Access control method, system and medium based on business model and policy

Abstract

The present invention provides an access control method, system and medium based on business models and policies, the method comprising the following steps: obtaining an operation request from a user end, the operation request including a common use operation request; performing a request operation based on the common use operation request in combination with an edited target business model, the target business model including access policy expressions of different object structures; obtaining a target business action based on the request operation, and before executing the target business action, calling the access policy expression in the edited target business model to judge the request operation, and executing the target business action when the current request operation meets the permission requirements of the access policy expression, otherwise not executing. The present invention aims to propose an access control method that is practical, flexible, efficient and easy to manage in the financial field, which can be based on different business models, fit the business of the enterprise itself, and is easy for users to understand, master and implement, so as to improve the efficiency of enterprise management and operation.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and in particular relates to an access control method, system and medium based on business models and policies. Background Art

[0002] In daily business, we often encounter scenarios where someone needs to process data. For example, financial statements usually have processing actions such as "view, modify, submit", and accordingly, the action permissions of "viewable, modifiable, and submittable" are required. The traditional access control system is "Role-Based Access Control (RBAC)". This type of system is simple in design, but has great limitations: changes in roles and personnel belonging to roles rely on administrator operations. For example, if the grouping of personnel changes, if the administrator lags behind in operation, problems such as unauthorized access or unauthorized access will occur. As the business develops, more and more roles will be added, and there will be more and more problems such as cross-repeated authorization and the inability to effectively and in real time adjust role access rights.

[0003] In recent years, "Policy-Based Access Control System (PBAC)" has begun to emerge. It is a new model that aims to help enterprises solve the need to implement specific access control based on abstract policies and governance requirements. However, PBAC has no implementation standards and cannot provide specific references in actual applications. Therefore, specific instructions need to be given in combination with corresponding actual scenarios. Summary of the invention

[0004] In view of the above-mentioned shortcomings of the prior art, an object of the present invention is to provide an access control method, system and medium based on a business model and a policy, so as to solve the above-mentioned problems.

[0005] In a first aspect, the present invention provides an access control method based on a business model and a policy, the method comprising the following steps:

[0006] Obtaining an operation request from a user terminal, wherein the operation request includes a common use operation request;

[0007] Performing a request operation based on the common use operation request in combination with the edited target business model, wherein the target business model includes access policy expressions of different object structures;

[0008] The target business action is obtained based on the request job, and before executing the target business action, the access policy expression in the edited target business model is called to judge the request job, wherein:

[0009] When the current request job meets the permission requirement of the access policy expression, the target business action is executed, otherwise it is not executed.

[0010] In a possible implementation of the present application, the method further includes obtaining the target business model by editing based on the operation request, specifically including:

[0011] Identifying a management editing operation request for editing the target business model based on the operation request of the user terminal;

[0012] The target business model is edited based on the management editing operation request in combination with a preset model design tool, wherein the target business model includes business objects, business attributes and link objects, and the model design tool includes the Xiansheng Cloud Platform Business Model Editor.

[0013] In a possible implementation of the present application, an operation request of a user terminal is obtained, wherein the operation request includes a management and editing operation request and a common use operation request, specifically including:

[0014] Identifying current user attributes of the data input by the user, wherein the user attributes include administrator attributes and non-administrator attributes;

[0015] Obtaining the management editing operation request based on user-side input data belonging to the administrator attribute;

[0016] The common use operation request is obtained based on the user-side input data belonging to the non-administrator attribute.

[0017] In a possible implementation of the present application, the editing of the target business model based on the management editing operation request in combination with a preset model design tool specifically includes:

[0018] Based on the management editing operation request, identifying the data filled in by the administrator user in the model design tool to edit the target business model, wherein:

[0019] Get the business object based on the filled object code and object name;

[0020] Obtain the business attribute based on the filled-in business primary key code and business primary key name;

[0021] The link object is obtained based on the entered link code and link name.

[0022] In a possible implementation of the present application, the method further includes automatically creating business attributes based on the target business object when the target business object is obtained, wherein the target business object includes a system user object.

[0023] In a possible implementation of the present application, the method further includes creating a new link for the link object, specifically including:

[0024] Based on the management editing operation request, identifying the data filled in by the administrator user in the model design tool to create a new link, wherein:

[0025] Add the newly added link code, link name and link type as an additional link to the current link object;

[0026] During the adding process, the check response of the target button is identified and marked, wherein the target button includes dynamic calculation, relationship cardinality, and deletion strategy.

[0027] In a possible implementation of the present application, performing a request operation based on the common use operation request in combination with the edited target business model specifically includes:

[0028] Based on the common use operation request and the edited target business model, a common operation request is performed, wherein:

[0029] Based on the preset query model, the database makes access permission judgment for the current request job and records the row. The business attributes are stored as columns of the database, and the link relationship of the link object is represented by an intermediate table.

[0030] In a second aspect, the present invention provides an access control system based on a business model and a policy, the system comprising:

[0031] An acquisition module, used to acquire an operation request from a user terminal, wherein the operation request includes a common operation request;

[0032] A request module, used to perform a request operation based on the common use operation request in combination with the edited target business model;

[0033] A calling module, used to obtain a target business action based on a request job, and before executing the target business action, call the access policy expression in the edited target business model to judge the request job;

[0034] The execution module is used to execute the target business action when the current request job meets the permission requirement of the access policy expression, and not execute it otherwise.

[0035] In a third aspect, the present invention provides an electronic device, the electronic device comprising: a processor and a memory;

[0036] The memory is used to store computer programs;

[0037] The processor is used to execute the computer program stored in the memory, so that the electronic device executes the above-mentioned access control method based on business models and policies.

[0038] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by an electronic device, implements the above-mentioned access control method based on business models and policies.

[0039] As described above, the access control method, system and medium based on business models and policies described in the present invention are intended to propose a practical, flexible, efficient and easy-to-manage access control method in the financial field, which can be based on different business models, fit the company's own business, and be easy for users to understand, master and implement, so as to improve the efficiency of enterprise management and operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Shown is a schematic diagram of a scene of an electronic device in an embodiment of the present invention;

[0041] Figure 2 Shown is a flow chart of an access control method based on a business model and a policy in one embodiment of the present invention;

[0042] Figure 3 Shown is a flow chart of an access control method based on a business model and a policy in one embodiment of the present invention;

[0043] Figure 4 Shown is a schematic diagram of creating a target business model in an embodiment of the access control method based on business models and policies of the present invention;

[0044] Figure 5 Shown is a schematic diagram of creating a target business model in an embodiment of the access control method based on business models and policies of the present invention;

[0045] Figure 6 Shown is a schematic diagram of creating a newly added link in an embodiment of the access control method based on business models and policies of the present invention;

[0046] Figure 7 Shown is a schematic diagram of checking a newly added link in an embodiment of the access control method based on a business model and a policy of the present invention;

[0047] Figure 8 Shown is a schematic diagram of adding department data in an embodiment of the access control method based on business models and policies of the present invention;

[0048] Fig. 9 A schematic diagram showing access rules in an embodiment of the access control method based on business models and policies of the present invention;

[0049] Fig.10 Shown is a schematic diagram of the structure of an access control system based on a business model and a policy in one embodiment of the present invention;

[0050] Fig.11 It is a schematic structural diagram of an electronic device of the present invention in one embodiment. DETAILED DESCRIPTION

[0051] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0052] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0053] The following embodiments of the present invention provide an access control method based on a business model and a policy, which can be applied to Figure 1 The electronic device shown. The electronic device described in the present invention may include a mobile phone 11 with a wireless charging function, a tablet computer 12, a laptop computer 13, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiment of the present invention does not impose any restrictions on the specific type of the electronic device.

[0054] For example, the electronic device may be a station (STAION, ST) in a WLAN with a wireless charging function, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with a wireless charging function, a computing device or other processing device, a computer, a laptop computer, a handheld communication device, a handheld computing device, and / or other devices for communicating on a wireless system and a next generation communication system, such as a mobile terminal in a 5G network, a mobile terminal in a future evolved Public Land Mobile Network (PLMN), or a mobile terminal in a future evolved Non-terrestrial Network (NTN).

[0055] For example, the electronic device can communicate with the network and other devices through wireless communication. The above wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobilecommunication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS can include Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), BeiDou navigation Satellite System (BDS), Quasi-Zenith Satellite System (QZSS) and / or Satellite Based Augmentation Systems (SBAS).

[0056] The technical solutions in the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0057] Specifically, see Figure 2 In one embodiment of the invention, the access control method based on business model and policy of the present invention comprises the following steps:

[0058] Step S202, obtaining an operation request from the user terminal, wherein the operation request includes a common operation request;

[0059] Step S204, performing a request operation based on the common use operation request in combination with the edited target business model, wherein the target business model includes access policy expressions of different object structures;

[0060] Step S206, obtaining a target business action based on the request job, and before executing the target business action, calling the edited access policy expression in the target business model to judge the request job;

[0061] Step S208: When the current request job meets the permission requirement of the access policy expression, the target business action is executed, otherwise it is not executed.

[0062] It should be noted that, in this embodiment, it is specifically described that a common use operation request is obtained to perform a request job in combination with an edited target business model. In particular, before executing the target business action, it is necessary to call the access policy (access rule) expression in the edited target business model to judge the request job, wherein the request job is performed based on the common use operation request in combination with the edited target business model, specifically including: performing a common operation request based on the common use operation request in combination with the edited target business model, wherein a row record is made for the access permission judgment of the current request job based on a preset query model database, the business attributes are stored as columns of the database, and the link relationship of the link object is represented by an intermediate table.

[0063] Furthermore, in an embodiment of the invention, in actual operation, the present application also describes how to distinguish between administrator users and non-administrator users, where Figure 3 As shown, the operation request includes a management and editing operation request and a common use operation request, which specifically includes the following steps:

[0064] Step S302, identifying current user attributes of the user-side input data, wherein the user attributes include administrator attributes and non-administrator attributes;

[0065] Step S304, obtaining the management editing operation request based on the user input data belonging to the administrator attribute;

[0066] Step S306: obtaining the common use operation request based on the user-side input data belonging to the non-administrator attribute.

[0067] It should be noted that the type of the current user, specifically whether it is an administrator user or a non-administrator user, can be obtained based on the user attributes of the user end that issues the operation request, so that different operation requests can be determined according to different user types, where the operation request for the administrator corresponds to a management editing operation request, and the operation request for the non-administrator corresponds to a normal use operation request.

[0068] Furthermore, in one embodiment of the invention, the method also includes editing the target business model based on an operation request, specifically including: identifying a management editing operation request for editing the target business model based on the operation request from the user end; editing the target business model based on the management editing operation request in combination with a preset model design tool, wherein the target business model includes business objects, business attributes and link objects, and the model design tool includes the Xiansheng Cloud Platform Business Model Editor.

[0069] It should be noted that, in this embodiment, it is specifically explained how to edit the target business model based on the management editing operation request in combination with a preset model design tool before the target business model is applied to ordinary users, which specifically includes: based on the management editing operation request, identifying the data filled in by the administrator user in the model design tool to edit the target business model, wherein the business object is obtained based on the filled-in object code and object name; the business attribute is obtained based on the filled-in business primary key code and business primary key name; and the link object is obtained based on the filled-in link code and link name.

[0070] Furthermore, the method also includes creating a new link for the link object, specifically including: based on the management editing operation request, identifying the data filled in by the administrator user in the model design tool to create a new link, wherein the new link code, link name and link type filled in are added as an additional link to the current link object; during the adding process, identifying the check response of the target button and marking it, wherein the target button includes dynamic calculation, relationship cardinality and deletion strategy.

[0071] Specifically, Figure 4As shown in the figure, taking the access control model as the target business model as an example, the administrator drags the "General Object" from the object group to the canvas. A new object window will pop up ("The title is Create object based on template"). Fill in the object code "Department", object name "Department", business primary key (ie "primary attribute") "name", business primary key name "Department Name" in the window, and leave the rest of the options as default. Click OK to complete the creation.

[0072] Furthermore, in an embodiment of the invention, the method further comprises automatically creating a business attribute based on the target business object when the target business object is obtained, wherein the target business object comprises a system user object.

[0073] It should be noted that if Figure 5 As shown in the figure, dragging "System User Object" from the object group to the canvas will automatically create a system-preset "System User Object" without filling in template parameters. After creation, the "System User Object" comes with properties such as "User ID" and "User Name".

[0074] Further, Figure 6 As shown in the creation of a new link, it can be seen that the link is added as an additional link to the current link object based on the new link code, link name and link type filled in.

[0075] Specifically, for newly added links, during the adding process, it is necessary to identify the check response of the target button for marking, wherein the target button includes dynamic calculation, relationship cardinality and deletion strategy, as shown in the following example: Figure 7 As shown, there are detailed descriptions in the newly added link, and the corresponding pop-up window has different checkable buttons, corresponding to dynamic calculation, relationship cardinality and deletion strategy. Among them, under the relationship cardinality, there are "current object unique, linked object required and linked object options", among which the linked object options correspond to single selection or multiple selection, and about the deletion strategy, that is, when the target business object is deleted, there is a definition of allowing deletion or restricting deletion.

[0076] Furthermore, if Figure 7As shown, select the "Department" object on the canvas and add a link "Department Member (member)": the type is "System User Object", and "Relationship Cardinality" is checked as "Multiple Selection" (that is, a department has multiple system users. The designed model structure (that is, the target business model) will be persisted to the database after saving and used as an object structure. In actual application, the data of the model objects can be added, deleted, modified, and queried by ordinary personnel. During the operation of the access control system, the model data will be queried to make access permission judgments. This part of the data is a specific row record in the database. Attributes can generally be stored as database columns, links can be represented by intermediate tables, or the type of the linked object and the text value of the primary attribute can be marked in the attribute column to confirm the linked object, such as Figure 8 As shown, enter the data editor of the Department object and add department data: "Department A, 3 users", "Department B, 2 users".

[0077] It should be noted that the administrator opens the data management page of the "Department" object and selects the access rule, such as Fig. 9 As shown, a new access rule "Rule: Is the person a member of this department?" is created. The rule designer allows you to reference the definition of the target business model (the attributes and links of the model itself - judgment rules), and determine one or more groups of access policies (rules) through the attributes and link relationships of the business model. The "access policy expression" defines how to use the attributes and links of the object to form the basis for the judgment rules.

[0078] Specifically, when in use, before performing the business action "passing the access control", the access rule (policy) "Rule: Are you a member of this department" designed in the editing state is called to determine whether the current object user has the authority to perform the operation. When the current request job meets the permission requirements of the access policy expression, the target business action is executed (execute the action "passing the access control"), otherwise it is not executed.

[0079] An embodiment of the present application also provides an access control system based on a business model and a policy, which can implement the access control method based on a business model and a policy described in the present application. However, the implementation device of the access control method based on a business model and a policy described in the present application includes but is not limited to the structure of the access control system based on a business model and a policy listed in the present embodiment. All structural deformations and replacements of the prior art made according to the principles of the present application are included in the protection scope of the present application.

[0080] See also Fig.10 In one embodiment, this embodiment provides an access control system 100 based on a business model and a policy, the system comprising:

[0081] The acquisition module 101 is used to acquire an operation request from a user terminal, wherein the operation request includes a common operation request;

[0082] A request module 102, configured to perform a request operation based on the common use operation request in combination with the edited target business model;

[0083] The calling module 103 is used to obtain the target business action based on the request job, and before executing the target business action, call the access policy expression in the edited target business model to judge the request job;

[0084] The execution module 104 is used to execute the target business action when the current request job meets the permission requirement of the access policy expression, and not execute it otherwise.

[0085] Since the specific implementation of this embodiment corresponds to the aforementioned method embodiment, the same details will not be repeated here, and those skilled in the art should also understand that Fig.10 The division of the modules in the embodiment is merely a division of logical functions, and in actual implementation, all or part of them can be integrated into one or more physical entities, and these modules can be implemented entirely in the form of software called by processing elements, or entirely in the form of hardware, or some modules can be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware.

[0086] In the several embodiments provided by the present invention, it should be understood that the disclosed system, device or method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules / units is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules or units, which can be electrical, mechanical or other forms.

[0087] The modules / units described as separate components may or may not be physically separated, and the components displayed as modules / units may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules / units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention. For example, the functional modules / units in the various embodiments of the present invention may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0088] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0089] The embodiment of the present invention also provides a computer-readable storage medium. A person of ordinary skill in the art can understand that all or part of the steps in the method for implementing the above embodiment can be completed by instructing the processor through a program, and the program can be stored in a computer-readable storage medium, and the storage medium is a non-transitory medium, such as a random access memory, a read-only memory, a flash memory, a hard disk, a solid-state hard disk, a magnetic tape, a floppy disk, an optical disc, and any combination thereof. The above storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state disk (SSD)), etc.

[0090] An embodiment of the present invention further provides an electronic device, which includes a processor and a memory.

[0091] The memory is used to store computer programs.

[0092] The memory includes: ROM, RAM, disk, USB flash drive, memory card or CD and other media that can store program codes.

[0093] The processor is connected to the memory and is used to execute the computer program stored in the memory so that the electronic device executes the above-mentioned access control method based on business models and policies.

[0094] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0095] like Fig.11 As shown, the electronic device of the present invention is in the form of a general computing device. The components of the electronic device may include but are not limited to: one or more processors or processing units 111, a memory 112, and a bus 113 connecting different system components (including the memory 112 and the processing unit 111).

[0096] Bus 113 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0097] Electronic devices typically include a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device, including volatile and non-volatile media, removable and non-removable media.

[0098] The memory 112 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1121 and / or cache memory 1122. The electronic device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 1123 may be used to read and write non-removable, non-volatile magnetic media ( Fig.11 not shown, usually called a "hard drive"). Although Fig.11Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 113 via one or more data medium interfaces. The memory 112 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the embodiments of the present invention.

[0099] A program / utility 1124 having a set (at least one) of program modules 11241 may be stored, for example, in the memory 112, such program modules 11241 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 11241 generally perform the functions and / or methods of the embodiments described herein.

[0100] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, displays, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via input / output (I / O) interface 114. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapter 115. Fig.11 As shown, the network adapter 115 communicates with other modules of the electronic device via the bus 113. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0101] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. An access control method based on business model and policy, characterized in that: include: Obtaining an operation request from a user terminal, wherein the operation request includes a management and editing operation request and a common use operation request; The target business model is obtained by editing based on the operation request, specifically comprising: identifying a management editing operation request for editing the target business model based on the operation request of the user end; editing the target business model based on the management editing operation request in combination with a preset model design tool, wherein the target business model includes business objects, business attributes and link objects, and the model design tool includes a Xiansheng cloud platform business model editor, wherein the target business model includes a door access control model; Performing a request operation based on the common use operation request in combination with the edited target business model, wherein the target business model includes access policy expressions of different object structures, and editing the target business model based on the management edit operation request in combination with a preset model design tool, specifically comprising: identifying the data filled in by the administrator user in the model design tool based on the management edit operation request to edit the target business model, wherein the business object is obtained based on the filled-in object code and object name; the business attribute is obtained based on the filled-in business primary key code and business primary key name; the link object is obtained based on the filled-in link code and link name; and Creating a new link for the link object specifically includes: based on the management edit operation request, identifying the data filled in by the administrator user in the model design tool to create a new link, wherein the new link code, link name and link type filled in are added as an additional link of the current link object; during the adding process, identifying the check response of the target button for marking, wherein the target button includes dynamic calculation, relationship cardinality and deletion strategy; The target business action is obtained based on the request job, and before executing the target business action, the access policy expression in the edited target business model is called to judge the request job, wherein: When the current request job meets the permission requirement of the access policy expression, the target business action is executed, otherwise it is not executed.

2. The access control method based on business model and policy according to claim 1, characterized in that: Obtaining an operation request from the user, wherein the operation request includes a management and editing operation request and a common use operation request, specifically including: Identifying current user attributes of the data input by the user, wherein the user attributes include administrator attributes and non-administrator attributes; Obtaining the management editing operation request based on user-side input data belonging to the administrator attribute; The common use operation request is obtained based on the user-side input data belonging to the non-administrator attribute.

3. The access control method based on business model and policy according to claim 2 is characterized in that: The method further includes automatically creating a business attribute based on the target business object when the target business object is obtained, wherein the target business object includes a system user object.

4. The access control method based on business model and policy according to claim 3 is characterized in that: The request operation based on the common use operation request combined with the edited target business model specifically includes: Based on the common use operation request and the edited target business model, a common operation request is performed, wherein the access permission judgment of the current request job is made based on the preset query model database to record the row, the business attributes are stored as columns of the database, and the link relationship of the link object is represented by an intermediate table.

5. An access control system based on business models and policies, characterized in that: include: An acquisition module, used to acquire an operation request from a user terminal, wherein the operation request includes a management and editing operation request and a common use operation request; A request module is used to edit a target business model based on an operation request, specifically including: identifying a management editing operation request for editing the target business model based on the operation request of the user end; editing the target business model based on the management editing operation request in combination with a preset model design tool, wherein the target business model includes business objects, business attributes and link objects, and the model design tool includes a Xiansheng cloud platform business model editor, wherein the target business model includes an access control model; performing a request operation based on the common use operation request in combination with the edited target business model, and editing the target business model based on the management editing operation request in combination with a preset model design tool, specifically including: identifying an administrator user in the management editing operation request in combination with a preset model design tool Filling in data in the model design tool to edit the target business model, wherein the business object is obtained based on the filled-in object code and object name; the business attribute is obtained based on the filled-in business primary key code and business primary key name; the link object is obtained based on the filled-in link code and link name; and a new link is created for the link object, specifically including: based on the management edit operation request, identifying the filled-in data in the model design tool by the administrator user to create a new link, wherein the filled-in new link code, link name and link type are added as an additional link of the current link object; during the adding process, identifying the check response of the target button for marking, wherein the target button includes dynamic calculation, relationship cardinality and deletion strategies; A calling module, used to obtain a target business action based on a request job, and before executing the target business action, call the access policy expression in the edited target business model to judge the request job; The execution module is used to execute the target business action when the current request job meets the permission requirement of the access policy expression, and not execute it otherwise.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the access control method based on business models and policies described in any one of claims 1 to 4 is implemented.

7. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the electronic device executes the access control method based on business models and policies as described in any one of claims 1 to 4.

Images