data, performing bitwise OR processing according to a second compressed permission value corresponding to the first-level value and a third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value; and

[0394] for any second-level value included only in the indication information corresponding to each of the first permission points, determining the second compressed permission value corresponding to the second-level value as the fourth compressed permission value corresponding to the second-level value; and

[0395] For any third-level value included only in the second target authority data, determining the third compressed authority value corresponding to the third-level value in the second target authority data as the fourth compressed authority value corresponding to the third-level value;

[0396] The first target permission data associated with the target role is generated based on each of the first-level values ​​and the fourth compressed authority values ​​corresponding to each of the first-level values, each of the second-level values ​​and the fourth compressed authority values ​​corresponding to each of the second-level values, and each of the third-level values ​​and the fourth compressed authority values ​​corresponding to each of the third-level values.

[0397] In some implementations, when the target operation is a difference set, the processing module 1903 is specifically configured to:

[0398] For any first-level values ​​included in both the indication information corresponding to each of the first permission points and the second target permission data, performing bitwise exclusive OR processing according to the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value; and

[0399] For any second-level value included only in the second target authority data, determining the third compressed authority value corresponding to the second-level value in the second target authority data as the fourth compressed authority value corresponding to the second-level value;

[0400] The first target permission data associated with the target role is generated according to each of the first-level values ​​and the fourth compressed permission values ​​corresponding to each of the first-level values, and each of the second-level values ​​and the fourth compressed permission values ​​corresponding to each of the second-level values.

[0401] In some implementations, when the target operation is to obtain an intersection, the processing module 1903 is specifically configured to:

[0402] For any first-level values ​​included in both the indication information corresponding to each of the first permission points and the second target permission data, performing bitwise AND processing according to the second compressed permission value corresponding to the first-level value and the third compressed permission value corresponding to the first-level value in the second target permission data, to obtain a fourth compressed permission value corresponding to the first-level value;

[0403] The first target permission data associated with the target role is generated according to each of the first-level values ​​and the fourth compressed permission values ​​corresponding to each of the first-level values.

[0404] In some implementations, the plurality of authority points in each of the authority levels are of the same category, and the categories of the authority points are pre-divided.

[0405] In some implementations, the authority value includes K bytes, the level value includes L bytes, and K and L are integers greater than or equal to 1.

[0406] In some implementations, the value type of the authority value is a long integer, and the value type of the level value is an integer or a short integer.

[0407] In some implementations, the processing module 1903 is further configured to:

[0408] In response to a role assignment request sent based on a first account, a first role indicated by the role assignment request is associated with the first account.

[0409] In some implementations, the processing module 1903 is further configured to:

[0410] In response to a login request sent based on the first account, parsing the first role associated with the first account;

[0411] Obtaining first target permission data associated with the first role;

[0412] Parsing the first target permission data to determine at least one associated permission point for which the first role has permission;

[0413] According to the at least one associated authority point, interface data corresponding to each of the associated authority points is sent to the login device corresponding to the first account, so that the login device corresponding to the first account displays the system interface corresponding to the first account according to the interface data.

[0414] The rights management method provided in the embodiment of the present application can be applied to electronic devices with communication functions. Electronic devices include terminal devices, which can also be called terminals, user equipment (UE), mobile stations (MS), mobile terminals (MT), etc. The terminal device can be a mobile phone, a smart TV, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical surgery, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc.

[0415] The present application embodiment provides a terminal device, Fig. 20 A schematic diagram of the hardware structure of a terminal device provided in an embodiment of the present application.

[0416] like Fig. 20 As shown, the terminal device 200 includes: a processor 2001 and a memory 2002; the memory 2002 stores computer execution instructions; the processor 2001 executes the computer execution instructions stored in the memory 2002, so that the terminal device 200 executes the above method.

[0417] When the memory 2002 is independently provided, the terminal device further includes a bus 2003 for connecting the memory 2002 and the processor 2001 .

[0418] The embodiment of the present application provides a chip. The chip includes a processor, and the processor is used to call a computer program in a memory to execute the technical solution in the above embodiment. Its implementation principle and technical effect are similar to those of the above related embodiments, and will not be repeated here.

[0419] The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program. The above method is implemented when the computer program is executed by the processor. The method described in the above embodiment can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. If implemented in software, the function can be stored as one or more instructions or codes on a computer-readable medium or transmitted on a computer-readable medium. Computer-readable media can include computer storage media and communication media, and can also include any medium that can transfer a computer program from one place to another. The storage medium can be any target medium that can be accessed by a computer.

[0420] In one possible implementation, a computer-readable medium may include RAM, ROM, compact disc read-only memory (CD-ROM) or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that is intended to carry or store the required program code in the form of instructions or data structures and can be accessed by a computer. Moreover, any connection is appropriately referred to as a computer-readable medium. For example, if a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wireless technology (such as infrared, radio and microwave) is used to transmit software from a website, server or other remote source, the coaxial cable, fiber optic cable, twisted pair, DSL or wireless technology such as infrared, radio and microwave are included in the definition of medium. Disks and optical disks as used herein include optical disks, laser disks, optical disks, digital versatile disks (DVD), floppy disks and Blu-ray disks, where disks usually reproduce data magnetically, while optical disks reproduce data optically using lasers. Combinations of the above should also be included in the scope of computer-readable media.

[0421] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed, the computer executes the above method.

[0422] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0423] The above specific implementation methods further illustrate the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present invention should be included in the scope of protection of the present invention.

Claims

1. A rights management method, characterized in that: Applied to a terminal device, the method comprises: In response to an operation on at least one selection control in the first permission configuration interface, determining a plurality of first permission points corresponding to the at least one selection control; In response to an operation on a role selection control in a second permission configuration interface, at least one generated role is displayed, and in response to an operation on at least one of the at least one generated role, a role to be operated is determined, wherein the role to be operated corresponds to a plurality of second permission points; Sending the plurality of first permission points and the role to be operated to a server, so that the server obtains second target permission data indicating the plurality of second permission points corresponding to the role to be operated, and generates first target permission data according to the plurality of first permission points and the plurality of second permission points; the first target permission data is used to indicate a target permission point corresponding to a target role, wherein the target permission point is a result of performing a target set operation on the plurality of first permission points and the plurality of second permission points; receiving the first target authority data sent by the server; Among them, the first target permission data and the second target permission data each include at least one associated data associated with the respective indicated roles, the associated data is used to indicate the correspondence between the level value and the compressed permission value corresponding to the level value, the level value is used to indicate the permission level corresponding to the permission point corresponding to the indicated role, the compressed permission value includes the indication bit corresponding to each permission point, and the compressed permission value corresponding to each level value is obtained by merging the permission values ​​of the same permission level; when the indicated role is the target role, the compressed permission value is the first compressed permission value, and the permission point is the target permission point; when the indicated role is the role to be operated, the compressed permission value is the second compressed permission value, and the permission point is the second permission point.

2. The method according to claim 1, characterized in that in, The target set operation is to take a union, a difference or an intersection.

3. The method according to claim 2, characterized in that The method further comprises: In response to an operation on an operation selection control in the second permission configuration interface, determining the target set operation; The target set operation is sent to the server, so that the server performs the target set operation according to the first permission point and the second permission point to generate the first target permission data corresponding to the target role.

4. The method according to any one of claims 1 to 3, characterized in that: The permission point is a system resource in the interface, and the system resource includes at least one of the following: a menu, an operation control, a table, and data.

5. A rights management method, characterized in that: Applied to a server, the method comprises: Receiving a plurality of first authority points and roles to be operated sent by a terminal device, wherein the roles to be operated correspond to a plurality of second authority points; Acquire second target permission data corresponding to the role to be operated, where the second target permission data is used to indicate the plurality of second permission points corresponding to the role to be operated; Generate first target permission data according to the plurality of first permission points and the plurality of second permission points, wherein the first target permission data is used to indicate a target permission point corresponding to a target role, wherein the target permission point is a result of performing a target set operation on the plurality of first permission points and the plurality of second permission points; Wherein, the first target permission data and the second target permission data each include at least one associated data associated with the respective indicated roles, the associated data is used to indicate the correspondence between the level value and the compressed permission value corresponding to the level value, the level value is used to indicate the permission level corresponding to the permission point corresponding to the indicated role, the compressed permission value includes the indication bit corresponding to each permission point, and the compressed permission value corresponding to each level value is obtained by merging the permission values ​​of the same permission level; when the indicated role is the target role, the permission point is the target permission point; when the indicated role is the role to be operated, the permission point is the second permission point; The first target authority data is sent to the terminal device.

6. The method according to claim 5, characterized in that The target set operation is to take a union, a difference or an intersection.

7. The method according to claim 6, characterized in that The method further comprises: Receiving the target set operation sent by the terminal device; The step of generating first target permission data according to the plurality of first permission points and the plurality of second permission points includes: performing merging processing according to the indication information corresponding to each of the plurality of first permission points, and determining at least one first compressed permission value corresponding to the plurality of first permission points, wherein the indication information includes a permission value and a level value, and the permission value includes an indication bit corresponding to the first permission point and having a value of a first preset value; The target set operation is performed according to the first compressed permission value and the second target permission data to generate the first target permission data.

8. The method according to claim 7, characterized in that The merging process according to the indication information respectively corresponding to the plurality of first permission points to determine at least one first compressed permission value corresponding to the plurality of first permission points includes: For any level value, determine, in the indication information corresponding to each of the plurality of first authority points, a plurality of indication information including the level value; A bitwise OR operation is performed on the permission values ​​in the plurality of indication information including the level value to obtain a first compressed permission value corresponding to the level value.

9. The method according to claim 7 or 8, characterized in that: When the target set operation is a union, performing the target set operation according to the first compressed permission value and the second target permission data to generate the first target permission data includes: for any first-level values ​​included in both the indication information corresponding to each of the plurality of first permission points and the second target permission data, performing bitwise OR processing according to a first compressed permission value corresponding to the first-level value and a second compressed permission value corresponding to the first-level value in the second target permission data, to obtain a third compressed permission value corresponding to the first-level value; and For any second-level value included only in the indication information corresponding to each of the plurality of first permission points, determining the first compressed permission value corresponding to the second-level value as a third compressed permission value corresponding to the second-level value; and For any third-level value included only in the second target authority data, determining the second compressed authority value corresponding to the third-level value in the target authority data as the third compressed authority value corresponding to the third-level value; The first target authority data is generated according to each of the first-level values ​​and the third compression authority values ​​corresponding to each of the first-level values, each of the second-level values ​​and the third compression authority values ​​corresponding to each of the second-level values, and each of the third-level values ​​and the third compression authority values ​​corresponding to each of the third-level values.

10. The method according to claim 7 or 8, characterized in that: When the target set operation is a difference set, performing the target set operation according to the first compressed permission value and the second target permission data to generate the first target permission data includes: For any first-level values ​​included in both the indication information corresponding to each of the plurality of first permission points and the second target permission data, performing bitwise exclusive-OR processing according to a first compressed permission value corresponding to the first-level value and a second compressed permission value corresponding to the first-level value in the second target permission data, to obtain a third compressed permission value corresponding to the first-level value; and For any second-level value included only in the second target authority data, determining the second compressed authority value corresponding to the second-level value in the second target authority data as the third compressed authority value corresponding to the second-level value; The first target authority data is generated according to each of the first-level values ​​and the third compressed authority values ​​corresponding to each of the first-level values, and each of the second-level values ​​and the third compressed authority values ​​corresponding to each of the second-level values.

11. The method according to claim 7 or 8, characterized in that: When the target set operation is to obtain an intersection, performing the target set operation according to the first compressed permission value and the second target permission data to generate the first target permission data includes: For any first-level values ​​included in both the indication information corresponding to each of the plurality of first permission points and the second target permission data, performing bitwise AND processing according to a first compressed permission value corresponding to the first-level value and a second compressed permission value corresponding to the first-level value in the second target permission data, to obtain a third compressed permission value corresponding to the first-level value; The first target authority data is generated according to each of the first-level values ​​and the third compressed authority values ​​corresponding to each of the first-level values.

12. A terminal device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the terminal device executes the method according to any one of claims 1 to 4.

13. A server, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the server performs the method according to any one of claims 5 to 11.

14. A computer-readable storage medium comprising instructions, characterized in that: When the instruction is executed on the terminal device, the terminal device executes the method according to any one of claims 1 to 4.

15. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a server, the server is caused to execute the method according to any one of claims 5 to 11.

16. A computer program product, characterized in that The method comprises a computer program, and when the computer program is executed on a terminal device, the terminal device is caused to execute the method according to any one of claims 1 to 4.

17. A computer program product, characterized in that The method comprises a computer program, which, when executed on a server, causes the server to execute the method according to any one of claims 5 to 11.

Images