Rights management method, device and computer-readable storage medium

Abstract

The present application discloses a permission management method, device and computer-readable storage medium, the method comprising: based on a first association relationship among users, positions, resource groups and interfaces, determining a target resource group corresponding to the current user's position information in the resource group; based on the target resource group, determining a menu to be rendered and a button to be rendered corresponding to the current user; rendering the menu to be rendered and the button to be rendered based on the target resource group to obtain a front-end operation interface; sending the front-end operation interface to the front-end terminal corresponding to the current user to display the front-end operation interface on the front-end terminal. The present application introduces a permission system of "users, positions, resource groups and interfaces", and uses resource groups as the core to control permissions at the interface level for front-end and back-end permission control, thereby improving the security and flexibility of permission management.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a rights management method, device, and computer-readable storage medium. Background Art

[0002] Traditional RBAC (Role-Based Access Control) permission management controls user operational and data permissions by defining role permissions and granting them to specific roles. This achieves a logical separation of users and permissions, greatly facilitating permission management. In the RBAC model, there is a many-to-many relationship between users and roles, and a many-to-many relationship between roles and permissions. Permissions generally include page permissions (whether users can see related pages, menus, and buttons) and operation permissions (whether users can operate related buttons). To maximize the user experience, page permissions and operation permissions are generally consistent, meaning users can "see and operate."

[0003] However, in the permission control of the RBAC model, permissions are generally controlled at the menu button level, not at the interface level, which lacks security. Alternatively, permissions are controlled at the interface level by directly associating roles with interfaces, which lacks flexibility.

[0004] Therefore, how to improve the security and flexibility of the permission control of the RBAC model is an urgent problem that needs to be solved. Summary of the Invention

[0005] The main purpose of this application is to provide a permission management method, device and computer-readable storage medium, aiming to solve the technical problem of how to improve the security and flexibility of permission management of the RBAC model.

[0006] To achieve the above objectives, the present application provides a rights management method, which includes the following steps:

[0007] Based on the first association relationship between the user, the position, the resource group, and the interface, determine the target resource group corresponding to the current user's position information in the resource group, wherein the resource group includes at least four types of permissions: public, logged-in user, member user, and designated position;

[0008] Based on the target resource group, determining a menu to be rendered and a button to be rendered corresponding to the current user;

[0009] Performing rendering operations on the menu to be rendered and the button to be rendered based on the target resource group to obtain a front-end operation interface;

[0010] The front-end operation interface is sent to the front-end terminal corresponding to the current user, so as to display the front-end operation interface on the front-end terminal.

[0011] Furthermore, the step of determining the menu to be rendered and the button to be rendered corresponding to the current user based on the target resource group includes:

[0012] Get the second association relationship between menu, submenu, resource group and interface;

[0013] Based on the second association relationship and the target resource group, the to-be-rendered menu and to-be-rendered button corresponding to the current user are determined.

[0014] Furthermore, the rights management method further includes:

[0015] Based on the first association relationship, obtaining permission information corresponding to each interface;

[0016] Based on the permission information corresponding to each interface, an interface permission tree is constructed, wherein the non-leaf nodes of the interface permission tree are the access path and access method of the interface, and the leaf nodes store the access rights of the interface.

[0017] Furthermore, after the step of constructing an interface permission tree based on the permission information corresponding to each interface, the permission management method further includes:

[0018] In response to an interface access request sent by the front-end terminal based on the front-end operation interface, querying permission information corresponding to the interface access request based on the interface permission tree;

[0019] Obtaining user authority information corresponding to the interface access request;

[0020] Determining whether the user authority information matches the authority information corresponding to the interface access request;

[0021] If the user authority information matches the authority information corresponding to the interface access request, the business logic corresponding to the interface access request is executed.

[0022] Furthermore, the rights management method further includes:

[0023] A resource configuration request is detected and the resource configuration interface is displayed;

[0024] A permission change request triggered by the resource configuration interface is detected, a permission change SQL corresponding to the permission change request is obtained, and the permission change SQL is executed.

[0025] Furthermore, the step of obtaining the permission change SQL corresponding to the permission change request and executing the permission change SQL includes:

[0026] Obtain the permission change information and project name corresponding to the permission change request;

[0027] Determine the permission change SQL based on the permission change information, and execute the permission change SQL;

[0028] The permission change SQL, the execution order corresponding to the permission change SQL, and the project name are recorded in the current database.

[0029] Furthermore, the step of determining the permission change SQL based on the permission change information includes:

[0030] Determine the difference between the permission change information and the permission information corresponding to the project name in the current database;

[0031] The permission change SQL is generated based on the difference information.

[0032] Furthermore, after the step of recording the permission change SQL, the execution order corresponding to the permission change SQL, and the user information in the current database, the permission management method further includes:

[0033] Detecting a permission change instruction to publish the permission change SQL to the next environment, obtaining the permission change record information in the current database and the name of the project to be published corresponding to the permission change instruction;

[0034] Query the permission change sql corresponding to the project name to be published in the permission change sql of the record information;

[0035] The execution order corresponding to the permission change sql to be published is obtained from the record information, and the permission change sql to be published is executed in the database of the next environment based on the execution order.

[0036] In addition, to achieve the above-mentioned purpose, the present application also provides a permission management device, which includes: a memory, a processor, and a permission management program stored on the memory and runnable on the processor, and when the permission management program is executed by the processor, the steps of the aforementioned permission management method are implemented.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which a rights management program is stored, and when the rights management program is executed by a processor, the steps of the aforementioned rights management method are implemented.

[0038] This application determines the target resource group corresponding to the current user's position information in the resource group based on the first association relationship between users, positions, resource groups, and interfaces, wherein the resource group includes at least four types of permissions: public, logged-in user, member user, and designated position; then, based on the target resource group, determines the menu to be rendered and the button to be rendered corresponding to the current user; then, based on the target resource group, the menu to be rendered and the button to be rendered are rendered to obtain a front-end operation interface; then, the front-end operation interface is sent to the front-end terminal corresponding to the current user to display the front-end operation interface on the front-end terminal. By introducing the permission system of "user, position, resource group, interface", the permission control is performed at the interface level for the front-end and back-end permission control with the resource group as the core, thereby improving the security and flexibility of permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] Figure 1 A flowchart of the first embodiment of the application rights management method is provided;

[0042] Figure 2 This is a schematic diagram of the permission system in an embodiment of the permission management method of this application;

[0043] Figure 3 This is a schematic diagram of the interface permission tree in an embodiment of the permission management method of this application;

[0044] Figure 4 This is a schematic diagram of the module structure of the rights management device according to an embodiment of the present application.

[0045] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0046] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0047] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0048] The main solution of this application is: based on the first association relationship between users, positions, resource groups, and interfaces, determine the target resource group corresponding to the current user's position information in the resource group, wherein the resource group includes at least four types of permissions: public, logged-in user, member user, and designated position; based on the target resource group, determine the menu to be rendered and the button to be rendered corresponding to the current user; based on the target resource group, render the menu to be rendered and the button to be rendered to obtain a front-end operation interface; send the front-end operation interface to the front-end terminal corresponding to the current user to display the front-end operation interface on the front-end terminal.

[0049] Currently, traditional RBAC (Role-Based Access Control) permission management controls user operation and data permissions by defining role permissions and granting them to specific roles. This achieves a logical separation between users and permissions, greatly facilitating permission management. In the RBAC model, users and roles form a many-to-many relationship, and roles and permissions also form a many-to-many relationship. Permissions generally include page permissions (whether users can see related pages, menus, and buttons) and operation permissions (whether users can operate related buttons). To maximize the user experience, page permissions and operation permissions are typically consistent, meaning users can "see and operate" the permissions. However, permission control in the RBAC model typically operates at the menu button level, not at the interface level, lacking security. Alternatively, permissions are controlled at the interface level by directly associating roles with interfaces, lacking flexibility. Therefore, improving the security and flexibility of permission control in the RBAC model is a pressing issue.

[0050] This application introduces the permission system of "user, position, resource group, interface" and "menu, resource group", and uses resource group as the core to control the permission at the interface level for front-end and back-end permission control, thereby improving the security and flexibility of permission management.

[0051] It should be noted that the execution subject of this embodiment may be a rights management device, or a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or a rights management device capable of performing the above functions, etc., and this embodiment does not specifically limit this. The following describes this embodiment and the following embodiments using the rights management device as the execution subject.

[0052] Based on this, this application proposes a first embodiment of the rights management method, please refer to Figure 1 The rights management method includes steps S110 to S140:

[0053] Step S110: Based on the first association relationship among the user, the position, the resource group, and the interface, a target resource group corresponding to the current user's position information is determined in the resource group, wherein the resource group includes at least four types of permissions: public, logged-in user, member user, and designated position;

[0054] In this embodiment, please refer to Figure 2 , two association relationships, "user-position-resource group-interface" and "menu-submenu-resource group-interface", are pre-set. "User-position-resource group-interface" is the first association relationship, and "menu-submenu-resource group-interface" is the second association relationship. One user can be associated with multiple positions, one position can be associated with multiple resource groups, and one resource group can be associated with multiple interfaces; one menu can be associated with multiple submenus, and one submenu can be associated with multiple resource groups; a resource group is a resource collection for a certain atomic operation, such as button permissions, page permissions, etc. This makes the resource group the core of permission control, and both the front-end and back-end perform fine-grained permission control based on the resource group. A resource group includes at least four permissions: public, logged-in user, member user, and designated position. At the same time, the resource group can also specify whether it is open to members or users.

[0055] In this embodiment, when the current user logs in to the corresponding user account on the front-end terminal, the login information corresponding to the current user's user account is received. The background server determines the target resource group corresponding to the current user's position information in the resource group based on the first association relationship between the user, position, resource group, and interface. Specifically, the background server queries the position owned by the current user in the first association relationship based on the user account, and queries the resource group to which the current user has authority in the first association relationship based on the position owned by the current user, to obtain the target resource group, that is, the target resource group is the resource group to which the current user has authority in each resource group.

[0056] Step S120: determining the menu to be rendered and the button to be rendered corresponding to the current user based on the target resource group;

[0057] In this embodiment, after obtaining the target resource group, the backend server determines the menu to be rendered and the button to be rendered corresponding to the current user based on the target resource group. Specifically, in a feasible implementation, step S120 may include steps S1201 to S1202:

[0058] Step S1201, obtaining a second association relationship between a menu, a submenu, a resource group, and an interface;

[0059] Step S1202: Based on the second association relationship and the target resource group, determine the menu to be rendered and the button to be rendered corresponding to the current user.

[0060] In this embodiment, after obtaining the target resource group, the background server ( Figure 2 The backend in the process obtains the second association relationship between the menu, submenu, resource group, and interface, that is, obtains the association relationship corresponding to "menu-submenu-resource group-interface". Then, the backend server determines the menu to be rendered and the button to be rendered corresponding to the current user based on the second association relationship and the target resource group. Specifically, according to the second association relationship, the menu, submenu, and button corresponding to the target resource group are searched for the menu and button that the current user has permission to, and the menu and button to be rendered are obtained, and then the target resource group is associated with the menu, submenu, and button on the front end.

[0061] Step S130, performing a rendering operation on the menu to be rendered and the button to be rendered based on the target resource group to obtain a front-end operation interface;

[0062] In this embodiment, after obtaining the menu to be rendered and the button to be rendered, the background server performs rendering operations on the menu to be rendered and the button to be rendered based on the target resource group, obtains the front-end operation interface, and renders the menu to be rendered and the button to be rendered specifically according to the target resource group and the association relationship between the target resource group and the front-end element.

[0063] Step S140: sending the front-end operation interface to the front-end terminal corresponding to the current user, so as to display the front-end operation interface on the front-end terminal.

[0064] In this embodiment, after obtaining the front-end operation interface, the front-end operation interface is sent to the front-end terminal corresponding to the current user ( Figure 2 The front-end terminal displays the front-end operation interface, thereby realizing that the front-end operation interface is visible and operable, and realizing the front-end authority control.

[0065] The permission management method proposed in this embodiment determines the target resource group corresponding to the current user's position information in the resource group based on the first association relationship between the user, position, resource group, and interface, wherein the resource group includes at least four types of permissions: public, logged-in user, member user, and designated position; then, based on the target resource group, determines the menu to be rendered and the button to be rendered corresponding to the current user; then, based on the target resource group, the menu to be rendered and the button to be rendered are rendered to obtain a front-end operation interface; then, the front-end operation interface is sent to the front-end terminal corresponding to the current user to display the front-end operation interface on the front-end terminal. By introducing the permission system of "user, position, resource group, interface", the permission control is performed at the interface level for front-end and back-end permission control with the resource group as the core, thereby improving the security and flexibility of permission management.

[0066] In a feasible implementation manner, the rights management method further includes: steps S210 to S220:

[0067] Step S210: Based on the first association relationship, obtain the permission information corresponding to each interface;

[0068] Step S220: construct an interface permission tree based on the permission information corresponding to each interface, wherein the non-leaf nodes of the interface permission tree are the access path and access method of the interface, and the leaf nodes store the access rights of the interface.

[0069] In this embodiment, in the gateway application ( Figure 2 When the gateway in the system is started, the background server can obtain the permission information corresponding to each interface according to the first association relationship of "user-position-resource group-interface". Specifically, according to the relationship between "position-resource group-interface" in the first association relationship and the permission scope configured by the resource group, the permission scope corresponding to all interfaces (public, logged-in user, member user, designated position) can be queried.

[0070] After obtaining the permission information of the interface, the background server constructs an interface permission tree (dictionary tree) based on the permission information corresponding to each interface. Specifically, the interface permission tree is initialized and constructed using the sureness framework and saved in memory. Among them, the non-leaf nodes of the interface permission tree are the access path and access method of the interface, and the leaf nodes store the access rights of the interface, such as Figure 3 As shown, in the interface permission tree, L#3 represents public permission, L#2 represents member user permission, L#1 represents logged-in user permission, and L#0 represents designated position permission; the subsequent 8-bit code represents the specific position code.

[0071] In a feasible implementation, after step S220, the rights management method may include steps S230 to S260:

[0072] Step S230, in response to the interface access request sent by the front-end terminal based on the front-end operation interface, querying the permission information corresponding to the interface access request based on the interface permission tree;

[0073] Step S240: Obtain user authority information corresponding to the interface access request;

[0074] Step S250, determining whether the user authority information matches the authority information corresponding to the interface access request;

[0075] Step S260: If the user authority information matches the authority information corresponding to the interface access request, the business logic corresponding to the interface access request is executed.

[0076] In this embodiment, the user can trigger an interface access request through the menu or button in the front-end operation interface displayed by the front-end terminal. After detecting the interface access request, the front-end terminal sends the interface access request to the gateway. The gateway queries the permission information corresponding to the interface access request based on the interface permission tree. Specifically, the gateway uses the dictionary tree algorithm to efficiently search for the permission information corresponding to the interface access request in the interface permission tree.

[0077] After obtaining the permission information corresponding to the interface access request, the gateway obtains the user permission information corresponding to the interface access request. The user permission information is the permission information of the login account of the front-end terminal, including whether the user is logged in, whether the user is a member user, whether the user has a designated position, etc. After obtaining the user permission information, the gateway compares the permission information corresponding to the interface access request with the user permission information to determine whether the user permission information matches the permission information corresponding to the interface access request.

[0078] In this embodiment, if the user permission information matches the permission information corresponding to the interface access request, it indicates that the front-end terminal's login account has access rights to the interface corresponding to the interface access request. The gateway then executes the business logic corresponding to the interface access request, i.e., the gateway application routes the request to the specific back-end server application to execute the subsequent business logic. By introducing the Sureness permission framework's efficient dictionary tree permission matching algorithm, the efficiency and security of permission control are further improved.

[0079] The permission management method proposed in this embodiment obtains the permission information corresponding to each interface based on the first association relationship; then constructs an interface permission tree based on the permission information corresponding to each interface, wherein the non-leaf nodes of the interface permission tree are the access path and access method of the interface, and the leaf nodes store the access rights of the interface. By introducing the interface permission tree to improve the efficiency of permission matching, and expanding the permission attributes of the leaf nodes of the permission tree, it supports fine-grained permission control in multiple dimensions such as public, logged-in users, member users, and designated positions.

[0080] In a feasible implementation, the rights management method may further include steps S310 to S320:

[0081] Step S310: Detecting a resource configuration request and displaying a resource configuration interface;

[0082] Step S320: Detecting the permission change request triggered by the resource configuration interface, obtaining the permission change SQL corresponding to the permission change request, and executing the permission change SQL.

[0083] In this embodiment, an independent user name (project name) and password can be assigned to each project. The administrator can use the user name and password to log in to the resource configuration website. Specifically, when a resource configuration request is detected, a resource configuration interface is displayed, that is, the configuration interface corresponding to the resource configuration website. The resource permissions of the project can be configured through the resource configuration interface, including adding, editing, and deleting interfaces, adding, editing, and deleting menus, adding, editing, and deleting resource groups, etc.

[0084] In this embodiment, when a permission change request triggered by a resource configuration interface is detected, the permission change SQL corresponding to the permission change request is obtained and the permission change SQL is executed, that is, the permission change SQL is executed in the database of the current environment to implement the permission change corresponding to the permission change request. In a feasible implementation, step S320 may include steps S321 to S323:

[0085] Step S321: Obtain the permission change information and project name corresponding to the permission change request;

[0086] Step S322: determining the permission change SQL based on the permission change information, and executing the permission change SQL;

[0087] Step S323: Record the permission change SQL, the execution order of the permission change SQL, and the project name in the current database.

[0088] In this embodiment, when a permission change request triggered by a resource configuration interface is detected, the permission change information and project name corresponding to the permission change request are obtained. The permission change information is the input information and selection information in the resource configuration interface, and the project name can be the user name of the project.

[0089] After obtaining the permission change information and the project name, the permission change SQL is determined based on the permission change information. In a feasible implementation, step S322 may include steps S3221 to S3222:

[0090] Step S3221, determining the difference between the permission change information and the permission information corresponding to the project name in the current database;

[0091] Step S3222: Generate the permission change SQL based on the difference information.

[0092] In this embodiment, the permission information corresponding to the project name is queried in the database of the current environment based on the user information, and the difference information between the permission change information and the permission information corresponding to the project name is compared. It should be noted that the difference information may only include the difference information corresponding to the permission change information, that is, the difference corresponding to the permission in the permission change information. For example, if the permission change information only includes the change information of permission A, the difference information is the difference information corresponding to permission A.

[0093] After obtaining the difference information, a permission change SQL is generated based on the difference information, and the permission change SQL is executed, that is, the permission change SQL is executed in the database of the current environment to implement the permission change corresponding to the permission change request.

[0094] In this embodiment, after the execution of the permission change sql is completed, the permission change sql, the execution order corresponding to the permission change sql, and the project name are recorded in the current database. Specifically, a customized mybatis interceptor can be used to record the record information of each permission change in the database. Each record information includes the execution sequence number of the permission change sql, the permission change sql, the batch number of the permission change sql, and the project name.

[0095] In a feasible implementation, the rights management method may further include steps S330 to S350:

[0096] Step S330: Detecting a permission change instruction to publish the permission change SQL to the next environment, obtaining the permission change record information in the current database and the name of the project to be published corresponding to the permission change instruction;

[0097] Step S340, querying the permission change sql corresponding to the project name to be published in the permission change sql of the record information;

[0098] Step S350: Obtain the execution order corresponding to the permission change SQL to be published from the record information, and execute the permission change SQL to be published in the database of the next environment based on the execution order.

[0099] In this embodiment, the permission change of a project can be published to the next environment. The permission change instruction to publish the permission change sql to the next environment is detected, and the record information of the permission change in the current database and the name of the project to be published corresponding to the permission change instruction are obtained. The name of the project to be published is the user name for logging into the resource configuration website corresponding to the project whose permission change needs to be published to the next environment.

[0100] After obtaining the name of the project to be released, query the permission change sql to be released corresponding to the project name to be released in the permission change sql of the record information; at the same time, obtain the execution order corresponding to the permission change sql to be released in the record information, and execute the permission change sql to be released in the database of the next environment based on the execution order, thereby realizing one-click configuration of permission change.

[0101] By comparing the differences in each permission configuration and the customized MyBatis plug-in, the SQL script for each permission change is recorded, thereby supporting multiple project groups on the system group to perform permission configuration in parallel without affecting each other, and configuring once in the development environment and using it in multiple places in the test and production environments, thereby improving the efficiency of permission configuration.

[0102] The permission management method proposed in this embodiment detects a resource configuration request and displays a resource configuration interface; then detects a permission change request triggered by the resource configuration interface, obtains the permission change SQL corresponding to the permission change request, and executes the permission change SQL, thereby realizing the permission change and further improving the efficiency of permission configuration.

[0103] The rights management device provided in the embodiment of the present application adopts the rights management method in the above embodiment and can solve the technical problem of how to improve the security and flexibility of the rights management of the RBAC model. Compared with the prior art, the beneficial effects of the rights management device provided in the embodiment of the present application are the same as the beneficial effects of the rights management method provided in the above embodiment, and the other technical features of the rights management device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0104] The present application provides a rights management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the rights management method in the above-mentioned embodiment one.

[0105] Reference below Figure 4, which shows a schematic diagram of the structure of a rights management device suitable for implementing the embodiments of the present application. The rights management device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 4 The rights management device shown is merely an example and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

[0106] like Figure 4 As shown, the rights management device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for the operation of the rights management device. Processing device 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to I / O interface 1006: input devices 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 1003 including, for example, a magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 can allow the rights management device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a rights management device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0107] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0108] The rights management device provided in this application, using the rights management method in the above-mentioned embodiment, can solve the technical problem of how to improve the security and flexibility of the rights management of the RBAC model. Compared with the prior art, the beneficial effects of the rights management device provided in this application are the same as the beneficial effects of the rights management method provided in the above-mentioned embodiment, and the other technical features of the rights management device are the same as those disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0109] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0110] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0111] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the rights management method in the above-mentioned embodiment.

[0112] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0113] The computer-readable storage medium may be included in the rights management device, or may exist independently without being incorporated into the rights management device.

[0114] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the permission management device, the permission management device: based on the first association relationship between users, positions, resource groups, and interfaces, determines the target resource group corresponding to the current user's position information in the resource group, wherein the resource group includes at least four types of permissions: public, logged-in user, member user, and designated position; based on the target resource group, determines the menu to be rendered and the button to be rendered corresponding to the current user; based on the target resource group, renders the menu to be rendered and the button to be rendered to obtain a front-end operation interface; sends the front-end operation interface to the front-end terminal corresponding to the current user to display the front-end operation interface on the front-end terminal.

[0115] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0116] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0117] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0118] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., a computer program) for executing the above-mentioned rights management method, and can solve the technical problem of how to improve the security and flexibility of the rights management of the RBAC model. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the rights management method provided in the above-mentioned embodiment, and will not be repeated here.

[0119] An embodiment of the present application provides a computer program product, including a computer program, which implements the steps of the above-mentioned rights management method when executed by a processor.

[0120] The computer program product provided in this application can solve the technical problem of how to improve the security and flexibility of the permission management of the RBAC model. Compared with the prior art, the beneficial effects of the computer program product provided in the embodiments of this application are the same as the beneficial effects of the permission management method provided in the above embodiments, and will not be repeated here.

[0121] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A rights management method, characterized in that: The rights management method comprises the following steps: Based on the first association relationship between the user, the position, the resource group, and the interface, determine the target resource group corresponding to the current user's position information in the resource group, wherein the resource group includes at least four types of permissions: public, logged-in user, member user, and designated position; Based on the target resource group, determining a menu to be rendered and a button to be rendered corresponding to the current user; Performing rendering operations on the menu to be rendered and the button to be rendered based on the target resource group to obtain a front-end operation interface; Sending the front-end operation interface to the front-end terminal corresponding to the current user, so as to display the front-end operation interface on the front-end terminal; The rights management method further includes: Detect the permission change instruction to publish the permission change SQL to the next environment, and obtain the permission change SQL to be published for the permission change instruction pair; The execution order corresponding to the permission change sql to be published is obtained from the record information of the permission change in the current database, and the permission change sql to be published is executed in the database of the next environment based on the execution order.

2. The rights management method according to claim 1, wherein: The step of determining the menu to be rendered and the button to be rendered corresponding to the current user based on the target resource group includes: Get the second association relationship between menu, submenu, resource group and interface; Based on the second association relationship and the target resource group, the to-be-rendered menu and to-be-rendered button corresponding to the current user are determined.

3. The rights management method according to claim 1, wherein: The rights management method further includes: Based on the first association relationship, obtaining permission information corresponding to each interface; Based on the permission information corresponding to each interface, an interface permission tree is constructed, wherein the non-leaf nodes of the interface permission tree are the access path and access method of the interface, and the leaf nodes store the access rights of the interface.

4. The rights management method according to claim 3, wherein: After the step of constructing an interface permission tree based on the permission information corresponding to each interface, the permission management method further includes: In response to an interface access request sent by the front-end terminal based on the front-end operation interface, querying permission information corresponding to the interface access request based on the interface permission tree; Obtaining user authority information corresponding to the interface access request; Determining whether the user authority information matches the authority information corresponding to the interface access request; If the user authority information matches the authority information corresponding to the interface access request, the business logic corresponding to the interface access request is executed.

5. The rights management method according to any one of claims 1 to 4, characterized in that: The rights management method further includes: A resource configuration request is detected and the resource configuration interface is displayed; A permission change request triggered by the resource configuration interface is detected, a permission change SQL corresponding to the permission change request is obtained, and the permission change SQL is executed.

6. The rights management method according to claim 5, wherein: The step of obtaining the permission change SQL corresponding to the permission change request and executing the permission change SQL includes: Obtain the permission change information and project name corresponding to the permission change request; Determine the permission change SQL based on the permission change information, and execute the permission change SQL; The permission change SQL, the execution order corresponding to the permission change SQL, and the project name are recorded in the current database.

7. The rights management method according to claim 6, wherein: The step of determining the permission change SQL based on the permission change information includes: Determine the difference between the permission change information and the permission information corresponding to the project name in the current database; The permission change SQL is generated based on the difference information.

8. The rights management method according to claim 6, wherein: The step of detecting a permission change instruction for publishing a permission change SQL to a next environment and obtaining a permission change SQL to be published for the permission change instruction pair comprises: Detecting a permission change instruction to publish the permission change SQL to the next environment, obtaining the permission change record information in the current database and the name of the project to be published corresponding to the permission change instruction; The permission change sql to be published corresponding to the project name to be published is searched in the permission change sql of the record information.

9. A rights management device, characterized in that: The rights management device includes: a memory, a processor, and a rights management program stored in the memory and executable on the processor. When the rights management program is executed by the processor, the steps of the rights management method according to any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a rights management program, which, when executed by a processor, implements the steps of the rights management method according to any one of claims 1 to 8.

Images