A method, device, storage medium and electronic device for user authority management

Abstract

The present application relates to the field of access control technology, and specifically provides a method, device, storage medium and electronic device for user rights management, which may include: obtaining at least one sub-user associated with a main user from a main user access control list; generating sub-user character strings corresponding to each sub-user in the at least one sub-user, wherein each sub-user character string includes identity information and access permission information of each sub-user; calculating each sub-user character string to obtain each sub-user characteristic value; sending each sub-user characteristic value to a client, so that when each sub-user logs in to the client, by verifying each sub-user characteristic value, it is determined whether each sub-user has access permission. Some embodiments of the present application can realize effective management of sub-user rights.

Description

Technical Field

[0001] The present application relates to the field of access control technology, and in particular to a method, device, storage medium and electronic device for user authority management. Background Art

[0002] Traditional object storage permission control is mainly controlled by ACL (Access Control List). ACL can be effective not only for users, buckets, and objects, but also for sub-users under users. It is a widely used, safe and efficient permission control management technology. In the current object storage system, the main user is usually directly configured by the object storage system, and then some sub-users who can access the files under the main user are divided into the main user for management. However, since different sub-users have different access rights, when there are a large number of sub-users, how to manage their permissions in an orderly and effective manner becomes a technical problem that needs to be solved urgently. Summary of the invention

[0003] The purpose of some embodiments of the present application is to provide a method, device, storage medium and electronic device for user authority management. Through the technical solutions of the embodiments of the present application, effective and orderly management of user access rights can be achieved to ensure the security of data access.

[0004] In a first aspect, some embodiments of the present application provide a method for user authority management, which is applied to a server, and includes: obtaining at least one sub-user associated with a main user from a main user access control list; generating sub-user character strings corresponding to each sub-user in the at least one sub-user, wherein each sub-user character string includes identity information and access permission information of each sub-user; calculating each sub-user character string to obtain a characteristic value of each sub-user; and sending each sub-user characteristic value to a client, so that when each sub-user logs in to the client, the characteristic value of each sub-user can be verified to determine whether each sub-user has access permission.

[0005] Some embodiments of the present application generate corresponding sub-user character strings for each sub-user managed by the main user, then calculate the sub-user characteristic values, and finally send them to the client, so that the sub-user can verify when logging in to access and confirm whether the sub-user has the relevant access rights. Some embodiments of the present application calculate the character string containing the user's access right information to obtain a unique user characteristic value as the basis for user access, which can realize the sub-user's effective and orderly access to data and ensure the security of access.

[0006] In some embodiments, the calculating each sub-user character string to obtain each sub-user characteristic value includes: segmenting each sub-user character string to obtain multiple data blocks; generating a binary tree structure based on the result of calculating each sub-data block in the multiple data blocks to determine each sub-user characteristic value.

[0007] Some embodiments of the present application generate a binary tree structure by segmenting each sub-user character string and then performing calculations to obtain unique characteristic values ​​for each sub-user, thereby providing security support for verifying the access rights of the sub-users.

[0008] In some embodiments, when the access rights of any sub-user among the at least one sub-user change, the method further includes: parsing the sub-user characteristic value corresponding to the any sub-user to obtain the access rights information; updating the access rights information, and regenerating an updated character string corresponding to the any sub-user; calculating the updated character string to obtain an updated characteristic value, and sending the updated characteristic value to the client.

[0009] Some embodiments of the present application can update relevant access permission information by parsing sub-user characteristic values ​​when access permissions change, and then recalculate updated characteristic values, thereby achieving dynamic adjustment of sub-user access permissions with high flexibility.

[0010] In a second aspect, some embodiments of the present application provide a method for user authority management, which is applied to a client, including: confirming that the sub-user corresponding to the received login request is one in the main user access control list; obtaining a sub-user characteristic value corresponding to the sub-user, wherein the sub-user characteristic value is calculated by the server for a user character string corresponding to the sub-user, and the user character string includes: the identity information and access permission information of the sub-user; and determining whether the sub-user has access permission by verifying the user characteristic value.

[0011] In some embodiments of the present application, any sub-user obtains its corresponding sub-user feature value when logging in to access, and then verifies it to determine whether it has access rights. In some embodiments of the present application, the server calculates the string containing the user's access rights information to obtain a unique user feature value as the basis for the user to access the client, which can achieve sub-users' effective and orderly access to data and ensure the security of access.

[0012] In some embodiments, when the access rights of the sub-user change, the method further includes: receiving an updated characteristic value sent by the server, wherein the updated characteristic value is recalculated by the server after updating the access rights information.

[0013] Some embodiments of the present application can achieve dynamic adjustment of sub-user access rights by receiving updated feature values ​​obtained by the server when access rights change, with high flexibility.

[0014] In a third aspect, some embodiments of the present application provide a user authority management device, which is applied to a server, and includes: an acquisition module, used to acquire at least one sub-user associated with a main user from a main user access control list; a generation module, used to generate sub-user character strings corresponding to each sub-user in the at least one sub-user, wherein each sub-user character string includes identity information and access permission information of each sub-user; a calculation module, used to calculate each sub-user character string to obtain a characteristic value of each sub-user; and a sending module, used to send the characteristic values ​​of each sub-user to a client, so that when each sub-user logs in to the client, it is determined whether each sub-user has access permission by verifying the characteristic values ​​of each sub-user.

[0015] In a fourth aspect, some embodiments of the present application provide a user authority management device, which is applied to a server, and includes: a receiving module, used to confirm that the sub-user corresponding to the received login request is one in the main user access control list; a feature acquisition module, used to obtain a sub-user feature value corresponding to the sub-user, wherein the sub-user feature value is obtained by the server by calculating the user character string corresponding to the sub-user, and the user character string includes: the identity information and access permission information of the sub-user; a verification module, used to determine whether the sub-user has access permission by verifying the user feature value.

[0016] In a fifth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0017] In a sixth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a method as described in any embodiment of the first aspect.

[0018] In a seventh aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A system diagram of user rights management provided for some embodiments of the present application;

[0021] Figure 2 One of the method flow charts of user rights management provided in some embodiments of the present application;

[0022] Figure 3 A schematic diagram of a binary tree structure provided for some embodiments of the present application;

[0023] Figure 4 A second flowchart of a method for user rights management provided in some embodiments of the present application;

[0024] Figure 5 A third flowchart of a method for user rights management provided in some embodiments of the present application;

[0025] Figure 6 One of the block diagrams of the user rights management device provided in some embodiments of the present application;

[0026] Figure 7 The second block diagram of the user rights management device provided in some embodiments of the present application;

[0027] Figure 8 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0029] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0030] Traditional object storage permission control is mainly controlled by ACL (Access Control List). In traditional object storage systems, the number of main users is limited and is directly configured and managed by the storage system. Therefore, some users who only need to perform limited operations on some objects are often classified under the main user, that is, sub-users. Due to the large number of sub-users, the needs are also relatively complex. By managing sub-users after access, the management situation becomes more complicated. Therefore, the better way is to manage them before accessing the storage pool or storage bucket.

[0031] It can be seen from the above related technologies that in the prior art, how to control the management technology of the extension of sub-user permissions based on the original permissions of the user is a technical problem that needs to be solved at present.

[0032] In view of this, some embodiments of the present application provide a method for user rights management, in which the server generates a sub-user string corresponding to each sub-user after obtaining at least one sub-user related to the main user; then calculates the sub-user string, obtains the sub-user characteristic value, and sends it to the client. After receiving the access request of the sub-user, the client can verify the corresponding sub-user characteristic value to confirm whether the sub-user has access rights. Some embodiments of the present application can realize effective and orderly management of sub-user rights, and the management method is relatively safe and easy to implement.

[0033] The following is combined with Figure 1 The overall structure of the user rights management system provided by some embodiments of the present application is exemplified.

[0034] like Figure 1 As shown, some embodiments of the present application provide a system for user rights management, which may include a client 100 and a server 200. The server 200 stores an access control list ACL of the main user, and at least one sub-user can be obtained from the ACL. Then, a corresponding sub-user string is generated for each sub-user; then, a hash calculation is performed on the sub-user string to obtain a sub-user feature value. While the server 200 stores the sub-user features locally, it also sends each sub-user feature value to the client 100. After receiving the login request of the sub-user, the client 100 can verify the corresponding sub-user features to confirm whether the sub-user has the relevant permissions. If the verification is passed, the sub-user is allowed to access and operate the relevant file data, otherwise, abnormal information is fed back.

[0035] In some embodiments of the present application, the client 100 may be a mobile terminal or a non-portable computer terminal, which is not specifically limited in the embodiments of the present application.

[0036] The following is combined with Figure 2 The implementation process of user rights management performed by the server 200 provided in some embodiments of the present application is exemplified.

[0037] Please see attached Figure 2 , Figure 2 A flowchart of a method for user rights management is provided for some embodiments of the present application. The method for user rights management may include:

[0038] S210: Acquire at least one sub-user associated with the main user from the main user access control list.

[0039] For example, in some embodiments of the present application, when a sub-user is created, the sub-users managed in the master user ACL are first confirmed, and then the inherited and modified parts of the file data of each sub-user are confirmed through user settings. The sub-user has access rights to the content and operation rights after access.

[0040] S220: Generate each sub-user character string corresponding to each sub-user in the at least one sub-user, wherein each sub-user character string includes identity information and access permission information of each sub-user.

[0041] For example, in some embodiments of the present application, based on the ACL provided by the main user and the name of the sub-user, sub-user identity information, extended permission items (as a specific example of access permission information), custom permission bits, file keywords, management life cycle and other fields are added to obtain the sub-user string of each sub-user (i.e., each sub-user string).

[0042] S230: Calculate each sub-user character string to obtain a characteristic value of each sub-user.

[0043] For example, in some embodiments of the present application, the HASH generation type of a single main user is confirmed according to the load type (for example, a storage unit inside a network disk or a database). For example, a high-security level and a low number of sub-users can specify the use of SHA-256 for HASH generation. If it is a high-load multi-sub-user type, an efficient algorithm such as CRC can be used. Among them, high-security level and low number of sub-users refers to a situation where the confidentiality level is high and the number of users is small. High-load multi-sub-user type refers to a situation where the load occupancy is large and there is more user data. After the HASH algorithm is determined through the above situation, the sub-user string of each sub-user is HASH calculated through the HASH algorithm to obtain the characteristic HASH value of each sub-user (as a specific example of the characteristic value of each sub-user).

[0044] In some embodiments of the present application, S230 may include: segmenting the sub-user character strings to obtain multiple data blocks; generating a binary tree structure based on the results of calculating each sub-data block in the multiple data blocks, and determining the characteristic values ​​of each sub-user.

[0045] For example, in some embodiments of the present application, the sub-user character string of each sub-user is divided into blocks according to the set data block size and then HASH calculation is performed to obtain the characteristic HASH value of each sub-user. Figure 3 As shown, the sub-user string corresponding to the user is divided into user permission data blocks 0 to N (as a specific example of multiple data blocks). Then, HASH calculation is performed level by level to generate a complete binary tree structure upward, and finally the root feature HASH, that is, the feature HASH value, is obtained. The HASH values ​​of the corresponding levels are generated using a specified algorithm, which can effectively prevent loss and tampering, and has high security.

[0046] S240: Send the characteristic value of each sub-user to the client, so that when each sub-user logs into the client, it is determined whether each sub-user has access rights by verifying the characteristic value of each sub-user.

[0047] For example, in some embodiments of the present application, the characteristic HASH value of each user is stored locally on the server 200 and sent to the client 100 at the same time to facilitate verification of the sub-user who sends the access request. Among them, the characteristic HASH value of each sub-user can be stored using a relational database, or can be stored as a file based on its own characteristic HASH, which is not specifically limited in the embodiments of the present application. Because the corresponding relationship is clear and highly block-based, the characteristic value can be flexibly migrated between multiple media without the risk of leakage.

[0048] In some embodiments of the present application, when the access rights of any sub-user among at least one sub-user change, the user rights management method also includes: parsing the sub-user characteristic value corresponding to any sub-user to obtain the access rights information; updating the access rights information, and regenerating an update string corresponding to any sub-user; calculating the update string to obtain an update characteristic value, and sending the update characteristic value to the client.

[0049] For example, in some embodiments of the present application, when the main user modifies the permissions of the sub-user, that is, the access permissions of the sub-user are changed, the characteristic HASH value of the sub-user can be parsed first, and then the access permission information therein can be modified accordingly. After completion, a new characteristic HASH value is regenerated (as a specific example of updating the characteristic value) and returned to the client 100 of the sub-user as soon as possible. Among them, the parsing algorithm corresponds to the HASH algorithm selected above, and different HASH algorithms correspond to different parsing algorithms.

[0050] The following is combined with Figure 4 The implementation process of user rights management performed by the client 100 provided in some embodiments of the present application is exemplified.

[0051] Please see attached Figure 4 , Figure 4 A flowchart of a method for user rights management is provided for some embodiments of the present application. The method for user rights management may include:

[0052] S410: Confirm that the sub-user corresponding to the received login request is one of the sub-users in the master user access control list.

[0053] For example, in some embodiments of the present application, the identity information of the logged-in sub-user is first verified to confirm that the identity ID of the sub-user is one in the ACL table and that the sub-user has an association relationship with the main user to inherit or modify files.

[0054] S420, obtaining a sub-user characteristic value corresponding to the sub-user, wherein the sub-user characteristic value is obtained by the server side calculating a user character string corresponding to the sub-user, and the user character string includes: identity information and access permission information of the sub-user.

[0055] For example, in some embodiments of the present application, the characteristic HASH value corresponding to the sub-user is searched. For example, the characteristic HASH value corresponding to the sub-user is searched from the characteristic value comparison information stored locally through the identity ID or user name of the sub-user.

[0056] S430: Determine whether the sub-user has access rights by verifying the user characteristic value.

[0057] For example, in some embodiments of the present application, the characteristic HASH value is parsed according to the HASH parsing algorithm corresponding to the HASH algorithm when calculating the characteristic HASH value until it is parsed into a data block array (i.e., data blocks 0 to N). If a check mismatch occurs during the parsing or the data block does not exist, an exception message is returned, which indicates that the sub-user does not have access rights. If the parsing is successful, indicating that the sub-user has access rights, the sub-user is allowed to access, and based on this, the sub-user is allowed to access various objects (e.g., file data) and perform related storage operations.

[0058] In some embodiments of the present application, when the access rights of a sub-user change, the user rights management method further includes: receiving an updated characteristic value sent by the server, wherein the updated characteristic value is recalculated by the server after updating the access rights information.

[0059] For example, in some embodiments of the present application, the client 100 may receive a new characteristic HASH value regenerated by the server 200 when the main user modifies the permissions of the sub-user, so as to facilitate the subsequent effective verification of the sub-user.

[0060] The following is combined with Figure 5 The specific process of user rights management provided by some embodiments of the present application is exemplified.

[0061] Please see attached Figure 5 , Figure 5 A flow chart of a method for user rights management provided for some embodiments of the present application.

[0062] The above process is explained below as an example.

[0063] S510, the server 200 obtains each sub-user associated with the main user from the main user access control list.

[0064] S520, the server 200 divides each sub-user character string into multiple data blocks.

[0065] S530, the server 200 generates a binary tree structure based on the calculation results of each sub-data block in the multiple data blocks, and determines the characteristic value of each sub-user.

[0066] S540 , the server 200 sends each sub-user characteristic value to the client 100 .

[0067] S550, the client 100 confirms that the sub-user corresponding to the received login request is one of the sub-users in the master user access control list.

[0068] S560: The client 100 obtains a sub-user characteristic value corresponding to the sub-user.

[0069] S570: The client 100 verifies the user characteristic value to determine whether the sub-user has access rights.

[0070] It can be understood that the specific implementation process of S510~S570 can refer to the method embodiment provided above. To avoid repetition, the detailed description is appropriately omitted here.

[0071] Through some of the above embodiments of the present application, it can be seen that the present application realizes the refined management of sub-users without affecting the object storage pool, storage bucket, and object, and can customize the coexisting permission control according to the storage bucket and object information. The management process is efficient, highly consistent and tamper-proof, and it takes up little space. It has high security on the basis of backup and migration, and is an effective authentication management method.

[0072] Please refer to Figure 6 , Figure 6 The following is a block diagram of the composition of the user rights management device provided by some embodiments of the present application. It should be understood that the user rights management device corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the user rights management device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0073] Figure 6 The user rights management device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the user rights management device. The user rights management device is applied to a server, and includes: an acquisition module 610, used to acquire at least one sub-user associated with a main user from a main user access control list; a generation module 620, used to generate sub-user character strings corresponding to each sub-user in the at least one sub-user, wherein each sub-user character string includes identity information and access permission information of each sub-user; a calculation module 630, used to calculate each sub-user character string to obtain each sub-user characteristic value; and a sending module 640, used to send each sub-user characteristic value to a client, so that when each sub-user logs in to the client, by verifying each sub-user characteristic value, it is determined whether each sub-user has access permission.

[0074] Please refer to Figure 7 , Figure 7 The following is a block diagram of the composition of the user rights management device provided by some embodiments of the present application. It should be understood that the user rights management device corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the user rights management device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0075] Figure 7 The user rights management device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the user rights management device. The user rights management device is applied to a client and includes: a receiving module 710, used to confirm that the sub-user corresponding to the received login request is one of the main user access control list; a feature acquisition module 720, used to obtain a sub-user feature value corresponding to the sub-user, wherein the sub-user feature value is calculated by the server for the user character string corresponding to the sub-user, and the user character string includes: the identity information and access permission information of the sub-user; a verification module 730, used to determine whether the sub-user has access permission by verifying the user feature value.

[0076] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0077] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0078] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0079] like Figure 8 As shown, some embodiments of the present application provide an electronic device 800, which includes: a memory 810, a processor 820, and a computer program stored in the memory 810 and executable on the processor 820, wherein the processor 820 can implement a method as described in any of the above embodiments when reading the program from the memory 810 through a bus 830 and executing the program.

[0080] Processor 820 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 820 can be a microprocessor.

[0081] The memory 810 may be used to store instructions executed by the processor 820 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 820 of the disclosed embodiment may be used to execute instructions in the memory 810 to implement the method shown above. The memory 810 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0082] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0083] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0084] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for user rights management, characterized in that: Applied to the server, including: Obtain at least one sub-user associated with the main user from the main user access control list; Generate each sub-user character string corresponding to each sub-user of the at least one sub-user, wherein each sub-user character string includes identity information and access permission information of each sub-user; Calculating each sub-user character string to obtain a characteristic value of each sub-user; Sending each sub-user characteristic value to the client, so that when each sub-user logs into the client, by verifying each sub-user characteristic value, it is determined whether each sub-user has access rights; The calculating each sub-user character string to obtain each sub-user characteristic value includes: Segmenting the sub-user character strings to obtain a plurality of data blocks; generating a binary tree structure based on the calculation results of each sub-data block in the plurality of data blocks, and determining the characteristic values ​​of each sub-user; When the access rights of any of the at least one sub-user change, the method further includes: parsing the sub-user characteristic value corresponding to the any sub-user to obtain the access right information; updating the access right information to regenerate an updated character string corresponding to the any sub-user; calculating the updated character string to obtain an updated characteristic value, and sending the updated characteristic value to the client.

2. A method for user rights management, characterized in that: Applied to the client, including: Confirm that the sub-user corresponding to the received login request is one of the sub-users in the master user access control list; Obtaining a sub-user characteristic value corresponding to the sub-user, wherein the sub-user characteristic value is determined by dividing each sub-user character string corresponding to the sub-user by the server to obtain multiple data blocks; generating a binary tree structure based on the result of calculating each sub-data block in the multiple data blocks, and the user character string includes: identity information and access permission information of the sub-user; Determining whether the sub-user has access rights by verifying the user characteristic value; When the access rights of the sub-user change, the method further includes: receiving an updated characteristic value sent by the server, wherein the updated characteristic value is recalculated by the server after updating the access rights information.

3. A user rights management device, characterized in that: Applied to a server, the device is used to execute the method according to claim 1, comprising: An acquisition module, used to acquire at least one sub-user associated with the main user from the main user access control list; A generating module, configured to generate each sub-user character string corresponding to each sub-user of the at least one sub-user, wherein each sub-user character string includes identity information and access permission information of each sub-user; A calculation module, used to calculate the sub-user character strings to obtain the characteristic values ​​of the sub-users; The sending module is used to send the characteristic values ​​of each sub-user to the client, so that when each sub-user logs into the client, it is determined whether each sub-user has access rights by verifying the characteristic values ​​of each sub-user.

4. A user rights management device, characterized in that: Applied to a client, the device is used to execute the method according to claim 2, comprising: A receiving module, used for confirming that the sub-user corresponding to the received login request is one of the sub-users in the master user access control list; A feature acquisition module, used to acquire a sub-user feature value corresponding to the sub-user, wherein the sub-user feature value is obtained by calculating a user string corresponding to the sub-user by the server, and the user string includes: identity information and access permission information of the sub-user; The verification module is used to determine whether the sub-user has access rights by verifying the user characteristic value.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 2 when executed by a processor.

6. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 2 when being run by the processor.

7. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 2 when executed by a processor.

Images