Service authority determination method and device based on RBAC model, equipment and medium
Through the business permission determination method based on the RBAC model, the problem of insufficient reliability of permission settings in the financial field is solved, centralized role management and data protection are realized, and permission management efficiency is improved.
Patent Information
- Application Number
- CN202411173787.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-23
- Publication Date
- 2024-12-13
AI Technical Summary
The traditional RBAC permission control model has problems such as lack of standards for permission splitting, difficulty in data permission empowerment, and poor user experience in the financial field, resulting in insufficient reliability of permission settings.
The business permission determination method based on the RBAC model is used to split user information, determine target function permissions and data permissions, and then determine business permissions, realize centralized role management, simplify the permission management process, and ensure that sensitive data is only visible to authorized users.
It improves the reliability of permission settings, reduces human errors and omissions, simplifies permission management, enhances data protection, and improves the management efficiency of user permissions in the financial field.
Smart Images
Figure CN119128843A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the fields of data analysis and finance, and in particular to a method, device, equipment and medium for determining business authority based on a RBAC model. Background Art
[0002] In the financial field, the permission control system is the foundation of every B-side business system and an important risk control guarantee. A good permission system needs to have two measurement criteria. On the one hand, it must be able to effectively manage permissions of each granularity to prevent risks; on the other hand, it must be flexible and convenient to manage to avoid too much duplication of work for administrators.
[0003] At present, the commonly used permission control model in the industry is the RBAC (Role-Based Access Control) model, but the traditional RBAC model has many drawbacks. For example: there is a lack of standards for permission splitting, and system designers often split permissions according to personal preferences, lacking reference basis; it is difficult to grant data permissions, and the use of the RMAC model will cause the system to generate a large number of homogeneous roles. Once changed, the configuration workload is extremely large; the user experience is poor, the system roles are complicated, and it is difficult for users to understand when applying for permissions, and it is easy to make wrong choices. Therefore, how to improve the reliability of setting permissions by establishing a permission control system in the financial field has become a technical problem that needs to be solved urgently. Summary of the invention
[0004] The present application provides a method, apparatus, device and medium for determining business permissions based on an RBAC model to improve the reliability of setting permissions.
[0005] In a first aspect, the present application provides a method for determining business authority based on an RBAC model, the method comprising:
[0006] Split user information based on the preset authority control system RBAC model to determine the target functional authority of the target user;
[0007] Determine a preset data permission isolation method according to the inherent attributes of the user information, and determine the target data permission of the target user according to the preset data permission isolation method;
[0008] The target business authority of the target user is determined according to the target functional authority and the target data authority.
[0009] In a second aspect, the present application further provides a device for determining business authority based on the RBAC model, the device comprising:
[0010] The target function authority determination module is used to split the user information based on the preset authority control system RBAC model and determine the target function authority of the target user;
[0011] A target data permission determination module, used to determine a preset data permission isolation method according to the inherent attributes of the user information, and determine the target data permission of the target user according to the preset data permission isolation method;
[0012] The target business authority determination module is used to determine the target business authority of the target user according to the target function authority and the target data authority.
[0013] In a third aspect, the present application also provides a computer device, comprising a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program and implement the business authority determination method based on the RBAC model as described above when executing the computer program.
[0014] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the business authority determination method based on the RBAC model as described above.
[0015] The present application discloses a method, device, equipment and medium for determining business permissions based on an RBAC model. The method for determining business permissions based on an RBAC model includes splitting user information based on a preset permission control system RBAC model to determine the target functional permissions of the target user; determining a preset data permission isolation method based on the inherent attributes of the user information, and determining the target data permissions of the target user based on the preset data permission isolation method; determining the target business permissions of the target user based on the target functional permissions and the target data permissions. Through the above methods, the present application implements centralized role management permissions through the RBAC model, reduces the need for setting permissions for individual users, simplifies the permission management process, and through the preset data permission isolation method, ensures that sensitive data is only visible to authorized users, enhances data protection, and reduces the possibility of human errors and omissions through automated permission allocation and management, thereby improving the reliability of setting user permissions in the financial field. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0017] Figure 1 It is a schematic flow chart of a method for determining business authority based on an RBAC model provided in an embodiment of the present application;
[0018] Figure 2 A schematic diagram of a functional authority control model of a method for determining business authority based on an RBAC model provided in an embodiment of the present application;
[0019] Figure 3 A schematic diagram of a data authority control model for a method for determining business authority based on an RBAC model provided in an embodiment of the present application;
[0020] Figure 4 A schematic block diagram of a device for determining service authority based on an RBAC model provided in an embodiment of the present application;
[0021] Figure 5 A schematic block diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0022] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0023] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.
[0024] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.
[0025] It should also be understood that the term “and / or” used in the specification and appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
[0026] The embodiments of the present application provide a method, device, equipment and medium for determining business permissions based on the RBAC model. Among them, the method for determining business permissions based on the RBAC model can be applied to a server, and the role-based centralized management permissions are realized through the RBAC model, which reduces the need for setting permissions for individual users and simplifies the permission management process. By presetting the data permission isolation method, it can ensure that sensitive data is only visible to authorized users, enhance data protection, and reduce the possibility of human errors and omissions through automated permission allocation and management, thereby improving the reliability of setting user permissions in the financial field. Among them, the server can be an independent server or a server cluster.
[0027] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.
[0028] See also Figure 1 , Figure 1 This is a schematic flow chart of a method for determining business permissions based on an RBAC model provided by an embodiment of the present application. The method for determining business permissions based on an RBAC model can be applied to a server to implement centralized role management permissions through an RBAC model, reduce the need for setting permissions for individual users, simplify the permission management process, and ensure that sensitive data is visible only to authorized users through a preset data permission isolation method, thereby enhancing data protection. Through automated permission allocation and management, the possibility of human errors and omissions is reduced, and the reliability of setting user permissions in the financial field is improved.
[0029] like Figure 1 As shown, the business authority determination method based on the RBAC model specifically includes steps S10 to S30.
[0030] Step S10: split the user information based on the preset authority control system RBAC model to determine the target function authority of the target user;
[0031] Step S20: determining a preset data permission isolation method according to the inherent attributes of the user information, and determining the target data permission of the target user according to the preset data permission isolation method;
[0032] Step S30: Determine the target business authority of the target user according to the target function authority and the target data authority.
[0033] In one embodiment, RBAC is a widely used access control model. In RBAC, permissions are not directly assigned to individual users, but to roles. Users obtain corresponding permissions by becoming members of one or more roles. This model provides a flexible and effective way to manage user access rights. Among them, the RBAC model has the following characteristics:
[0034] Role management: In RBAC, a role defines a specific set of permissions. Roles can be based on different criteria, such as job responsibilities, departments, or security requirements;
[0035] Users and roles: Users are assigned to one or more roles. The permission set of a role defines the user's access rights;
[0036] Principle of least privilege: RBAC supports the principle of least privilege, which means that users are only given the minimum set of permissions necessary to complete their tasks;
[0037] Centralized management of permissions: Role permissions can be centrally managed, simplifying the process of assigning and revoking permissions;
[0038] Flexibility and scalability: As your organization grows or user needs change, roles and their corresponding permissions can be easily added or modified;
[0039] Simplify user access control: By associating permission management with roles, the complexity of directly configuring permissions for each user can be reduced;
[0040] Improved security: Reduces security risks by limiting user access to the minimum required for their role;
[0041] Easy to audit and monitor: The RBAC model provides a clear permission and role allocation track, which facilitates security auditing and user behavior monitoring;
[0042] Support fine-grained access control: RBAC allows you to set roles and permissions at different levels as needed to achieve fine-grained access control;
[0043] Facilitates compliance: RBAC helps organizations adhere to regulatory and security standards by ensuring appropriateness and transparency of user permissions.
[0044] This embodiment divides the business permissions owned by users into two parts: functional permissions and data permissions. Functional permissions are based on the RBAC model and are designed in four ways to split permissions. Data permissions are stripped and managed, and different authorization methods are designed based on whether they are fixed rules or non-fixed rules. And for different roles, the scope of users who can apply and special approval chains are increased. The total permissions owned by a user = functional permissions owned + data permissions owned.
[0045] Function permission definition: what menus the user can see and what buttons in the menus the user can operate
[0046] Data permission definition: Users can use a certain function normally, but they can see that certain data in the menu (including enumeration values of options) are different.
[0047] The present embodiment discloses a method, device, equipment and medium for determining business permissions based on the RBAC model. The method for determining business permissions based on the RBAC model includes splitting user information based on the preset permission control system RBAC model to determine the target functional permissions of the target user; determining the preset data permission isolation method according to the inherent attributes of the user information, and determining the target data permissions of the target user according to the preset data permission isolation method; determining the target business permissions of the target user according to the target functional permissions and the target data permissions. Through the above methods, the present application implements centralized role management permissions through the RBAC model, reduces the need for setting permissions for individual users, simplifies the permission management process, and through the preset data permission isolation method, ensures that sensitive data is only visible to authorized users, enhances data protection, and reduces the possibility of human errors and omissions through automated permission allocation and management, thereby improving the reliability of setting user permissions in the financial field.
[0048] based on Figure 1 In the embodiment shown, in this embodiment, step S10 includes:
[0049] Splitting the user information based on the RBAC model to generate at least one set of user tags;
[0050] Based on each of the user tags, determining the preset function permissions corresponding to each of the user tags from a preset function permission library;
[0051] The target function permission of the target user is determined according to each of the preset function permissions.
[0052] In a specific embodiment, Figure 2 As shown, Figure 2 A schematic diagram of a functional authority control model of a business authority determination method based on an RBAC model provided in an embodiment of the present application.
[0053] The RBAC permission control system (Role-Based Access Control) is adopted as follows:
[0054] 1) A user can correspond to one or more roles;
[0055] 2) A role can correspond to one or more permissions;
[0056] 3) One permission only corresponds to one menu or some button operations within a menu.
[0057] Among them, the user corresponds to the primary user tag in this embodiment, and the role corresponds to the secondary user tag in this embodiment.
[0058] The functional permissions that a user ultimately has are the union of the permissions corresponding to the various roles that the user has.
[0059] This embodiment discloses a method, device, equipment and medium for determining business permissions based on an RBAC model. The method for determining business permissions based on an RBAC model includes splitting the user information based on the RBAC model to generate at least one group of user tags; based on each of the user tags, determining the preset function permissions corresponding to each of the user tags from a preset function permission library; determining the target function permissions of the target user according to each of the preset function permissions; determining the preset data permission isolation method according to the inherent attributes of the user information, and determining the target data permissions of the target user according to the preset data permission isolation method; determining the target business permissions of the target user according to the target function permissions and the target data permissions. In the above manner, the present application can ensure that each user obtains permissions that match their roles and responsibilities through the generation of user tags, avoiding excessive concentration or abuse of permissions. The RBAC model allows administrators to quickly identify and assign permissions through user tags, reducing the complexity and time consumption of setting permissions for individual users. In addition, by limiting users to access only the resources required for their roles, the RBAC model helps reduce the risk of internal threats and data leakage, and improves the reliability of setting user permissions in the financial field.
[0060] Furthermore, the user information is split based on the RBAC model to generate at least one set of user tags, including:
[0061] Extracting at least one tag keyword from the user information through the RBAC model;
[0062] Each of the tag keywords is classified based on a preset tag classification rule to generate a classification result, and the primary user tag and / or the secondary user tag of the user information is determined according to the classification result.
[0063] In a specific embodiment, Figure 2 As shown, this embodiment adopts four types of permission splitting methods, so that permissions can be controlled according to different granularities, as follows:
[0064] 1) View permissions: such as search, view, etc., and also copy, download, etc. are classified into this category;
[0065] 2) Editing permissions: such as adding, editing, deleting, terminating, etc.;
[0066] 3) Special button / data permissions: permissions for some special buttons / data;
[0067] 4) All permissions: All permissions for a certain menu.
[0068] In addition, add notes and memos for each permission.
[0069] The present embodiment discloses a method, device, equipment and medium for determining business permissions based on an RBAC model. The method for determining business permissions based on an RBAC model includes extracting at least one tag keyword from the user information through the RBAC model; classifying each of the tag keywords based on a preset tag classification rule to generate a classification result, and determining the primary user tag and / or the secondary user tag of the user information according to the classification result; determining the preset functional permissions corresponding to each of the user tags from a preset functional permission library based on each of the user tags; determining the target functional permissions of the target user according to each of the preset functional permissions; determining a preset data permission isolation method according to the inherent attributes of the user information, and determining the target data permissions of the target user according to the preset data permission isolation method; determining the target business permissions of the target user according to the target functional permissions and the target data permissions. In the above manner, the present application can customize a more precise access control policy for each user by extracting tag keywords from user information, which helps to ensure that sensitive information can only be accessed by authorized users, thereby reducing the risk of unauthorized access. By clarifying the roles and permissions of users, organizations can allocate resources more effectively, ensure that key tasks and projects receive the necessary support, reduce the complexity of manually configuring permissions, and make permission management more efficient and consistent. Users can quickly understand the scope of their permissions, reducing confusion and dissatisfaction caused by unclear permissions. At the same time, when user roles or organizational structures change, the system can quickly adjust user tags and permissions to adapt to new business needs. Through preset tag classification rules, it can ensure that the permissions between different users are clear, avoid overlapping and conflicts of permissions, and improve the reliability of setting user permissions.
[0070] based on Figure 1 In the embodiment shown, in this embodiment, step S20 includes:
[0071] Determining the user tag according to the inherent attribute;
[0072] In a case where the user tag is the primary user tag and the secondary user tag, determining that the preset data authority isolation mode is a fixed rule isolation mode;
[0073] When the user tag is the primary user tag, it is determined that the preset data permission isolation method is a non-fixed rule isolation method.
[0074] In one embodiment, Figure 3 As shown, Figure 3 A schematic diagram of a data authority control model for a method for determining business authority based on an RBAC model provided in an embodiment of the present application.
[0075] Specifically, user tags are a way of classifying users based on their inherent attributes, such as position, department, nature of work, etc. We divide user tags into primary user tags and secondary user tags.
[0076] First level user tags:
[0077] First-level user labels usually represent basic attributes of users, such as department or position. These labels are used to define basic access rights for users.
[0078] Secondary user tags:
[0079] Secondary user tags are more granular and may include a user's area of expertise, project group, or other specific attributes. These tags are used to further segment a user's access rights.
[0080] In this embodiment, the first-level user label is the user of the data authority control model, and the second-level user label is the role of the data authority control model.
[0081] When a user's tags include both primary and secondary user tags, fixed rule isolation will be used. In this way, data access permissions are based on predefined rules that specify the scope of data that different user tags can access.
[0082] When a user has only a first-level user tag, a non-fixed rule isolation method is used. This method provides greater flexibility and allows data access permissions to be adjusted according to actual conditions.
[0083] The present embodiment discloses a method, device, equipment and medium for determining business authority based on the RBAC model. The method for determining business authority based on the RBAC model includes splitting user information based on the preset authority control system RBAC model to determine the target functional authority of the target user; determining the user tag according to the inherent attribute; determining the preset data authority isolation method as a fixed rule isolation method when the user tag is the first-level user tag and the second-level user tag; determining the preset data authority isolation method as a non-fixed rule isolation method when the user tag is the first-level user tag, and determining the target data authority of the target user according to the preset data authority isolation method; determining the target business authority of the target user according to the target functional authority and the target data authority. Through the above-mentioned method, the present application realizes the centralized management of role authority through the RBAC model, reduces the demand for setting the authority of a single user, simplifies the authority management process, and can ensure that sensitive data is visible only to authorized users through the preset data authority isolation method, thereby enhancing data protection. Through automated authority allocation and management, the possibility of human errors and omissions is reduced, and the reliability of setting user authority in the financial field is improved.
[0084] Further, determining the target data permission of the target user according to the preset data permission isolation method includes:
[0085] Determining the user granularity of the target user based on the primary user tag and the secondary user tag;
[0086] Based on the granularity of each user, the target data authority is determined.
[0087] In one embodiment, fixed-rule data permissions: such as data permissions isolated by fixed attributes such as institutions, departments, and positions, are automatically isolated by the system based on the inherent attributes of the logged-in user. Five types of data permission isolation methods are used to meet different granularity control permissions:
[0088] 1) No isolation, all contents can be edited if you have the editing permission of this menu;
[0089] 2) Creator Isolation Method: Only the creator can edit this information;
[0090] 3) Organization (branch + department) isolation method: People in the same organization can edit and view each other's data;
[0091] 4) Single Administrator Isolation Law: The administrator of this row can edit the information of this row, and others have no right to edit;
[0092] 5) Module Administrator: The module administrator can edit all the information of this menu and see all the data.
[0093] The present embodiment discloses a method, device, equipment and medium for determining business permissions based on an RBAC model. The method for determining business permissions based on an RBAC model includes splitting user information based on a preset permission control system RBAC model to determine the target functional permissions of the target user; determining the user granularity of the target user based on the primary user tag and the secondary user tag; determining the target data permissions based on each of the user granularities; and determining the target business permissions of the target user based on the target functional permissions and the target data permissions. Through the above-mentioned methods, the present application implements centralized role management permissions through the RBAC model, reduces the need for setting permissions for individual users, simplifies the permission management process, and can ensure that sensitive data is only visible to authorized users through the preset data permission isolation method, thereby enhancing data protection. Through automated permission allocation and management, the possibility of human errors and omissions is reduced, and the reliability of setting user permissions in the financial field is improved.
[0094] Further, determining the target data permission of the target user according to the preset data permission isolation method includes:
[0095] Based on each of the first-level user tags, determining at least one first-level user tag combination;
[0096] The target data permissions are determined based on preset isolation rules and each combination of the first-level user tags.
[0097] In one embodiment, non-fixed rules need to support flexible configuration of data permissions to be configured on an independent configuration page. Some data permissions are not bound to roles and then given to users, but data permissions are directly related to users. This greatly reduces the number of "roles" and reduces the maintenance cost of permissions. For ease of operation, users can be assigned using a combination of dimensions: branch + department + job type + ... + employee ID.
[0098] The present embodiment discloses a method, device, equipment and medium for determining business permissions based on an RBAC model. The method for determining business permissions based on an RBAC model includes splitting user information based on a preset permission control system RBAC model to determine the target functional permissions of the target user; determining at least one first-level user tag combination based on each of the first-level user tags; determining the target data permissions based on preset isolation rules and each of the first-level user tag combinations; and determining the target business permissions of the target user based on the target functional permissions and the target data permissions. Through the above-mentioned methods, the present application implements centralized role management permissions through the RBAC model, reduces the need for setting permissions for individual users, simplifies the permission management process, and can ensure that sensitive data is only visible to authorized users through the preset data permission isolation method, thereby enhancing data protection. Through automated permission allocation and management, the possibility of human errors and omissions is reduced, and the reliability of setting user permissions in the financial field is improved.
[0099] Based on any of the above embodiments, in this embodiment, step S30 includes:
[0100] The target functional authority and the target data authority are combined to generate the target business authority.
[0101] Specifically, the total permissions a user has is equal to the union of the target functional permissions and the target data permissions. Each role can set visible departments, branches, and job types, and can set a dedicated administrator for the role, so as to ensure that each user can see the role they can apply for when applying for permissions. Each role can have an independent administrator. When a user initiates permission approval, the user can submit applications for multiple roles at the same time. Different roles are approved by the administrator, and the permissions the user has are the union of the permissions corresponding to the roles that have been approved by the administrator.
[0102] See also Figure 4 , Figure 4 The embodiment of the present application provides a schematic block diagram of a business authority determination device based on an RBAC model, wherein the business authority determination device based on an RBAC model is used to execute the aforementioned business authority determination method based on an RBAC model. The business authority determination device based on an RBAC model can be configured on a server.
[0103] like Figure 4 As shown, the service authority determination device 400 based on the RBAC model includes:
[0104] The target function authority determination module 410 is used to split the user information based on the preset authority control system RBAC model to determine the target function authority of the target user;
[0105] The target data permission determination module 420 is used to determine a preset data permission isolation mode according to the inherent attributes of the user information, and determine the target data permission of the target user according to the preset data permission isolation mode;
[0106] The target business authority determination module 430 is used to determine the target business authority of the target user according to the target function authority and the target data authority.
[0107] Furthermore, the target function authority determination module 410 includes:
[0108] A user label generating unit, configured to split the user information based on the RBAC model to generate at least one set of user labels;
[0109] A preset function permission determining unit, configured to determine, based on each of the user tags, the preset function permission corresponding to each of the user tags from a preset function permission library;
[0110] The target function permission determining unit is used to determine the target function permission of the target user according to each of the preset function permissions.
[0111] Furthermore, the user tag generating unit includes:
[0112] a tag keyword extraction subunit, configured to extract at least one tag keyword from the user information through the RBAC model;
[0113] The user tag generation subunit is used to classify each of the tag keywords based on a preset tag classification rule, generate a classification result, and determine the primary user tag and / or the secondary user tag of the user information according to the classification result.
[0114] Furthermore, the target data authority determination module 420 includes:
[0115] A user tag determination unit, configured to determine the user tag according to the inherent attribute;
[0116] A fixed rule isolation mode determining unit, configured to determine that the preset data permission isolation mode is a fixed rule isolation mode when the user tag is the primary user tag and the secondary user tag;
[0117] The non-fixed rule isolation method determination unit is used to determine that the preset data permission isolation method is a non-fixed rule isolation method when the user tag is the first-level user tag.
[0118] Furthermore, the fixed rule isolation mode determination unit includes:
[0119] A user granularity determination subunit, configured to determine the user granularity of the target user based on the primary user tag and the secondary user tag;
[0120] The first target data authority determination subunit is used to determine the target data authority based on each user granularity.
[0121] Furthermore, the non-fixed rule isolation mode determination unit includes:
[0122] A primary user label combination determining subunit, configured to determine at least one primary user label combination based on each of the primary user labels;
[0123] The second target data permission determination subunit is used to determine the target data permission based on a preset isolation rule and each combination of the first-level user tags.
[0124] Furthermore, the target business authority determination module 430 includes:
[0125] The target business authority determination unit is used to combine the target function authority and the target data authority to generate the target business authority.
[0126] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and each module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0127] The above-mentioned device can be implemented in the form of a computer program. Figure 5 Runs on the computer device shown.
[0128] See also Figure 5 , Figure 5 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device may be a server.
[0129] See also Figure 5 The computer device includes a processor, a memory and a network interface connected through a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.
[0130] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any one of the service authority determination methods based on the RBAC model.
[0131] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.
[0132] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any business authority determination method based on the RBAC model.
[0133] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0134] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
[0135] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:
[0136] Split user information based on the preset authority control system RBAC model to determine the target functional authority of the target user;
[0137] Determine a preset data permission isolation method according to the inherent attributes of the user information, and determine the target data permission of the target user according to the preset data permission isolation method;
[0138] The target business authority of the target user is determined according to the target functional authority and the target data authority.
[0139] In one embodiment, user information is split based on a preset authority control system RBAC model to determine the target functional authority of the target user, so as to achieve:
[0140] Splitting the user information based on the RBAC model to generate at least one set of user tags;
[0141] Based on each of the user tags, determining the preset function permissions corresponding to each of the user tags from a preset function permission library;
[0142] The target function permission of the target user is determined according to each of the preset function permissions.
[0143] In one embodiment, the user tag includes a primary user tag and a secondary user tag, and the user information is split based on the RBAC model to generate at least one group of user tags for achieving:
[0144] Extracting at least one tag keyword from the user information through the RBAC model;
[0145] Each of the tag keywords is classified based on a preset tag classification rule to generate a classification result, and the primary user tag and / or the secondary user tag of the user information is determined according to the classification result.
[0146] In one embodiment, a preset data permission isolation mode is determined based on the inherent attributes of the user information to achieve:
[0147] Determining the user tag according to the inherent attribute;
[0148] In a case where the user tag is the primary user tag and the secondary user tag, determining that the preset data authority isolation mode is a fixed rule isolation mode;
[0149] When the user tag is the primary user tag, it is determined that the preset data permission isolation method is a non-fixed rule isolation method.
[0150] In one embodiment, the target data permission of the target user is determined according to the preset data permission isolation mode to achieve:
[0151] Determining the user granularity of the target user based on the primary user tag and the secondary user tag;
[0152] Based on the granularity of each user, the target data authority is determined.
[0153] In one embodiment, the target data permission of the target user is determined according to the preset data permission isolation mode to achieve:
[0154] Based on each of the first-level user tags, determining at least one first-level user tag combination;
[0155] The target data permissions are determined based on preset isolation rules and each combination of the first-level user tags.
[0156] In one embodiment, the target business authority of the target user is determined according to the target function authority and the target data authority, so as to achieve:
[0157] The target functional authority and the target data authority are combined to generate the target business authority.
[0158] A computer-readable storage medium is also provided in an embodiment of the present application, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and the processor executes the program instructions to implement any one of the business authority determination methods based on the RBAC model provided in the embodiments of the present application.
[0159] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (Smart Medi a Card, SMC), a secure digital (Secure Digital, SD) card, a flash memory card (Flash Card), etc., equipped on the computer device.
[0160] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.
Claims
1. A method for determining business authority based on the RBAC model, characterized in that: include: Split user information based on the preset authority control system RBAC model to determine the target functional authority of the target user; Determine a preset data permission isolation method according to the inherent attributes of the user information, and determine the target data permission of the target user according to the preset data permission isolation method; The target business authority of the target user is determined according to the target functional authority and the target data authority.
2. The method for determining business authority based on the RBAC model according to claim 1, characterized in that: The user information is split based on the preset authority control system RBAC model to determine the target functional authority of the target user, including: Splitting the user information based on the RBAC model to generate at least one set of user tags; Based on each of the user tags, determining the preset function permissions corresponding to each of the user tags from a preset function permission library; The target function permission of the target user is determined according to each of the preset function permissions.
3. The method for determining business authority based on the RBAC model according to claim 2 is characterized in that: The user tag includes a primary user tag and a secondary user tag, and the user information is split based on the RBAC model to generate at least one group of user tags, including: Extracting at least one tag keyword from the user information through the RBAC model; Each of the tag keywords is classified based on a preset tag classification rule to generate a classification result, and the primary user tag and / or the secondary user tag of the user information is determined according to the classification result.
4. The method for determining business authority based on the RBAC model according to claim 1, characterized in that: The user tag includes a primary user tag and a secondary user tag, and the preset data permission isolation mode is determined according to the inherent attributes of the user information, including: Determining the user tag according to the inherent attribute; In a case where the user tag is the primary user tag and the secondary user tag, determining that the preset data authority isolation mode is a fixed rule isolation mode; When the user tag is the primary user tag, it is determined that the preset data permission isolation method is a non-fixed rule isolation method.
5. The method for determining business authority based on the RBAC model according to claim 4 is characterized in that: The user tag is the primary user tag and the secondary user tag, and the determining the target data permission of the target user according to the preset data permission isolation method includes: Determining the user granularity of the target user based on the primary user tag and the secondary user tag; Based on the granularity of each user, the target data authority is determined.
6. The method for determining business authority based on the RBAC model according to claim 4 is characterized in that: The user tag is the primary user tag, and determining the target data permission of the target user according to the preset data permission isolation method includes: Based on each of the first-level user tags, determining at least one first-level user tag combination; The target data permissions are determined based on preset isolation rules and each combination of the first-level user tags.
7. The method for determining business authority based on the RBAC model according to any one of claims 1 to 6, characterized in that: The determining the target business authority of the target user according to the target function authority and the target data authority includes: The target functional authority and the target data authority are combined to generate the target business authority.
8. A device for determining business authority based on RBAC model, characterized in that: include: The target function authority determination module is used to split the user information based on the preset authority control system RBAC model and determine the target function authority of the target user; A target data permission determination module, used to determine a preset data permission isolation method according to the inherent attributes of the user information, and determine the target data permission of the target user according to the preset data permission isolation method; The target business authority determination module is used to determine the target business authority of the target user according to the target function authority and the target data authority.
9. A computer device, characterized in that: The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is used to execute the computer program and implement the service authority determination method based on the RBAC model according to any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the service authority determination method based on the RBAC model according to any one of claims 1 to 7.