A rights management system, method, device, medium and program product

Abstract

This disclosure provides a permission management system applicable to the field of information security technology. The system includes: a resource management subsystem, which provides a first operation and maintenance interface to an enterprise for receiving and managing the enterprise's user information, organizational structure information, and resource items. The organizational structure information is used to determine the permission scope of a user's organizational structure, and the resource items include various attributes associated with users and permissions; and a kernel system, which interconnects with the resource management subsystem for providing and maintaining a permission management policy library. In response to an administrator selecting a permission management policy, the kernel system combines the user information, organizational structure information, and resource items based on the permission management policy to grant permissions to users and manage the roles of the granted users. This disclosure also provides a permission management method, device, storage medium, and program product.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, specifically to an access control system, method, device, medium, and program product. Background Technology

[0002] Enterprise IT systems play a crucial role in modern enterprise management, primarily used to improve work efficiency, reduce costs, optimize decision-making, enhance information security, and improve user experience. Among these systems, the user role and access control system is paramount, controlling user access permissions and directly impacting the security of the enterprise and all its other IT systems.

[0003] Typical enterprise user role-based access control (RBAC) systems are designed and implemented based on the RBAC access control model, primarily comprising three major functional modules: user management, role management, and access control. However, due to differences in organizational structure, size, and characteristics among enterprises, their user and organizational types and attributes vary, leading to differences in the scope and composition of permissions that their access control systems need to manage. Consequently, the user permission change approval processes differ between enterprise access control systems. When developing access control systems for different enterprises, IT departments or IT companies need to redesign and develop different systems suitable for their specific needs, taking into account these varying factors, which is time-consuming and labor-intensive. Summary of the Invention

[0004] In view of the above problems, this disclosure provides improved access control systems, methods, devices, media and program products.

[0005] According to a first aspect of this disclosure, a permission management system is provided, the system comprising: a resource management subsystem, which provides a first operation and maintenance interface to an enterprise for receiving and managing user information, organizational structure information, and resource items of the enterprise, wherein the organizational structure information is used to determine the permission scope of the organizational structure to which a user belongs, and the resource items include multiple attributes associated with the user and permissions; and a kernel system, which interconnects with the resource management subsystem for providing and maintaining a permission management policy library, and in response to an administrator selecting a permission management policy, granting permissions to users based on the permission management policy by combining the user information, the organizational structure information, and the resource items, and performing role management on the authorized users.

[0006] According to an embodiment of this disclosure, the kernel system includes: a role management module, used to generate and maintain multiple permission roles based on the organizational structure information, wherein different permission roles represent the user's position in the organizational structure; a user role management module, used to maintain the permission scope and permission roles of the authorized users; and a policy engine module, used to combine the user information, the organizational structure information, and the resource items according to the permission management policy selected by the administrator to derive the user's permission scope and permission roles, associate the user's permission scope and permission roles, and output them to the user role management module.

[0007] According to an embodiment of this disclosure, the kernel system includes: a permission management policy library, which includes multiple permission management policies, wherein the permission management policy is a policy expression; and a policy management module, which is connected to the permission management policy library and is used to provide a second operation and maintenance interface for the administrator to maintain the permission management policies in the permission management policy library.

[0008] According to an embodiment of this disclosure, the kernel system includes: an element loading module connected to the resource management subsystem, used to obtain and update the user information, the organizational structure information and the resource items from the resource management subsystem in real time, provide the latest user information, the organizational structure information and the resource items to the policy engine module, and update the user's permissions.

[0009] According to an embodiment of this disclosure, the kernel system includes: an authentication module that provides an authentication service interface for receiving authentication requests through the authentication service interface, responding to the authentication requests, and obtaining and outputting the permission scope and permission role of the user for whom the authentication request requires authentication.

[0010] According to an embodiment of this disclosure, the resource management subsystem includes: a user management module for maintaining user information, the user information including the organizational structure to which the user belongs; an organization management module for maintaining organizational structure information; and a resource item management module for maintaining various attribute information associated with users and permissions, the attribute information including resource item name, application to which the resource item belongs, resource item description, resource item permission level, and parent resource item.

[0011] The second aspect of this disclosure provides a permission management method applied to a permission management system as described in any of the first aspects. The method includes: opening a first operation and maintenance interface of a resource management subsystem to an enterprise; receiving and managing user information, organizational structure information, and resource items of the enterprise based on the first operation and maintenance interface; wherein the organizational structure information is used to determine the permission scope of the organizational structure to which a user belongs; and the resource items include multiple attributes associated with the user and permissions; transmitting the user information, organizational structure information, and resource items to a kernel system; wherein the kernel system provides and maintains a permission management policy library; and in response to an administrator selecting a permission management policy through the kernel system, combining the user information, organizational structure information, and resource items based on the permission management policy to grant permissions to the user, and performing role management on the granted user.

[0012] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the aforementioned access control system.

[0013] A fourth aspect of this disclosure also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the aforementioned access control system.

[0014] The fifth aspect of this disclosure also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the aforementioned access control system. Attached Figure Description

[0015] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0016] Figure 1 This diagram illustrates an application scenario of a permission management system according to an embodiment of the present disclosure.

[0017] Figure 2 This schematic diagram illustrates the structure of a permission management system according to an embodiment of the present disclosure;

[0018] Figure 3 This schematic diagram illustrates the overall structure of the access control system according to an embodiment of the present disclosure;

[0019] Figure 4 This illustration schematically shows an application diagram of a permission management system according to an embodiment of the present disclosure;

[0020] Figure 5 A flowchart illustrating a permission management method according to an embodiment of this disclosure is shown schematically; and

[0021] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a permission management system according to an embodiment of the present disclosure. Detailed Implementation

[0022] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0024] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0025] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0026] Terminology Explanation:

[0027] RBAC, or Role-Based Access Control, can be simply understood as allowing a subject to access an object if it possesses a certain role.

[0028] PBAC, Policy-Based Access Control, can be simply understood as allowing a subject to access an object if it meets certain policy requirements.

[0029] In this article, "subject" refers to the user of the operating system.

[0030] In this article, "object" refers to the system resources to be operated on or accessed. System resources in this article include menus, button controls, etc.

[0031] Resource items, in this article, are objects;

[0032] A strategy describes how an object is accessed and consists of multiple elements.

[0033] Elements are components of a strategy and are generally user attributes or extended attributes, such as user ID, user type, and the organizational level to which the user belongs.

[0034] In the access control model, a role is a collection of system resources that one or a group of users can operate within an organization. In enterprise activities, roles embody the division of labor and can be understood as the special attributes of employees, as well as a type of information element.

[0035] Figure 1 The illustration shows an application scenario diagram of the permission management system according to an embodiment of the present disclosure.

[0036] like Figure 1 As shown, a typical enterprise user role and access control system is designed and implemented based on the RBAC access control model, mainly including three major functional modules: user management, role management, and access control. The user management module manages basic user information and user organization information; the role management module manages role information, job role information, and role group information; and the access control module manages access control information and user access control information.

[0037] exist Figure 1 In the application scenarios shown, different enterprises have different organizational structures, sizes, and characteristics, resulting in differences in user, organizational types, and attributes. This leads to variations in the scope and composition of permissions that their access control systems need to manage, as well as different user permission change approval processes. When IT departments or IT companies develop access control systems for different enterprises, they need to redesign and develop different systems suitable for the current enterprise based on these different factors. Designing and developing different access control systems according to the enterprise's current situation, goals, and requirements is costly, time-consuming, and risky. Generally, access control systems designed and developed using the RBAC (Role-Based Access Control) model can only authorize users based on their roles, lacking flexibility and fine-grained control. Furthermore, if role responsibilities change, permission configurations need to be manually modified, requiring significant work and time, which is time-consuming and labor-intensive.

[0038] Embodiments of this disclosure provide a permission management system, comprising: a resource management subsystem, which provides a first operation and maintenance interface to the enterprise for receiving and managing the enterprise's user information, organizational structure information, and resource items. The organizational structure information is used to determine the permission scope of the organizational structure to which a user belongs, and the resource items include various attributes associated with the user and permissions; and a kernel system, which communicates with the resource management subsystem for providing and maintaining a permission management policy library. In response to the administrator selecting a permission management policy, the kernel system combines user information, organizational structure information, and resource items based on the permission management policy to grant permissions to users and manage the roles of the granted users.

[0039] The access control system provided in this disclosure is a kernel-extension-based access control system. It combines the common, unchanging functions of various enterprise access control systems with the core functions of an RBAC policy-based access control model to form a kernel system. It also incorporates the different functions that may require customization from different enterprises into an extensional resource subsystem. The kernel system and the resource management subsystem together constitute the access control system. When enterprise requirements are low and no additional customization is needed, the kernel system can be used directly as the access control system. Only user, organization, and resource item data need to be synchronously imported to automatically trigger policy calculations, thereby implementing access control changes. If the access control of a resource item changes, only the resource item's access policy needs to be adjusted.

[0040] The acquisition, transmission, storage, use, and processing of data in this disclosed technical solution all comply with the relevant provisions of national laws and regulations.

[0041] It should be noted that in the embodiments disclosed herein, certain software, components, models, and other existing solutions in the industry may be mentioned. These should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solutions disclosed herein. However, it does not mean that the discloser has used or necessarily used such solutions.

[0042] The following will be based on Figure 1 The described scene, through Figures 2-4 The permission management system of the disclosed embodiments will be described in detail.

[0043] Figure 2 The diagram illustrates the structure of a permission management system according to an embodiment of the present disclosure.

[0044] like Figure 2 As shown, the permission management system in this embodiment includes a resource management subsystem 210 and a kernel system 220.

[0045] The resource management subsystem 210 provides the enterprise with the first operation and maintenance interface, which is used to receive and manage the enterprise's user information, organizational structure information and resource items. The organizational structure information is used to determine the scope of permissions of the organizational structure to which the user belongs, and the resource items include various attributes associated with the user and permissions.

[0046] The kernel system 220 communicates with the resource management subsystem 210 to provide and maintain a permission management policy library. In response to the administrator's selection of a permission management policy, the kernel system combines user information, organizational structure information and resource items based on the permission management policy to grant permissions to users and manage the roles of the granted users.

[0047] The kernel system 220 provides standard PBAC-based access control capabilities, while the extended resource management subsystem is expanded according to specific enterprise requirements. Resource item access policies consist of various elements, no longer limited to roles; they can include basic user attributes, extended attributes, and virtually any structured information about a person as part of access control, making control highly flexible. The system can automatically trigger policy calculations to implement access control changes; if a resource item's access control changes, only the resource item's access policy needs to be adjusted. In short, the entire access control process is very simple and clear.

[0048] In some embodiments, the resource management subsystem can be simplified and omitted, and only the kernel system can be deployed, which then interfaces with other enterprise IT systems. This can significantly reduce implementation costs and improve delivery quality.

[0049] Figure 3 The diagram illustrates the overall structure of the access control system according to an embodiment of the present disclosure.

[0050] like Figure 3 As shown in this embodiment, the resource management subsystem includes a user management module, an organization management module, and a resource item management module.

[0051] The user management module is used to maintain user information, which mainly includes various attributes such as user ID, user name, job title, mobile phone number, email address, ID card number, organization ID, organization name, organization level, and organizational structure information.

[0052] The organization management module is used to maintain organizational structure information.

[0053] The resource item management module is used to maintain various attribute information associated with users and permissions. The attribute information includes resource item name, application to which the resource item belongs, resource item description, resource item permission level, and parent resource item.

[0054] The access strategy for resource items consists of various elements, no longer limited to roles. It can be the user's basic attributes and extended attributes. In other words, any structured information about a person can be used as an element as part of the access control, making the control very flexible.

[0055] Furthermore, the resource management subsystem may also include an element unloading module. In this embodiment, the resource management subsystem can obtain user, organization, and resource item data from the database through the element unloading module, assemble and package them into element files in a unified format, and share them with the kernel system. Although both the kernel system and the resource management subsystem contain user information, organization information, and resource item information, the element unloading module only unloads the attributes required by the strategy engine to describe the strategy. Only these attributes are called elements, and only these attribute fields are stored in the core system.

[0056] It should be noted that user, organization, and resource data are the core input data of the access control system. However, because their data structure, data item definition, data volume, and data relationships vary greatly from enterprise to enterprise, the possibility of customized design and development is very high. In addition, this part of the data can also be maintained by the enterprise's various IT systems and then loaded through the element loading module of the kernel system. In this case, all the above modules can be omitted and are only optional functional modules of the access control system.

[0057] As shown in Figure 3, the kernel system 220 includes a role management module, a user role management module, and a policy engine module.

[0058] The role management module is used to generate and maintain various permission roles based on organizational structure information. Different permission roles represent the user's position in the organizational structure.

[0059] In this embodiment, roles generally represent the division of labor within an enterprise, serving as a standard authorization carrier. The role management module primarily manages attributes such as role number, role name, responsible department, role countersigning rules, application or application domain to which the role belongs, and role description.

[0060] The user role management module is used to maintain the scope of permissions and roles of authorized users.

[0061] In this embodiment, the user role management module primarily manages the roles owned by users, including operations such as adding, deleting, modifying, and querying. User role management is generally referred to as user authorization.

[0062] The strategy engine module combines user information, organizational structure information, and resource items based on the permission management policy selected by the administrator to derive the user's permission scope and permission role, associates the user's permission scope and permission role, and outputs it to the user role management module.

[0063] Kernel system 220 also includes a permission management policy library and a policy management module.

[0064] The permission management policy library includes a variety of permission management policies, which are policy expressions.

[0065] The policy management module connects to the permission management policy library, providing administrators with a second operation and maintenance interface to maintain the permission management policies within the library.

[0066] In this embodiment, the policy management module primarily maintains the access policies for resource items. A policy is a complex logical expression composed of various elements, among which roles are a crucial one. This function mainly provides users with a convenient and quick way to assemble structured elements into policy expressions using different association operators, thus providing rules for the policy engine to calculate user permissions. For different enterprises, provided the overall architecture of the permission management system remains unchanged, when the access control of enterprise resource items changes, only the resource item access policies need to be adjusted.

[0067] Kernel system 220 also includes a feature loading module.

[0068] The element loading module connects to the resource management subsystem and is used to obtain and update user information, organizational structure information and resource items in real time from the resource management subsystem. It provides the strategy engine module with the latest user information, organizational structure information and resource items to update user permissions.

[0069] Elements are generally user attributes or extended attributes, such as user ID, user type, and the user's organizational level. This functional module mainly synchronizes elements from the resource management subsystem to provide input for the strategy engine to calculate user permissions.

[0070] Kernel system 220 also includes a kernel system authentication module.

[0071] The authentication module provides an authentication service interface for enterprise users, which is used to receive authentication requests, respond to authentication requests, and obtain and output the scope of permissions and roles of the user requested for authentication.

[0072] The authentication module is a standard permission, user, and organization data service provided by the kernel system. It is the core output of the permission system and mainly provides authentication services for other IT systems in the enterprise.

[0073] In addition, the kernel system 200 may also include a process engine, providing powerful process functions for role management, user role management, and policy management, primarily supporting features such as dynamic process configuration and process countersigning. It also provides basic management functions such as process querying and process maintenance.

[0074] Figure 4 The illustration shows an application diagram of the permission management system according to an embodiment of the present disclosure.

[0075] like Figure 4 As shown, the application process of the permission management system provided in this embodiment mainly includes:

[0076] The first part, the extended system (i.e., the resource management subsystem), maintains user, organization, and resource item data through relevant functional modules;

[0077] In the second part, the extension system shares user, organization, and resource item data files with the kernel system through the element unloading module;

[0078] The third part involves the kernel system maintaining role, user role, and policy data through relevant functional modules.

[0079] The fourth part is that the kernel system feature loading module obtains features and other information from the shared feature files of the extended system, the synchronized feature files of other IT systems, and the kernel system database, processes this information into feature structured data according to the feature control rules, and sends it to the cache.

[0080] In the fifth part, the strategy engine retrieves the subject (user information), object (resource item information), element information (user basic attributes, extended attributes, user's affiliated organization information, organization extended attributes), and strategy information from the cache, and then calculates the objects that the subject can access, that is, the resource items that the user can access.

[0081] According to the access control system provided in this disclosure, the access policy for resource items is composed of various elements, which are generally composed of various attributes of a person. Therefore, when a person's attributes change, policy calculation can be automatically triggered, thereby realizing the change in access control. If the access control of a resource item changes, only the access policy of the resource item needs to be adjusted. The access control operation is very simple and clear. Based on this system, access control systems adapted to various management requirements of different enterprises can be rapidly developed iteratively. The kernel system provides standard PBAC-based access control capabilities, while the extended system is extended according to the specific requirements of the enterprise. Alternatively, the extended system can be simplified and omitted, and only the kernel system can be deployed, which then interfaces with other IT systems of the enterprise. Therefore, the implementation cost can be greatly reduced and the delivery quality improved.

[0082] According to embodiments of this disclosure, any plurality of modules in the resource management subsystem 210, kernel system 220, and their submodules can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules can be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the resource management subsystem 210, kernel system 220, and their submodules can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these. Alternatively, at least one of the resource management subsystem 210, kernel system 220, and their submodules can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0083] This disclosure also provides a permission management method, applicable to, for example... Figures 2-4 The permission management system shown.

[0084] Figure 5 A flowchart illustrating a permission management method according to an embodiment of the present disclosure is shown schematically.

[0085] like Figure 5 As shown, the permission management method provided in this disclosure includes operations S510~S530.

[0086] In operation S510, the first operation and maintenance interface of the resource management subsystem is opened to the enterprise. Based on the first operation and maintenance interface, the enterprise's user information, organizational structure information and resource items are received and managed. The organizational structure information is used to determine the permission scope of the organizational structure to which the user belongs. The resource items include various attributes associated with the user and permissions.

[0087] In operating the S520, user information, organizational structure information, and resource items are transmitted to the kernel system, which provides and maintains the permission management policy library.

[0088] In operating S530, in response to the administrator selecting a permission management policy through the kernel system, the system combines user information, organizational structure information, and resource items based on the permission management policy to grant permissions to users and then manage the roles of the granted users.

[0089] It should be noted that the permission management method provided in this disclosure has the same technical features as the permission management system described above. Therefore, the permission management method provided in this disclosure can achieve the same technical effect as the permission management system described above. Specific features will not be repeated here.

[0090] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a permission management system according to an embodiment of the present disclosure.

[0091] like Figure 6 As shown, an electronic device 600 according to an embodiment of this disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this disclosure.

[0092] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 602 and / or RAM 603. It should be noted that programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0093] According to embodiments of this disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0094] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0095] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0096] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the access control system provided by embodiments of this disclosure.

[0097] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0098] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0099] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0100] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0101] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0102] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0103] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A permission management system, characterized in that, The system includes: The resource management subsystem provides the enterprise with a primary operation and maintenance interface for receiving and managing the enterprise's user information, organizational structure information, and resource items. The organizational structure information is used to determine the permission scope of the user's organizational structure, and the resource items include various attributes associated with the user and permissions. The resource management subsystem is generated based on customized functional extensions required by the enterprise. The kernel system, which communicates with the resource management subsystem, is used to provide and maintain a permission management policy library. In response to the administrator selecting a permission management policy, it combines the user information, the organizational structure information, and the resource items based on the permission management policy to grant permissions to users and manage the roles of the authorized users. The kernel system is generated based on the enterprise permission management system in conjunction with the permission management policy. The kernel system includes: The permission management strategy library includes various permission management strategies, which are strategy expressions. The policy management module connects to the permission management policy library and is used to provide the administrator with a second operation and maintenance interface to maintain the permission management policies in the permission management policy library; the policy engine module is used to combine the user information, the organizational structure information and the resource items according to the permission management policy selected by the administrator to derive the user's permission scope and permission role. The element loading module is connected to the resource management subsystem and is used to obtain and update the user information, organizational structure information and resource items from the resource management subsystem in real time, provide the strategy engine module with the latest user information, organizational structure information and resource items, and update the user's permissions.

2. The system according to claim 1, characterized in that, The kernel system includes: The role management module is used to generate and maintain various permission roles based on the organizational structure information. Different permission roles represent the user's position in the organizational structure. The user role management module is used to maintain the permission scope and permission roles of authorized users. The strategy engine module is also used to associate the user's permission scope and permission role and output them to the user role management module.

3. The system according to claim 1 or 2, characterized in that, The kernel system includes: The authentication module provides an authentication service interface, which is used to receive authentication requests through the authentication service interface, respond to the authentication requests, obtain and output the permission scope and permission role of the user requested for authentication.

4. The system according to claim 1, characterized in that, The resource management subsystem includes: The user management module is used to maintain the user information, which includes the organizational structure to which the user belongs. The organization management module is used to maintain the organizational structure information; The resource item management module is used to maintain various attribute information associated with users and permissions. The attribute information includes resource item name, application to which the resource item belongs, resource item description, resource item permission level, and parent resource item.

5. A permission management method, applied to the permission management system as described in any one of claims 1-4, characterized in that, The method includes: The first operation and maintenance interface of the resource management subsystem is open to enterprises. Based on the first operation and maintenance interface, user information, organizational structure information and resource items of the enterprise are received and managed. The organizational structure information is used to determine the permission scope of the organizational structure to which the user belongs. The resource items include multiple attributes associated with the user and permissions. User information, organizational structure information, and resource items are transmitted to the kernel system, which provides and maintains a permission management policy library; In response to the administrator selecting a permission management policy through the kernel system, the system combines the user information, the organizational structure information, and the resource items based on the permission management policy to grant permissions to the user and then manage the role of the user after granting permissions.

6. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The feature is that the one or more processors execute the one or more computer programs to implement the access control system according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by the processor, they implement the access control system according to any one of claims 1 to 4.

8. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by the processor, they implement the access control system according to any one of claims 1 to 4.

Images