User authority management method and device, electronic equipment and medium

Abstract

The embodiment of the invention discloses a user authority management method and device, electronic equipment and a medium. The user authority management method comprises the following steps: receiving a first user request; filtering the first user request to obtain a filtered first user request, the filtered first user request carrying a legal mark; acquiring a user name corresponding to the legal mark based on the second user request; determining a role of the user and a permission corresponding to the role according to the user name; custom annotation is carried out in methods needing to be called by different controllers of the MVC architecture, and a value is added into the custom annotation to identify a permission field; in the aspect of the aspect-oriented programming, acquiring authority information by searching an annotated method; and based on the authority corresponding to the role and the authority information, accessing the authority resource information required in different controllers through authority control. According to the embodiment of the invention, the user authority management efficiency is improved, and later maintenance is easy.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of information technology, and specifically to a user authority management method, device, electronic device, and medium. Background Art

[0002] In the field of information technology, the user rights management system is generally to pass information such as username, password, and role status from the user end to the controller layer, and then the controller layer verifies the role information. Different roles make the controller layer's response correspond to different services and views. In the permission system, all requests can be filtered by adding filters. This method can be achieved by maintaining the Uniform Resource Identifier (URI) of all requests in the database. However, not all URIs need to be intercepted. The interception rules need to add whitelists, login requests should not be intercepted, static resources should not be intercepted, etc. Due to the lack of a unified interception standard, the intercepted URI granularity is too fine, and there are defects such as the inability to unify the resource level and the increased workload. In addition, security and authorization forms need to be implemented by themselves, resulting in low efficiency in user rights management and difficulty in subsequent maintenance. Summary of the invention

[0003] The embodiments of this specification provide a user rights management method, device, electronic device and medium, and the technical solutions are as follows: In a first aspect, an embodiment of the present specification provides a user authority management method, comprising: receiving a first user request; filtering the first user request to obtain a filtered first user request, wherein the filtered first user request carries a legal mark; based on a second user request, obtaining a user name corresponding to the legal mark, wherein the second user request is a user login request received just before the first user request is received; determining the user's role and the authority corresponding to the role according to the user name; based on the MVC architecture, performing custom annotations in methods required to be called by different controllers of the MVC architecture, adding a value to the custom annotation to identify the authority field, and the authority field is used to control the authority resource information required in the controller; in an aspect of aspect-oriented programming, obtaining authority information by searching for annotated methods; the authority information is the authority identifier corresponding to when the controller accesses the annotated method; based on the authority corresponding to the role and the authority information, accessing the authority resource information required in different controllers through authority control to complete authority management of various resources.

[0004] In a second aspect, an embodiment of the present specification provides a user authority management device, comprising: a request receiving module, for receiving a first user request; a filtering module, for filtering the first user request to obtain a filtered first user request, wherein the filtered first user request carries a legal mark; a user name acquisition module, for obtaining a user name corresponding to the legal mark based on a second user request, wherein the second user request is a user login request received at a moment before the first user request is received; a permission determination module, for determining a user role and the authority corresponding to the role according to the user name; an annotation module, for performing custom annotations in methods required to be called by different controllers of the MVC architecture based on the MVC architecture, adding a value to the custom annotation to identify the authority field, wherein the authority field is used to control the authority resource information required in the controller; an information acquisition module, for obtaining authority information by searching for annotated methods in an aspect of aspect-oriented programming; the authority information is the authority identifier corresponding to when the controller accesses the annotated method; a authority management module, for accessing the authority resource information required in different controllers through authority control based on the authority and authority information corresponding to the role, so as to complete the authority management of various resources.

[0005] In a third aspect, an embodiment of the present specification provides an electronic device, comprising a processor and a memory; the processor is connected to the memory; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the steps of the user authority management method of the first aspect of the above embodiment.

[0006] In a fourth aspect, an embodiment of this specification provides a computer storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the steps of the user authority management method of the first aspect of the above embodiment.

[0007] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least: It can first receive a first user request; then filter the first user request to obtain the filtered first user request, and the filtered first user request carries a legal mark; then obtain the user name corresponding to the legal mark based on the second user request; then determine the user's role and the authority corresponding to the role according to the user name; then perform custom annotations in the methods required to be called by different controllers in the MVC architecture, and authenticate the authority corresponding to the role based on aspect-oriented programming. The embodiment of this specification uses annotations and aspect-oriented programming aspects. When the authority corresponding to the role has the authority information declared in the annotation, based on the authority information, the authority resource information required in different controllers is accessed through authority control, that is, the embodiment of this specification uses annotations and aspect-oriented programming to identify and control the authority requirements of various resources, so as to achieve a mode in which different users correspond to different roles, and different roles correspond to different resource authorities, establish a corresponding relationship between users, roles and resources, and realize a flexible authority management mode, further realize the refined authority management of various resources, and improve the efficiency of user authority management. The embodiments of this specification are easy to use and efficient. When authorizing a user, you only need to authorize the role and then assign the corresponding role to the user. In addition, the embodiments of this specification are easy to maintain, expand, and maintain in the later stage, and the user authority management is efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions in the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0009] Figure 1 This is a schematic diagram of an application scenario of a user rights management system provided in this manual.

[0010] Figure 2 It is a flowchart of a user rights management method provided in this manual.

[0011] Figure 3 It is a timing flow chart based on the user rights management device provided in this manual.

[0012] Figure 4 This is a schematic diagram of the structure of an electronic device provided in this manual. DETAILED DESCRIPTION

[0013] The technical solutions in the embodiments of this specification will be described clearly and completely below in conjunction with the drawings in the embodiments of this specification.

[0014] The terms "first", "second", etc. in the description and claims of this specification and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any variation thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices.

[0015] The user rights management method provided in multiple embodiments of this specification can be executed by the user rights management device provided in the embodiment of the present invention, or a server integrated with the user rights management device, wherein the user rights management device can be implemented in hardware or software.

[0016] Before the user rights management method is described in detail in conjunction with one or more embodiments, the present specification first introduces the application scenarios of the user rights management method.

[0017] See also Figure 1 , Figure 1 The schematic diagram of the scenario of the user rights management system 100 provided in the embodiment of the present invention is as follows. The user rights management system 100 may include a user rights management device 110 and a user terminal 120, etc. Among them, the user terminal 120 may be a terminal based on an Android system or a terminal based on an IOS system, or may be a PC based on a Windows system or a MAC system, etc. The user terminal 120 and the user rights management device 110 may be connected via a communication network, and the communication network includes a wireless network and a wired network, wherein the wireless network includes a combination of one or more of a wireless wide area network, a wireless local area network, a wireless metropolitan area network, and a wireless personal network. The network includes network entities such as routers and gateways, which are not shown in the figure. The user terminal 120 may exchange information with the user rights management device 110 via the communication network, for example, a user may send a first user request or a second user request to the user rights management device 110 via the user terminal 120.

[0018] The user rights management device can be specifically integrated into an electronic device, which can be a terminal, a server, or other devices. The terminal can be a mobile phone, a tablet computer, a smart Bluetooth device, a laptop, or a personal computer (PC) and other devices; the server can be a single server or a server cluster composed of multiple servers. In some embodiments, the user rights management device can also be integrated into multiple electronic devices, for example, the user rights management device can be integrated into multiple servers, and the user rights management method of the present application can be implemented by multiple servers.

[0019] In an embodiment of the present specification, the user authority management device 110 can receive a first user request; filter the first user request to obtain a filtered first user request, wherein the filtered first user request carries a legal mark; based on a second user request, obtain a user name corresponding to the legal mark, wherein the second user request is a user login request received just before the first user request is received; determine the user's role and the authority corresponding to the role according to the user name; based on the MVC architecture, perform custom annotations in the methods required to be called by different controllers in the MVC architecture, add a value to the custom annotation to identify the authority field, and the authority field is used to control the authority resource information required in the controller; in the aspect of aspect-oriented programming, obtain the authority information by searching for the annotated method; the authority information is the authority identifier corresponding to the controller when accessing the annotated method; based on the authority and authority information corresponding to the role, access the authority resource information required in different controllers through authority control to complete the authority management of various resources, etc.

[0020] It should be noted that Figure 1 The scenario diagram of the user authority management system shown is only an example. The user authority management system and scenario described in the embodiment of the present invention are intended to more clearly illustrate the technical solution of the embodiment of the present invention, and do not constitute a limitation on the technical solution provided by the embodiment of the present invention. Ordinary technicians in this field can know that with the evolution of the user authority management system and the emergence of new scenarios, the technical solution provided by the embodiment of the present invention is also applicable to similar technical problems.

[0021] See also Figure 2 , Figure 2 is a flow chart of a user rights management method provided by an embodiment of the present invention. The user rights management method can be Figure 1 The user rights management device 110 shown is executed. The user rights management method may at least include the following steps: 200. Receive a first user request.

[0022] In this embodiment, the first user request is a request initiated by the user to the user authority management device 110 through a front-end interface of the user terminal (such as a browser, a mobile application, etc.).

[0023] For example, the first user request may be an action of the user clicking a button, filling out a form, sending an API request, etc. When the user initiates the first user request, the first user request usually carries some information, such as the user's identity authentication information, operation parameters, and the like.

[0024] In some embodiments, before receiving the first user request, it includes: receiving a second user request, the second user request carries user login information; when the user login is successfully verified based on the user login information, randomly generating a unique tag corresponding to the user; storing the tag and the user login information in the cache of the user authority management device.

[0025] In this embodiment, the second user request is a user login request received before the first user request is received, and the second user request carries user login information. The user login information may be information such as a user name and password entered by the user at the user end when logging in. The tag may be a string used to indicate user identity, access rights, and other security information.

[0026] For example, when the user login is successfully verified based on the user login information, the user rights management device 110 may generate a random tag through a universally unique identifier (UUID), and then store the tag together with the user login information in the cache of the user rights management device 110 , which may be a Redis cache.

[0027] In this embodiment, the tag can also be stored in the cache of the user terminal. On the user terminal, when the user logs in successfully, the user terminal can call the tag corresponding to the user in the cache of the user terminal, so as to add the tag to the user information, that is, each time the user subsequently initiates a user request, the user terminal will carry this tag in the request header, and the tag will be transmitted to the user rights management device together with the user request.

[0028] In some embodiments, storing the tag and user login information in a cache of a user rights management device includes: using a hash table data structure in the cache, using the user name in the user login information as a key, and storing the tag as a value.

[0029] A hash table is a data structure that uses a hash function to map keys to values, thereby allowing fast data access. A hash table can be composed of an array structure and a hash function. When a key-value pair needs to be stored, the hash function calculates the hash value of the key and then stores the value in the array position corresponding to the hash value, so that the value can be obtained and updated in a constant time. This embodiment uses a hash table to make data storage highly efficient.

[0030] This embodiment may use a hash table data structure, where the Key value stores the user name and the Value value stores the generated tag.

[0031] In some embodiments, obtaining a user name corresponding to the legal tag based on the second user request includes: determining user login information based on the second user request; and obtaining the user name corresponding to the legal tag according to the user login information.

[0032] In this embodiment, before receiving the first user request sent by the user through the user terminal, the user rights management device 110 has received the second user request (i.e., the user login request) carrying the user login information, and generated a unique tag for the user, and stored the tag together with the user name. In this embodiment, the user login information can be determined from the second user request, and then the user name corresponding to the legal tag can be obtained from the user login information.

[0033] 210. Filter the first user request to obtain a filtered first user request, where the filtered first user request carries a legal mark.

[0034] In this embodiment, when a user initiates a request, the tag is transmitted to the user authority management device along with the first user request. The user authority management device filters the first user request through a filter, for example, determining whether the first user request contains the tag and whether the tag is legal, etc., thereby obtaining the filtered first user request, and the filtered first user request carries a legal tag.

[0035] In some embodiments, filtering the first user request to obtain the filtered first user request includes: filtering the first user request through a tag filter to obtain the filtered first user request.

[0036] In this embodiment, the token filter can be a processor used to filter, tokenize and convert text during the user rights management process.

[0037] In this embodiment, the first user request may be filtered by a tag filter to obtain a filtered first user request.

[0038] In some embodiments, the first user request is filtered through a tag filter to obtain a filtered first user request, including: when it is verified based on the tag filter that the first user request carries a tag and the tag is legal, the filtered first user request is obtained, and the legal tag in the filtered first user request is the tag carried in the first user request.

[0039] In this embodiment, when filtering the first user request based on the tag filter, it is necessary not only to determine whether the first user request carries a tag, but also to further determine whether the tag carried in the first user request is legal. If the tag is illegal or empty, a message about the failure of the authorization authentication is returned to the user end. If the tag is legal, the filtered first user request is obtained, and the legal tag in the filtered first user request is the tag carried in the first user request.

[0040] For example: when judging whether the mark carried in the first user request is legal, the embodiment can verify whether the format of the mark conforms to the prescribed mode or structure, such as checking the length, character type, special characters, etc. of the mark; the embodiment can also perform a blacklist or whitelist check, that is, the application may maintain a blacklist or whitelist, which contains prohibited or allowed marks, and it is necessary to verify whether the mark is within the permitted range; the embodiment can also perform a security check, that is, for security-sensitive applications, it is necessary to verify whether the mark contains potential security risks, such as SQL injection, cross-site scripting attacks, etc. The embodiment can also perform permission verification, that is, some marks can carry specific permissions or role information, and it is necessary to verify whether the mark has sufficient permissions. For example, when the user login is successfully verified based on the user login information, the user rights management device 110 randomly generates a unique mark, and the mark can carry the user rights or role information in the user login information. When judging whether the mark carried in the first user request is legal, it can be verified whether the mark carries the user-related permissions or role information. The embodiment can also perform business rule verification, that is, according to specific business needs, the mark can be further verified by business rules to ensure that it complies with business logic.

[0041] 220. Based on the second user request, obtain a user name corresponding to the legal mark.

[0042] In this embodiment, the second user request is a user login request received before the first user request is received.

[0043] In this embodiment, before receiving the first user request, a unique tag has been randomly generated based on the user login information, and the tag and the user login information are stored in the cache of the user rights management device 110. The user login information may include information such as a user name and a password. Therefore, in this embodiment, the user name corresponding to the legal tag can be obtained through the cache.

[0044] 230. Determine the user's role and the authority corresponding to the role based on the user name.

[0045] In this embodiment, the user roles may include but are not limited to administrator, ordinary user, super user, etc. Different user roles correspond to different permissions. For example, an administrator can manage users and content, including deleting illegal content and banning users. Ordinary users can publish and browse content, but cannot edit or delete other users' content. Super users can enjoy some special functions, such as posting advertisements or viewing more data statistics.

[0046] For example, the user authority management device 110 of this embodiment can obtain detailed information of the user, including the role information of the user, from the user database according to the user name; according to the role information of the user, corresponding role authorization can be performed to determine the user's operation authority in the system. The user database can be located in a database server, and the user database is used to store user data, which can include but is not limited to the user name, the role information of the user, etc.

[0047] In this embodiment, when it is determined that the tag carried in the first user request is legal, the user name corresponding to the tag can be taken out from the cache, and the role and the authority corresponding to the role can be determined according to the user name. If the tag does not exist in the cache, the authority authentication failure is returned.

[0048] 240. Based on the MVC architecture, custom annotations are made in the methods that need to be called by different controllers in the MVC architecture. Value values ​​are added to the custom annotations to identify the permission fields. The permission fields are used to control the permission resource information required in the controller.

[0049] In this embodiment, the user rights management device 110 is provided with a Model-View-Controller (MVC) architecture. The controller is a part of the application program of the MVC architecture mode. The controller is a component for processing user input, operating the model (data) and updating the view (user interface); that is, the controller layer is responsible for scheduling and coordinating user interaction and business logic in the MVC architecture, receiving user requests, calling corresponding methods to process these requests, and finally updating the model and view, and returning the processing results to the user. The controller can be represented by a specific code block or class in the user rights management device 110.

[0050] In this embodiment, a custom annotation can be defined before authenticating the permissions corresponding to the role according to aspect-oriented programming, that is, a custom annotation is made in the method that needs to be called by different controllers in the MVC architecture; a value is added to the custom annotation to identify the permission field, and the permission field is used to control the permission resource information required by different controllers in the MVC architecture.

[0051] Among them, the permission resource information can be the controller's access rights or operation rights for specific operations or functions. For example, the permission resource information may include functional permissions, data permissions, system permissions, etc. Functional permissions refer to specific functions or operations that the controller needs to perform, such as creating, reading, updating, or deleting data. These functional permissions can be operations within the application or involve access to external resources. Data permissions refer to specific data resources that the controller needs to access or operate, such as tables and records in a database or files in a file system. When it comes to reading, modifying, or deleting data, corresponding data permissions are required. System permissions refer to system-level resources that the controller needs to access or operate, such as network connections, device interfaces, or operating system functions. These system permissions may involve interaction with the operating system or other applications.

[0052] In the user rights management system, the rights resource information can be represented by identifiers, names or other forms of information so that the system can identify and manage these resources. For example, a rights resource information can be a specific page, a specific functional module, a data table or a specific operation (such as read, write, update, etc.). These rights resource information are used to help the system determine whether the role has the authority to access the corresponding resources or perform the corresponding operations.

[0053] For example, the user authority management device 110 of this embodiment can create a custom annotation, such as @RequiresPermission, and set a value attribute in the annotation to indicate the required permission field, for example: public @interface RequiresPermission { String value(); } Next, use this custom annotation in the controller to identify the required permission resource information, for example: @RestController public class MyController { @GetMapping(" / secureEndpoint") @RequiresPermission("read:resource") public String secureEndpoint() { / / Method implementation } } It can be seen that the user rights management device 110 of this embodiment can clearly specify the required permission resource information in different controllers by adding a value value to the custom annotation to identify the corresponding permission field, so as to interpret and process it in the subsequent permission control logic. The embodiment of this specification can summarize the fine-grained URI to form a unified string, that is, add a value value to the custom annotation to identify the permission field, so as to further identify the resource permission.

[0054] 250. In the aspect of aspect-oriented programming, obtain permission information by looking up the annotated method.

[0055] In this embodiment, the permission information may be a permission identifier corresponding to when the controller accesses the annotated method. For example, the permission information may be "read", "write", "admin", etc. Based on the permission information, in aspect-oriented programming, annotations may be used to mark certain methods as requiring specific permissions to be called.

[0056] Aspect-oriented programming is a programming paradigm that can improve the modularity and maintainability of the code by dynamically separating cross-cutting concerns from the main business logic when the program is running. The aspect-oriented programming framework can enable developers to dynamically write cross-cutting concerns into the application without modifying the main business logic by providing pointcuts and notifications.

[0057] Among them, the aspect of aspect-oriented programming is a module used to encapsulate cross-cutting concerns. The aspect includes notifications and pointcuts. Notifications define when and where to execute additional behaviors, while pointcuts define where to apply these behaviors.

[0058] A method can be a function or procedure in a program, which is a block of code that implements a specific function. In aspect-oriented programming, annotations can be used to modify certain methods so that they can be processed or additional behaviors can be added to these methods in specific aspects.

[0059] Annotations are a way to add metadata to program elements (such as classes, methods, fields, etc.). By adding specific annotations to a method, you can add additional information or tags to the method, such as declaring that the method requires permission verification. You can use annotation-modified methods in your code, and these annotations can contain information for permission control, transaction management, logging, and other aspects.

[0060] In the aspect-oriented programming, this embodiment can use annotations to identify methods that need special processing, and then use the function of the aspect to find and uniformly process these annotated methods. In the aspect-oriented programming, this embodiment searches for annotated methods, and the annotations declare permission information.

[0061] 260. Based on the permissions and permission information corresponding to the roles, the required permission resource information in different controllers is accessed through permission control to complete the permission management of various resources.

[0062] In this embodiment, based on the permissions and permission information corresponding to the role, the required permission resource information in different controllers can be accessed through permission control to complete the permission management of various resources. The permission resource information can be the controller's access rights or operation rights for specific operations or functions.

[0063] In some embodiments, based on the permissions and permission information corresponding to the roles, permission control is used to access the required permission resource information in different controllers to complete permission management of various resources, including: when the permissions corresponding to the roles include permission information declared in the annotations, permission control is used to access the required permission resource information in different controllers to complete permission management of various resources.

[0064] This embodiment can determine whether the permissions corresponding to the role include the permission information declared in the annotation, and access the required permission resource information in different controllers through permission control to complete the permission management of various resources.

[0065] This embodiment can control user permissions through roles based on aspect-oriented programming, and can better support the principles of least privilege, separation of duties, and data abstraction, greatly simplifying user permission management and improving user permission management efficiency.

[0066] In some embodiments, after accessing the required permission resource information in different controllers through permission control, it includes: accessing the required permission resource information in different controllers based on the permission control to obtain access data; and returning the access data to the user end.

[0067] This embodiment can access the required authority resource information in different controllers from the resource server through authority control, and return the access data to the user end. When the authority corresponding to the role does not contain the authority resource information declared in the annotation, a message about authority authentication failure is returned to the user end.

[0068] The embodiments of this specification can summarize fine-grained URIs, and at the same time, through annotations and aspect-oriented programming, authenticate the permissions corresponding to the roles according to aspect-oriented programming, so that for different controllers, a unified string is bound according to the permission requirements, and a class of resource permissions is identified with a unified string, thereby achieving a mode in which users correspond to roles and roles correspond to resources, and improving the efficiency of user permission management. The embodiments of this specification are easy to use and efficient. When authorizing a user, you only need to authorize the role, and then assign the corresponding role to the user; and the embodiments of this specification are easy to maintain, expand, and maintain in the later stage, and the user permission management efficiency is high.

[0069] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0070] See also Figure 3 , Figure 3 A schematic diagram of the structure of a user rights management device provided in an embodiment of this specification.

[0071] like Figure 3 As shown, the user rights management device may at least include a request receiving module 300, a filtering module 310, a user name obtaining module 320, a rights determination module 330, an annotation module 340, an information obtaining module 350 and a rights management module 360, wherein: The request receiving module 300 is used to receive a first user request; A filtering module 310, configured to filter the first user request to obtain a filtered first user request, wherein the filtered first user request carries a legal mark; A user name acquisition module 320, configured to acquire a user name corresponding to a legal tag based on a second user request, where the second user request is a user login request received before the first user request is received; The authority determination module 330 is used to determine the role of the user and the authority corresponding to the role according to the user name; An annotation module 340 is used to perform custom annotations in methods that need to be called by different controllers in the MVC architecture based on the MVC architecture, and add a value to the custom annotation to identify the permission field, and the permission field is used to control the permission resource information required in the controller; The information acquisition module 350 is used to obtain permission information by searching for an annotated method in the aspect-oriented programming aspect; the permission information is a permission identifier corresponding to the controller when accessing the annotated method; The authority management module 360 ​​is used to access the authority resource information required in different controllers through authority control based on the authority and authority information corresponding to the role, so as to complete the authority management of various resources.

[0072] In some embodiments, the user authority management device also includes a user login module, which is used to: receive a second user request, the second user request carries user login information; when the user login is successfully verified based on the user login information, randomly generate a unique tag corresponding to the user; and store the tag and the user login information in the cache of the user authority management device.

[0073] In some embodiments, the user login module includes a storage module, and the storage module is used to: use a hash table data structure in a cache, use the user name of the user in the user login information as a key, and use the tag as a value to store.

[0074] In some embodiments, the user name acquisition module 320 includes a user name acquisition submodule, which is used to: determine user login information based on the second user request; and acquire a user name corresponding to the legal tag according to the user login information.

[0075] In some embodiments, the filtering module 310 includes a filtering submodule, which is used to: when the first user request is verified to carry a tag based on the tag filter and the tag is legal, obtain a filtered first user request, and the legal tag in the filtered first user request is the tag carried in the first user request.

[0076] In some embodiments, the permission management module 360 ​​includes a judgment module, which is used to: when the permissions corresponding to the role include permission information declared in the annotation, access the required permission resource information in different controllers through permission control to complete permission management of various resources.

[0077] In some embodiments, the authority management module 360 ​​also includes an access module, which is used to: access the authority resource information required in different controllers based on authority control to obtain access data; and return the access data to the user end.

[0078] Based on the contents of the user rights management system in multiple embodiments of this specification, it can be known that the embodiments of this specification use annotations and aspect-oriented programming to identify and control the permission requirements of various resources, so as to achieve a mode in which different users correspond to different roles, and different roles correspond to different resource permissions, establish a correspondence between users, roles and resources, and implement a flexible permission management mode, further realize refined permission management of various resources, and improve the efficiency of user permission management. The embodiments of this specification are easy to use and efficient. When authorizing a user, you only need to authorize the role, and then assign the corresponding role to the user; and the embodiments of this specification are easy to maintain, expand, and maintain in the later stage, and the user permission management efficiency is high.

[0079] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the user rights management system embodiment, since it is basically similar to the user rights management method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0080] See also Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification is shown.

[0081] like Figure 4 As shown, the electronic device 400 may include: at least one processor 401 , at least one network interface 404 , a user interface 403 , a memory 405 , and at least one communication bus 402 .

[0082] The communication bus 402 may be used to realize the connection and communication among the above-mentioned components.

[0083] The user interface 403 may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0084] The network interface 404 may include, but is not limited to, a Bluetooth module, an NFC module, a Wi-Fi module, etc.

[0085] Among them, the processor 401 may include one or more processing cores. The processor 401 uses various interfaces and lines to connect the various parts of the entire electronic device 400, and executes various functions and processes data of the electronic device 400 by running or executing instructions, programs, code sets or instruction sets stored in the memory 405, and calling data stored in the memory 405. Optionally, the processor 401 can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor 401 can integrate one or a combination of CPU, GPU, modem, etc. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 401, and it can be implemented separately through a chip.

[0086] Among them, the memory 405 may include RAM or ROM. Optionally, the memory 405 includes a non-transitory computer-readable medium. The memory 405 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 405 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 405 may also be at least one storage device located away from the aforementioned processor 401. The memory 405 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a user rights management application. The processor 401 may be used to call the user rights management application stored in the memory 405, and execute the steps of user rights management and formulation mentioned in the above-mentioned embodiments.

[0087] The embodiment of the present specification also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer or a processor, the computer or the processor executes the above Figure 2 One or more steps in the illustrated embodiment. If the components of the electronic device described above are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0088] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function according to the embodiment of this specification is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by the computer or a data storage device such as a server or data center that contains one or more available media integrations. Available media may be magnetic media (eg, floppy disks, hard disks, tapes), optical media (eg, digital versatile discs (DVD)), or semiconductor media (eg, solid state drives (SSD)).

[0089] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0090] The above embodiments are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Without departing from the design spirit of this specification, various modifications and improvements made to the technical solutions of this specification by ordinary technicians in this field should fall within the scope of protection determined by the claims of this specification.

Claims

1. A user rights management method, comprising: receiving a first user request; Filtering the first user request to obtain a filtered first user request, wherein the filtered first user request carries a legal mark; Based on a second user request, obtaining a user name corresponding to the legal mark, where the second user request is a user login request received before the first user request is received; Determine the user's role and the authority corresponding to the role according to the user name; Based on the MVC architecture, custom annotations are made in the methods that need to be called by different controllers in the MVC architecture, and value values ​​are added to the custom annotations to identify the permission field, and the permission field is used to control the permission resource information required in the controller; In the aspect-oriented programming, the permission information is obtained by searching the annotated method; the permission information is a permission identifier corresponding to when the controller accesses the annotated method; Based on the permissions corresponding to the roles and the permission information, permission resource information required in different controllers is accessed through permission control to complete permission management of various resources.

2. The method according to claim 1, before receiving the first user request, comprising: receiving a second user request, wherein the second user request carries user login information; When the user login is successfully verified based on the user login information, a unique tag corresponding to the user is randomly generated; The mark and the user login information are stored in a cache of a user rights management device.

3. The method according to claim 2, wherein storing the tag and the user login information in a cache of a user rights management device comprises: A hash table data structure is used in the cache, and the user name of the user in the user login information is used as a key and the tag is used as a value for storage.

4. The method according to claim 3, wherein obtaining the user name corresponding to the legal mark based on the second user request comprises: determining user login information based on the second user request; The user name corresponding to the legal mark is obtained according to the user login information.

5. The method according to claim 4, wherein filtering the first user request to obtain the filtered first user request comprises: When it is verified based on the tag filter that the first user request carries a tag and the tag is legal, a filtered first user request is obtained, and the legal tag in the filtered first user request is the tag carried in the first user request.

6. The method according to claim 1, based on the permissions corresponding to the roles and the permission information, accessing the required permission resource information in different controllers through permission control to complete the permission management of various resources, comprises: When the permissions corresponding to the role include the permission information declared in the annotation, the required permission resource information in different controllers is accessed through permission control to complete the permission management of various resources.

7. The method according to claim 1, after accessing the required authority resource information in different controllers through authority control, comprises: Based on permission control, access the required permission resource information in different controllers to obtain access data; The access data is returned to the user end.

8. A user rights management device, comprising: A request receiving module, used for receiving a first user request; A filtering module, configured to filter the first user request to obtain a filtered first user request, wherein the filtered first user request carries a legal mark; A user name acquisition module, used to acquire a user name corresponding to the legal mark based on a second user request, where the second user request is a user login request received before the first user request is received; A permission determination module, used to determine the role of the user and the permission corresponding to the role according to the user name; An annotation module is used to perform custom annotations in methods that need to be called by different controllers in the MVC architecture based on the MVC architecture, and to add a value to the custom annotation to identify the permission field, and the permission field is used to control the permission resource information required in the controller; An information acquisition module, used to acquire permission information by searching for an annotated method in an aspect-oriented programming aspect; the permission information is a permission identifier corresponding to when the controller accesses the annotated method; The authority management module is used to access the authority resource information required in different controllers through authority control based on the authority corresponding to the role and the authority information, so as to complete the authority management of various resources.

9. An electronic device comprising a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images