Authority control method and device, computer equipment and computer readable storage medium

Abstract

The invention discloses an authority control method and device, computer equipment and a computer readable storage medium, relates to the technical field of information security management and control, performs authority management through an interface, realizes fine-grained management and control of authority, enhances the security protection capability of a system, ensures that different user roles can only access authorized data resources, and improves the user experience. The authority control requirement of an enterprise in a complex business scene is met, and a solid security guarantee is provided for enterprise informatization construction. The method comprises the following steps: in response to a system access request, determining that the system access request indicates a to-be-accessed target interface; acquiring role information of a target role initiating the system access request, determining a target platform associated with the role information, and matching interface permission information of the target role under the target platform; and when the interface permission information indicates that access to the target interface is allowed, generating a target menu based on the target interface, and controlling the target role to access the target menu.

Description

Technical Field

[0001] The present application relates to the field of information security management and control technology, and in particular to a permission control method, apparatus, computer equipment and computer-readable storage medium. Background Art

[0002] With the rapid development of information technology, enterprise informatization has become an important means to improve operational efficiency and optimize resource allocation. In the process of enterprise informatization, the background management system, as the core platform supporting the business operation of the enterprise, is of great importance. The background management system is not only responsible for processing complex business logic, but also undertakes the key task of managing database data to ensure the accuracy, integrity and security of the data. Therefore, building an efficient and secure permission management platform to achieve refined permission control for different user roles has become an important challenge in the construction of enterprise informatization.

[0003] In the related art, the authority division of different user roles is usually realized by relying on menu management. Specifically, the system limits the functional areas that different user roles can access by hiding or displaying specific menu items.

[0004] In the process of implementing this application, the applicant found that the related technology has at least the following problems:

[0005] The permission control implemented by relying on menu management mainly focuses on the permission control of the first-level menu. It is unable to manage the permission of the second-level or even multi-level menus nested under the first-level menu. It is difficult to achieve the refined division of user permissions and cannot meet the permission control needs of enterprises in complex business scenarios. Even if the user's access entrance is restricted by hiding the menu, once the user bypasses the permission control through other means (such as direct access interface routing), it may still cause the leakage of sensitive data, pose a security risk, and seriously threaten the security of enterprise data and the stability of business. Summary of the invention

[0006] In view of this, the present application provides a permission control method, apparatus, computer device and computer-readable storage medium, the main purpose of which is to solve the problem that it is currently difficult to achieve a refined division of user permissions, and cannot meet the permission control needs of enterprises in complex business scenarios. Even if the user's access entrance is restricted by hiding the menu, once the user bypasses the permission control through other means (such as direct access interface routing), it may still cause the leakage of sensitive data, pose a security risk, and seriously threaten the security of enterprise data and the stability of the business.

[0007] According to the first aspect of the present application, a permission control method is provided, the method comprising:

[0008] In response to a system access request, determining a target interface to be accessed as indicated by the system access request;

[0009] Obtaining role information of a target role initiating the system access request and determining a target platform associated with the role information, and matching interface permission information of the target role on the target platform;

[0010] When the interface permission information indicates that access to the target interface is allowed, a target menu is generated based on the target interface, and the target role is controlled to access the target menu.

[0011] Optionally, the acquiring role information of a target role initiating the system access request and determining a target platform associated with the role information, and matching interface permission information of the target role on the target platform, includes:

[0012] Determining a target user identifier based on a target system account logged in when initiating the system access request;

[0013] Obtaining a role information table, and using the role information associated with the target user identifier in the role information table as the role information of the target role, wherein the role information table records the association relationship between the user identifier and the role information and each role information is associated with a platform identifier;

[0014] Using the platform identifier associated with the role information of the target role in the role information table as the target platform identifier, and using the platform indicated by the target platform identifier as the target platform;

[0015] Obtaining a permission information table, obtaining target platform permission information under the target platform in the permission information table, wherein the permission information table records platform permission information of multiple platforms, and each platform permission information records an association relationship between at least one role information and interface information;

[0016] The interface information associated with the role information of the target role in the target platform permission information is used as the interface permission information.

[0017] Optionally, determining the target user identifier based on the target system account logged in when initiating the system access request includes:

[0018] Querying the login status information when the system access request is initiated, and determining the target system account according to the login status information;

[0019] A user information table is obtained, and a user identifier associated with the target system account in the user information table is used as the target user identifier, wherein the user information table records the association relationship between the user's system account and the user identifier.

[0020] Optionally, after obtaining the role information of the target role initiating the system access request and determining the target platform associated with the role information, and matching the interface permission information of the target role under the target platform, the method further includes:

[0021] Query whether the interface authority information includes the interface name of the target interface;

[0022] When the interface permission information includes the interface name of the target interface, reading the status information of the target interface in the interface permission information, and determining whether to allow access to the target interface based on the status information;

[0023] When the interface name of the target interface is not included in the interface permission information, query whether the target interface is a public interface, and when the query determines that the target interface is a public interface, determine that the interface permission information indicates that the target role is allowed to access the target interface, and when the query determines that the target interface is not a public interface, determine that the interface permission information indicates that access to the target interface is prohibited, generate an access failure reminder, and push the access failure reminder to the target role.

[0024] Optionally, the determining whether to allow access to the target interface based on the state information includes:

[0025] If the status information indicates that the target interface is unavailable, determining that the interface permission information indicates that access to the target interface is prohibited, generating the access failure reminder, and pushing the access failure reminder to the target role;

[0026] If the status information indicates that the target interface is available, it is determined that the interface permission information indicates that access to the target interface is permitted.

[0027] Optionally, generating a target menu based on the target interface includes:

[0028] Obtaining an association table, querying in the association table whether the target interface is associated with a menu item, wherein the association table records the association relationship between the interface and the menu item;

[0029] When it is found that the target interface is associated with at least one menu item, the at least one menu item is sorted according to the hierarchical relationship of the at least one menu item to obtain the target menu;

[0030] Acquire a platform information table, and based on the platform identifier of the target platform, acquire target routing information of the target platform in the platform information table, wherein the platform information table records the association relationship between the platform identifier and the routing information;

[0031] Jump to the target platform according to the target routing information, and control the target platform to display the target menu, so that the target character can access the target menu in the target platform;

[0032] When it is found that the target interface is not associated with a menu item, a jumpable menu indicated by the target interface is queried, and the jumpable menu is used as the target menu.

[0033] Optionally, the method further comprises:

[0034] In response to the platform access request, determining a platform to be accessed, and acquiring a platform identifier and routing information of the platform to be accessed;

[0035] Acquire a platform information table, associate the identifier of the platform to be accessed with the routing information to be accessed, and store them in the platform information table, wherein the platform information table records the association relationship between the platform identifier and the routing information;

[0036] Identifying multiple platform interfaces of the platform to be accessed, and constructing the platform permission information of the platform to be accessed based on the multiple platform interfaces;

[0037] The permission information of the platform to be accessed is recorded in the permission information table under the platform to be accessed, wherein the permission information table records platform permission information of multiple platforms, and each platform permission information records an association relationship between at least one role information and interface information. When a request to create a role in the platform to be accessed is detected, the role information to be created of the role to be created and at least one interface information to be associated input for the role to be created are determined, and under the permission information of the platform to be accessed stored in the permission information table, an association relationship between the role information to be created and the at least one interface information to be associated is established.

[0038] According to a second aspect of the present application, a permission control device is provided, the device comprising:

[0039] A determination module, configured to determine, in response to a system access request, a target interface to be accessed as indicated by the system access request;

[0040] A matching module, used to obtain the role information of the target role initiating the system access request and determine the target platform associated with the role information, and match the interface permission information of the target role under the target platform;

[0041] The control module is used to generate a target menu based on the target interface and control the target role to access the target menu when the interface permission information indicates that access to the target interface is allowed.

[0042] Optionally, the matching module is used to determine the target user identifier based on the target system account logged in when the system access request is initiated; obtain a role information table, and use the role information associated with the target user identifier in the role information table as the role information of the target role, wherein the role information table records the association relationship between the user identifier and the role information and each role information is associated with a platform identifier; use the platform identifier associated with the role information of the target role in the role information table as the target platform identifier, and use the platform indicated by the target platform identifier as the target platform; obtain a permission information table, and obtain the target platform permission information under the target platform in the permission information table, wherein the permission information table records platform permission information of multiple platforms, and each platform permission information records the association relationship between at least one role information and interface information; use the interface information associated with the role information of the target role in the target platform permission information as the interface permission information.

[0043] Optionally, the matching module is used to query the login status information when the system access request is initiated, and determine the target system account based on the login status information; obtain a user information table, and use the user identifier associated with the target system account in the user information table as the target user identifier, wherein the user information table records the association relationship between the user's system account and the user identifier.

[0044] Optionally, the device further comprises:

[0045] A query module is used to query whether the interface permission information includes the interface name of the target interface; when the interface permission information includes the interface name of the target interface, read the status information of the target interface in the interface permission information, and determine whether access to the target interface is allowed based on the status information; when the interface permission information does not include the interface name of the target interface, query whether the target interface is a public interface, and when the query determines that the target interface is a public interface, determine that the interface permission information indicates that the target role is allowed to access the target interface, and when the query determines that the target interface is not a public interface, determine that the interface permission information indicates that access to the target interface is prohibited, generate an access failure reminder, and push the access failure reminder to the target role.

[0046] Optionally, the query module is used to determine that the interface permission information indicates that access to the target interface is prohibited if the status information indicates that the target interface is unavailable, generate the access failure reminder, and push the access failure reminder to the target role; if the status information indicates that the target interface is available, determine that the interface permission information indicates that access to the target interface is allowed.

[0047] Optionally, the control module is used to obtain an association table, and query in the association table whether the target interface is associated with a menu item, wherein the association table records the association between the interface and the menu item; when it is queried that the target interface is associated with at least one menu item, the at least one menu item is sorted according to the hierarchical relationship of the at least one menu item to obtain the target menu; obtain a platform information table, and based on the platform identifier of the target platform, obtain target routing information of the target platform in the platform information table, wherein the platform information table records the association between the platform identifier and the routing information; jump to the target platform according to the target routing information, and control the target platform to display the target menu, so that the target character can access the target menu in the target platform; wherein, when it is queried that the target interface is not associated with a menu item, the jumpable menu indicated by the target interface is queried, and the jumpable menu is used as the target menu.

[0048] Optionally, the device further comprises:

[0049] An update module is used to determine the platform to be accessed in response to a platform access request, and obtain the platform to be accessed identifier and the routing information to be accessed of the platform to be accessed; obtain a platform information table, associate the platform to be accessed identifier and the routing information to be accessed, and store them in the platform information table, wherein the platform information table records the association relationship between the platform identifier and the routing information; identify multiple platform interfaces of the platform to be accessed, and construct the platform to be accessed permission information of the platform to be accessed based on the multiple platform interfaces; record the platform to be accessed permission information under the platform to be accessed in the permission information table, wherein the permission information table records the platform permission information of multiple platforms, and each of the platform permission information records the association relationship between at least one role information and interface information, and when a request to create a role in the platform to be accessed is detected, determine the role to be created information of the role to be created and at least one interface information to be associated input for the role to be created, and establish the association relationship between the role information to be created and the at least one interface information to be associated under the platform permission information to be accessed stored in the permission information table.

[0050] According to a third aspect of the present application, a computer device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0051] According to a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods described in the first aspect are implemented.

[0052] Through the above technical scheme, the present application provides a permission control method, device, computer equipment and computer-readable storage medium. The present application responds to a system access request, determines the target interface to be accessed indicated by the system access request, obtains the role information of the target role initiating the system access request and determines the target platform associated with the role information, matches the interface permission information of the target role under the target platform, generates a target menu based on the target interface when the interface permission information indicates that access to the target interface is allowed, and controls the target role to access the target menu, performs permission management through the interface, realizes fine-grained control of permissions, enhances the security protection capabilities of the system, ensures that different user roles can only access their authorized data resources, meets the enterprise's permission control needs in complex business scenarios, and provides solid security guarantees for enterprise informatization construction.

[0053] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0055] Figure 1 A schematic diagram of a permission control method provided in an embodiment of the present application is shown;

[0056] Figure 2A A schematic diagram of another permission control method provided in an embodiment of the present application is shown;

[0057] Figure 2B A schematic diagram of an RBAC model architecture provided in an embodiment of the present application is shown;

[0058] Figure 2CA schematic diagram of a permission control method provided in an embodiment of the present application is shown;

[0059] Figure 2D A schematic diagram of a permission control method provided in an embodiment of the present application is shown;

[0060] Figure 3 A schematic diagram of the structure of a permission control device provided in an embodiment of the present application is shown;

[0061] Figure 4 A schematic diagram of the device structure of a computer device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0062] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0063] The present application embodiment provides a permission control method, such as Figure 1 As shown, the method includes:

[0064] 101. In response to a system access request, determine a target interface to be accessed as indicated by the system access request.

[0065] The embodiments of the present application can be applied to a rights management platform, which is connected to multiple platforms. Therefore, when a user has access requirements on a certain platform, the rights management platform will first receive a system access request from the client. Next, this system access request will be parsed, and the rights management platform will accurately identify the target interface that the user intends to access, providing a clear target for subsequent rights verification, thereby reducing the processing of invalid requests and improving system response efficiency.

[0066] Specifically, the system access request will carry a unique identifier of the interface, and the target interface can be determined by the unique identifier. For example, user A clicks the "Query User Information" button on the client interface, and this operation triggers a system access request. Then the system access request will carry the unique identifier of the "Query User Information" interface.

[0067] 102. Obtain role information of a target role that initiates a system access request and determine a target platform associated with the role information, and match interface permission information of the target role on the target platform.

[0068] In an embodiment of the present application, the authority management platform determines the target role that initiates the system access request, retrieves and obtains detailed role information of the target role that currently initiates the system access request, including but not limited to role identification, role name, department, etc.

[0069] Then, based on the role information, the authority management platform will further determine the target platform associated with the role information. The target platform can be an internal ERP (Enterprise Resource Planning) system, CRM (Customer Relationship Management) system, or an external service platform, etc., which is not specifically limited in this application.

[0070] After determining the role information and target platform, the permission management platform will continue to match the target role's specific interface permission information under the target platform. The interface permission information lists in detail which interfaces the target role can access and which operation permissions (such as read, write, execute, etc.) each interface has.

[0071] Continuing with user A as an example, the permission management platform queries the interface permission information of user A in the target platform ERP system through his role information, and finds that he has the read permission of the "Query User Information" interface.

[0072] In this way, by obtaining the role information of the target role and the associated target platform, the interface permission information of each role under a specific platform can be accurately matched. This fine-grained permission management method not only enhances the security of the platform, but also avoids security issues or operational inconveniences caused by excessive or insufficient permissions. At the same time, since platform factors are taken into consideration, permission management is more flexible and applicable.

[0073] 103. When the interface permission information indicates that access to the target interface is allowed, a target menu is generated based on the target interface, and the target role is controlled to access the target menu.

[0074] In an embodiment of the present application, when the rights management platform confirms that the target role has the right to access the target interface, the rights management platform generates a target menu based on the target interface. Among them, the target menu may be associated with at least one menu item, and one or more target menus are dynamically generated based on at least one menu item. At least one menu item may directly correspond to an interface operation, or it may be a set of logically related interface operations. In the actual application process, some public interfaces may not be associated with menu items. Therefore, when the target interface has no associated menu items, it can be directly determined which menu can be jumped to when requesting access to the target interface, and the menu can be used as the target menu.

[0075] Next, the permission management platform will allow the target role to access the interface through the generated target menu through front-end display or back-end logic control. During this process, the permission management platform may also perform additional security checks, such as session verification and request parameter verification, to ensure the legitimacy of the access.

[0076] Continuing with user A as an example, the permission management platform generates a target menu item containing a "Query User Information" button based on the "Query User Information" interface. This menu item may be located in the navigation bar of user A or the operation area of ​​a specific page. Then, after user A clicks the "Query User Information" button, the permission management platform calls the corresponding backend interface based on the operation, executes the user information query logic, and returns the result to user A's client for display.

[0077] Through the above embodiments, the technical solution of the present application effectively realizes refined permission control of system access requests, which not only improves the security of the system, but also enhances the user experience; moreover, by dynamically generating target menus, different roles can intuitively and conveniently access the interfaces within their authority range, thereby improving the usability and flexibility of the system.

[0078] The method provided in the embodiment of the present application responds to a system access request, determines the target interface to be accessed indicated by the system access request, obtains the role information of the target role initiating the system access request and determines the target platform associated with the role information, matches the interface permission information of the target role under the target platform, generates a target menu based on the target interface when the interface permission information indicates that access to the target interface is allowed, and controls the target role to access the target menu, performs permission management through the interface, realizes fine-grained control of permissions, enhances the security protection capability of the system, ensures that different user roles can only access their authorized data resources, meets the enterprise's permission control needs in complex business scenarios, and provides a solid security guarantee for the enterprise's informatization construction.

[0079] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, the embodiment of the present application provides another permission control method, such as Figure 2A As shown, the method includes:

[0080] 201. In response to a system access request, determine a target interface to be accessed as indicated by the system access request.

[0081] The embodiments of the present application can be applied to a rights management platform, which is an integrated and intelligent system management tool designed to provide comprehensive and detailed access control solutions for various platforms. The rights management platform can achieve precise rights control for different user roles on different platforms. Through the rights management platform, enterprises can ensure data security, improve system usability, and simplify the rights management process. Among them, the rights management platform supports flexible role definition and platform configuration, supports many-to-many role-platform associations, and facilitates enterprises to perform complex rights management; the rights management platform also supports custom menu styles and layouts, supports the generation of multi-level menus and complex menu structures, and provides users with an intuitive and friendly operation interface. In this way, through precise permission control, the permission management platform can ensure that only users with corresponding permissions can access specific interfaces, effectively preventing data leakage and illegal operations; moreover, dynamically generated menu items allow users to complete the required operations through intuitive menus without having to understand complex interface information, thereby improving user experience; further, the integrated permission management platform integrates functions such as role management, platform management, permission control and menu generation, simplifying the permission management process and reducing management costs; in addition, the permission management platform supports flexible role definition, platform configuration and permission control strategies, and can adapt to the business needs and changes of different enterprises.

[0082] It should be noted that the permission management platform can be connected with various information system platforms, including but not limited to enterprise resource planning (ERP), customer relationship management (CRM), office automation (OA) and other system platforms. Through the permission management platform, enterprises can achieve fine permission control for different user roles, ensure the security and stability of the system, and improve the work efficiency and satisfaction of users. The permission control method provided by the permission management platform is developed based on the RBAC (Role-Based Access Control) standard model. The core idea of ​​RBAC is to classify users in the system according to their roles, then define the permissions of different roles, and finally specify which users belong to which roles, so as to achieve permission management. The permission management platform developed based on the RBAC standard model manages the relationship between users and permissions through roles, realizes flexible configuration and dynamic adjustment of permissions, which not only simplifies the complexity of permission management, but also improves the security and scalability of the system. In practical applications, the appropriate RBAC model and its extension mode can be selected according to specific needs to build a permission management platform.

[0083] Specifically, Figure 2B As shown in the figure, the RBAC model involves three main elements: users, roles, and permissions. Figure 2B"User A", "User B", and "User C" represent specific users or user categories in the platform. In the RBAC model, users are the final recipients of permissions, but they do not directly possess permissions. Instead, they obtain permissions indirectly by playing one or more roles. Figure 2B The "administrator" and "ordinary user" in the RBAC model can be regarded as different roles. Each role has a set of specific permissions, which define the operations that the role can perform or the resources it can access. For example, the "administrator" has the permissions to "create a new user", "delete a user", and "view a user", while the "ordinary user" only has the permission to "view a user". In summary, in the RBAC model, roles are the bridge between users and permissions. By assigning permissions to roles and then assigning users to roles, user permission management is achieved.

[0084] In order to provide targeted services to users and control user rights, the rights management platform provides users with login services. After users successfully log in to the rights management platform, they can start to request access. The rights management platform is connected to multiple third-party platforms. As the demand for platforms increases, each platform needs a login function. However, if a login function is developed, it is very redundant. Therefore, the rights management platform unifies the login of all platforms connected to the rights management, performs single-point login, and realizes that if one platform has rights, other platforms can also log in and jump directly. Specifically, the rights management platform provides a unified login interface and login logic to all third-party platforms connected. Users only need to log in once on the rights management platform to obtain a valid authentication token. The rights management platform will maintain a unified token verification, which contains the user's identity information and permission information. When a user tries to access a third-party platform, the platform will send the token to the rights management platform for verification. The rights management platform confirms whether the user's identity and permissions are legal by decrypting and verifying the content of the token. That is to say, once a user successfully logs in to the permission management platform and obtains a token, the user can use this token to access all third-party platforms that have been connected to the single sign-on mechanism without having to log in repeatedly on each platform. This greatly improves user convenience and reduces the complexity of password management. In addition, to facilitate user access, the permission management platform can directly redirect the user to the target third-party platform according to the user's request or preset rules after the user successfully logs in, making the user experience smoother and more seamless.

[0085] When a user has access requirements on a platform, the permission management platform will first receive a system access request from the client. Next, the system access request will be parsed, and the permission management platform will accurately identify the target interface that the user intends to access, providing a clear target for subsequent permission verification, thereby reducing the processing of invalid requests and improving system response efficiency. Specifically, the system access request will carry a unique identifier for the interface, and the target interface can be determined by the unique identifier.

[0086] 202. Obtain role information of a target role that initiates a system access request and determine a target platform associated with the role information.

[0087] In an embodiment of the present application, the rights management platform will automatically identify and determine the role to which the target user belongs and its associated target platform, thereby achieving more flexible and precise access control.

[0088] In order to manage different permissions for different roles, a role information table is set in the permission management platform. The role information table records the association between the user ID and the role information, and each role information is associated with the platform ID. Specifically, the role information table may include the key fields of user ID, role information, platform ID, and association. Among them, the user ID is used to uniquely identify each user in the platform and is a unique identifier of the user identity. Role information is used to describe the role or responsibility of the user in the corresponding platform. A user can have multiple roles, and each role corresponds to a specific set of permissions; role information can be a text description or an object with a specific structure. The platform ID is used to identify different platforms or systems in the access permission management platform. Through the platform ID, the permission management platform can clearly know which platform or system a certain role is set for. The association relationship is used to record the correspondence between the user ID and the role information and between the role information and the platform ID, and to assist the permission management platform to quickly locate the role to which the user belongs and its associated platform.

[0089] When determining the role information of the target role and the target platform associated with the role information, first, the authority management platform will determine the target user ID based on the target system account logged in when initiating the system access request. Among them, when the user logs in successfully, the authority management platform will generate or update the user's login status information, including login time, login IP (Internet Protocol Address, device address), session identifier, etc., and associate the login status information with the user's system account, and store it in the login status table or session management system. Therefore, the login status information when initiating the system access request can be queried, and the target system account can be determined according to the login status information. Further, the authority management platform maintains a user information table, which is a data table that stores the basic information of the user, in which the association between the user's system account and the user ID is recorded, and usually contains the user's basic attribute information, such as system account, user ID, real name, contact information, registration time, last login time, etc., in order to identify the user's identity. Therefore, after determining the target system account, the authority management platform will obtain the user information table and use the user ID associated with the target system account in the user information table as the target user ID.

[0090] After determining the identity of the target user, since the access rights to the interface are all associated with the role information, the permission management platform will continue to query the role information of the target user and the target platform where the role information is located. Specifically, the permission management platform will obtain the role information table, retrieve the role information associated with the target user identifier, and use the role information associated with the target user identifier in the role information table as the role information of the target role. For the retrieved role information, the permission management platform will further check the platform identifier associated with it in the role information table. The platform identifier indicates which platforms or subsystems need to apply the permission settings of the role. The permission management platform will use the platform indicated by the target platform identifier as the target platform, so that it can subsequently make a decision on whether to allow access based on the role information of the target user, the permission settings of the target platform, and the specific interface of the access request, and return a corresponding response to the target user.

[0091] 203. Match the interface permission information of the target role on the target platform.

[0092] In the embodiment of the present application, after determining the role information and the target platform, the rights management platform will continue to match the target role's specific interface rights information under the target platform. The interface rights information lists in detail which interfaces the target role can access, and which operation rights (such as read, write, execute, etc.) each interface has.

[0093] Among them, the permission information table is maintained in the permission management platform. The permission information table is a data table used to store and manage the permission configuration of different roles on each platform. It is one of the core components of implementing the role-based access control (RBAC) strategy. The permission information table records the platform permission information of multiple platforms. Each platform permission information records the association between at least one role information and interface information. The permission information table can support the permission configuration of multiple platforms (or subsystems). Each platform has a unique platform identifier, which is used to distinguish the permission records of different platforms in the table. The permission information table records the association between role information and interface information. The association defines the interface or resource range that each role can access on each platform. The design of the permission information table supports fine-grained access control. It can not only define the role's access rights to a certain interface (such as whether to allow access), but also further refine it to specific operations of the interface (such as read-only, write-only or read-write permissions) and detailed control of request parameters and response data. In addition, with the development of business and the upgrade of the system, the permission requirements may change. Therefore, the permission information table can also easily add new platforms, roles or interfaces, and adjust existing permission configurations, with good flexibility and scalability.

[0094] In this way, after the permission management platform determines the target platform and the target role, it will query the permission information table to obtain the permission details under the target platform. Specifically, the permission management platform will obtain the permission information table, obtain the target platform permission information under the target platform in the permission information table, and use the interface information associated with the role information of the target role in the target platform permission information as the interface permission information. Specifically, the interface permission information may include detailed information such as the interface name, URI (Uniform Resource Identifier), HTTP (HyperText Transfer Protocol) method (such as GET, POST, etc.), request parameters, response data format, etc. These detailed information define the specific operations that the role can perform and the range of data that can be accessed.

[0095] 204. Query whether the interface authority information includes the interface name of the target interface. When the interface authority information includes the interface name of the target interface, execute the following step 205; when the interface authority information does not include the interface name of the target interface, execute the following step 206.

[0096] In the embodiment of the present application, since the interface permission information indicates which interfaces are accessible to the target role, after obtaining the interface permission information, the permission management platform will query whether the interface permission information includes the interface name of the target interface.

[0097] Accordingly, when the interface permission information includes the interface name of the target interface, it indicates that the target role has access rights to the target interface, and the permission management platform will continue to display the content related to the target interface to the target role, and control the target role to access the target interface, that is, execute the following step 205. When the interface permission information does not include the interface name of the target interface, it is necessary to further determine whether the target interface is a public interface that allows everyone to access it, so the interface name is not included in the interface permission information, and determine whether the target role can access the target interface based on the judgment interface, that is, execute the following step 206.

[0098] 205. When the interface authority information includes the interface name of the target interface, read the status information of the target interface in the interface authority information, determine whether to allow access to the target interface based on the status information, and when the interface authority information indicates that access to the target interface is allowed, generate a target menu based on the target interface, and control the target role to access the target menu.

[0099] In an embodiment of the present application, when the interface name of the target interface is included in the interface authority information, it means that the target role has access rights to the target interface. And considering that the interface may be frozen or unavailable sometimes, the rights management platform will read the status information of the target interface in the interface authority information, and determine whether to allow access to the target interface based on the status information. The status information includes but is not limited to whether the interface is available, access restrictions, maintenance status, etc., wherein, if the status information indicates that the target interface is unavailable (such as being in maintenance, reaching access restrictions, freezing, etc.), it is determined that the interface authority information indicates that access to the target interface is prohibited, and an access failure reminder is generated, and an access failure reminder is pushed to the target role. The access failure reminder may include a specific failure reason, and can be realized by a preset communication channel (such as SMS, email, system message, etc.) when the access failure reminder is pushed. If the status information indicates that the target interface is available, it is determined that the interface authority information indicates that access to the target interface is allowed, and the rights management platform will continue to execute subsequent access processing procedures, that is, to generate a target menu based on the target interface, and to control the target role to access the target menu.

[0100] It should be noted that the menu items in the rights management platform are clearly divided into first-level menu items and second-level menu items, and this hierarchical relationship has a specific impact on rights management. When a first-level menu item is frozen or unfrozen, its impact will be cascaded to all the second-level menu items under it and the interfaces associated with these second-level menu items. When a first-level menu item is frozen, the rights management platform will update the status of the first-level menu item in the database or memory, indicating that it has been frozen, and traverse all the second-level menu items under the first-level menu item, and update their status to frozen. For each frozen second-level menu item, the rights management platform will find and freeze the access rights of all interfaces under it, set corresponding access-forbidden status information for these interfaces, or remove the access rights of these interfaces from the permission list of a specific role. As for the unfreezing operation, especially when the demand for directly unfreezing a second-level menu item is put forward, it can be mandatory to start unfreezing from the first-level menu item, that is, first unfreeze the first-level menu item, and then the second-level menu item and its interface will be automatically unfrozen to avoid confusion and uncertainty in the unfreezing operation. Alternatively, if it is really necessary to allow users to unfreeze directly from the second-level menu item, the permission management platform can provide an indirect approach, such as displaying a warning or prompt to inform users that they need to unfreeze from the first-level menu item, and providing a link or button to quickly jump to the first-level menu item. In this way, although the user starts the operation from the second-level menu item, it actually follows the principle of unfreezing from the upper level. Alternatively, if the business scenario really needs to allow the second-level menu item to be unfrozen directly, the permission management platform can implement a special unfreezing logic. For example, when a user tries to unfreeze a second-level menu item, the permission management platform can automatically check the status of its upper first-level menu item and prompt the user whether to unfreeze the first-level menu item and all other frozen menus and interfaces under it at the same time; if the user agrees, the cascade unfreezing operation is performed; if the user refuses, only the current second-level menu item and the interface under it are unfrozen.

[0101] In an optional implementation scheme, an association table and a platform information table are maintained in the rights management platform. Among them, the association table records the association between the interface and the menu item, and the association table at least contains the interface identifier, the menu item identifier, and possible other association information (such as association type, association weight, etc.). By querying the association table, all menu items associated with the target interface can be obtained. The platform information table records the association between the platform identifier and the routing information. The platform information table at least contains the platform identifier, routing information (such as URL path, jump logic, etc.) and possible other platform configuration information. Through the platform information table, the corresponding routing information can be obtained according to the platform identifier of the target platform to achieve platform jump and access.

[0102] When generating a target menu based on the target interface and controlling the target role to access the target menu, since an association table is set in the permission management platform, the permission management platform will obtain the association table, first query whether the target interface is associated with at least one menu item in the association table, and ensure that only menu items with corresponding permissions will be retrieved based on the association between the interface and the menu item. Subsequently, when it is found that the target interface is associated with at least one menu item, the permission management platform will sort out at least one menu item according to the hierarchical relationship of at least one menu item to obtain the target menu, and by parsing the hierarchical structure of the menu items, ensure that a clear menu hierarchy and logical structure can be presented during display. Next, the permission management platform continues to obtain the platform information table, and based on the platform identifier of the target platform, obtains the target routing information of the target platform in the platform information table, and through the association between the platform identifier and the routing information, the information required for platform jump is quickly obtained. Finally, the rights management platform will jump to the target platform according to the target routing information, and control the target platform to display the target menu, so that the target role can access the target menu in the target platform. In this way, the user can be guided to the target platform and a personalized menu customized according to the interface permissions can be displayed, thereby realizing platform access control based on interface permissions. By combining the association between the interface and menu items and the platform routing information, flexible platform access control and personalized menu display based on interface permissions are realized, improving user experience and access efficiency.

[0103] Accordingly, when it is found that the target interface is not associated with a menu item, it means that the interface is not currently directly associated with any menu item. Since the target interface is not associated with a menu item, the rights management platform will further analyze the properties or configuration of the target interface, and make a judgment based on the metadata, permission settings or other business logic of the target interface to determine whether the target interface is a public interface or an interface that allows all users to access and does not rely on a specific menu structure. If it is determined that the target interface is a public interface or an interface that does not explicitly limit the access scope, the jumpable menu indicated by the target interface can be queried, and the jumpable menu can be used as the target menu. Among them, the jumpable menu can be the context or entry point of the function of the target interface displayed in the user interface. Once the jumpable menu is queried, the rights management platform can regard the jumpable menu as the target menu when the user accesses the interface.

[0104] 206. When the interface name of the target interface is not included in the interface permission information, query whether the target interface is a public interface, and when the query determines that the target interface is a public interface, determine that the interface permission information indicates that the target role is allowed to access the target interface, and when the query determines that the target interface is not a public interface, determine that the interface permission information indicates that access to the target interface is prohibited, generate an access failure reminder, and push the access failure reminder to the target role.

[0105] In an embodiment of the present application, when the interface name of the target interface is not included in the interface permission information, the rights management platform will not immediately determine that access is denied, but will proceed to the next step of judgment to determine whether the target interface is an open interface to the outside world, and whether it is not recorded in the interface permission information because it is allowed to be accessed by everyone by default. Specifically, the rights management platform will query whether the target interface is a public interface, and a public interface refers to an interface that is designed to be open to most users or roles in the system and can be accessed without specific permission verification. Public interfaces usually perform some basic and common operations, such as querying public information, performing stateless operations, or providing system status reports. When querying whether the target interface is a public interface, the metadata tag of the target interface, the settings in the configuration file, and the provisions in the security policy can be queried to determine whether the target interface is a public interface, or the target interface is queried through a specific service interface to determine whether it is a public interface. Among them, when the query determines that the target interface is a public interface, since the original intention of the design of the public interface is to allow wide access, it will be considered that the interface permission information allows the target role to access the target interface by default, without additional permission verification, therefore, it is determined that the interface permission information indicates that the target role is allowed to access the target interface. When the query determines that the target interface is not a public interface, it means that the target interface is not a public interface and the target role does not have the permission to access the target interface. The permission management platform needs to inform the target role that it cannot access the target interface. Therefore, the permission management platform will generate an access failure reminder, which will clearly indicate the reason why the access request was rejected, that is, the target role did not obtain the permission to access the target interface. In addition, in order to improve the user experience, the access failure reminder can also include suggestions on how to apply for permissions or contact the administrator.

[0106] After the access failure reminder is generated, the permission management platform will push the above access failure reminder to the target role through the preset communication channels (such as user interface pop-up windows, SMS notifications, emails, system logs, etc.). The choice of push method is based on the system configuration and user preferences to ensure that the access failure reminder can be communicated to the target role in a timely and accurate manner. In addition, in addition to pushing reminders to the target role, the permission management platform can also record the access failure event in the security event log, which is helpful for subsequent security audits and permission management optimization work, such as analyzing the reasons for access failures and discovering potential abuse of permissions. In some cases, the permission management platform can also trigger an alarm mechanism when an unauthorized access attempt is detected. This is achieved by sending an alarm email to the system administrator, displaying the alarm information on the security monitoring platform, etc., which helps to quickly respond to security incidents and reduce potential security risks.

[0107] In another optional implementation scheme, with the development of business and expansion of the system, new platforms often need to be connected to the existing rights management platform to achieve unified rights management and access control. The specific process of connecting a new platform to the rights management platform is as follows:

[0108] In response to the platform access request, the rights management platform will determine the platform to be accessed, identify and determine the identity and basic information of the platform to be accessed, and obtain the platform to be accessed identifier (such as platform ID, platform name, etc.) and access routing information (such as URL path, API interface address, etc.) of the platform to be accessed. Next, the rights management platform will obtain the platform information table, associate the platform to be accessed identifier and the access routing information to be accessed, and store them in the platform information table. Subsequently, the rights management platform continues to identify multiple platform interfaces of the platform to be accessed. The platform interface is the entrance to the functions or services provided by the platform. The rights management platform will construct the platform to be accessed permission information of the platform to be accessed based on multiple platform interfaces. The platform to be accessed permission information may specifically include interface name, interface description, interface type, interface permission level, etc. After generating the platform to be accessed permission information, the rights management platform will record the platform to be accessed permission information under the platform to be accessed in the permission information table. Specifically, a new platform permission information area or category can be created for the platform to be accessed in the permission information table, and the platform to be accessed permission information can be recorded under the platform to be accessed, ensuring that each interface is associated with the corresponding role information. Correspondingly, when a request is detected to create a role in the platform to be accessed, the rights management platform will determine the role information to be created (such as role name, role description, role type, etc.) of the role to be created and at least one interface information to be associated with the role to be created, which is selected from the interface list of the platform to be accessed. Then, the rights management platform will find the corresponding area under the permission information of the platform to be accessed in the permission information table, and establish an association relationship between the role information to be created and at least one interface information to be associated, so that the newly created role is given the permission to access a specific interface. It should be noted that after completing the above steps, the rights management platform can also perform permission verification and testing to ensure that the newly accessed platform and its interface can be correctly integrated with the rights management platform. Specifically, the test includes but is not limited to whether the role permission allocation is correct, whether the interface access control is effective, and whether the platform routing jump is smooth. After verification and testing, the rights management platform will formally deploy the new platform and its permission information to the production environment, and update relevant documents and guidelines so that users and administrators can understand the usage and permission configuration of the new platform.

[0109] In summary, the logic of the permission control method provided by this application is summarized as follows:

[0110] like Figure 2CAs shown, the user needs to verify his identity through the login step. Specifically, the permission management platform will verify the identity by checking whether the token held by the user is valid. If the token is verified to be valid, the user's login information is successfully verified, and the permission management platform will continue to verify the permissions. After the permission verification is passed, the user can make interface calls, that is, access specific functions or resources provided by the corresponding platform. If the token held by the user is invalid or the user does not have sufficient permissions to access the requested resources, the permission management platform can require the administrator to intervene, such as assigning corresponding permissions to the user or solving other permission-related issues.

[0111] Further, see Figure 2D , the permission management platform involves many aspects of management, including menu management, role management, permission management and user management. Among them, menu management involves the creation, freezing and unfreezing of menus. Role management involves adding permissions to the corresponding roles and removing permissions. Permission management involves the addition of permissions, and the newly added permissions need to be bound to the corresponding menus; further, it also involves the freezing of permissions. When freezing, if there are menus of different levels, they need to be verified in sequence, such as verifying the second-level menu, verifying the first-level menu, etc. User management involves the creation of users and the freezing of the corresponding permissions of users. Specifically, when controlling the permissions of users, the permission management platform will query whether the interface requested by the user to access is in a frozen state. If it has been frozen, there is no right to access. If it has not been frozen, the permission management platform will continue to query the role played by the user on the platform where the interface requested to access is located. If there is no role, the interface cannot be accessed. If there is a role, it will continue to query whether the permissions of the role played by the user on the platform include the interface it accesses and query whether the interface is frozen. If the interface is frozen, you have no right to access it. If it is not frozen, check whether the first-level menu item under the interface is frozen. If it is not frozen, continue to check whether the second-level menu item under the first-level menu item is frozen, and provide the user with access services to the interface if it is not frozen. Correspondingly, if the first-level menu item is frozen, you still have no right to access it, and there is no need to continue to check the second-level menu items under the first-level menu item.

[0112] The method provided in the embodiment of the present application performs permission management through an interface, realizes fine-grained control of permissions, enhances the security protection capability of the system, ensures that different user roles can only access their authorized data resources, meets the enterprise's permission control needs in complex business scenarios, and provides a solid security guarantee for the enterprise's informatization construction.

[0113] Further, as Figure 1 In a specific implementation of the method, the present application provides a permission control device, such as Figure 3As shown, the device includes: a determination module 301, a matching module 302, and a control module 303.

[0114] The determination module 301 is used to determine, in response to a system access request, a target interface to be accessed as indicated by the system access request;

[0115] The matching module 302 is used to obtain the role information of the target role that initiates the system access request and determine the target platform associated with the role information, and match the interface permission information of the target role on the target platform;

[0116] The control module 303 is used to generate a target menu based on the target interface and control the target role to access the target menu when the interface permission information indicates that access to the target interface is allowed.

[0117] In a specific application scenario, the matching module 302 is used to determine the target user identifier based on the target system account logged in when the system access request is initiated; obtain a role information table, and use the role information associated with the target user identifier in the role information table as the role information of the target role, wherein the role information table records the association relationship between the user identifier and the role information and each role information is associated with a platform identifier; use the platform identifier associated with the role information of the target role in the role information table as the target platform identifier, and use the platform indicated by the target platform identifier as the target platform; obtain a permission information table, and obtain the target platform permission information under the target platform in the permission information table, wherein the permission information table records the platform permission information of multiple platforms, and each platform permission information records the association relationship between at least one role information and interface information; use the interface information associated with the role information of the target role in the target platform permission information as the interface permission information.

[0118] In a specific application scenario, the matching module 302 is used to query the login status information when the system access request is initiated, and determine the target system account based on the login status information; obtain a user information table, and use the user identifier associated with the target system account in the user information table as the target user identifier, wherein the user information table records the association relationship between the user's system account and the user identifier.

[0119] In a specific application scenario, the device also includes:

[0120] A query module is used to query whether the interface permission information includes the interface name of the target interface; when the interface permission information includes the interface name of the target interface, read the status information of the target interface in the interface permission information, and determine whether access to the target interface is allowed based on the status information; when the interface permission information does not include the interface name of the target interface, query whether the target interface is a public interface, and when the query determines that the target interface is a public interface, determine that the interface permission information indicates that the target role is allowed to access the target interface, and when the query determines that the target interface is not a public interface, determine that the interface permission information indicates that access to the target interface is prohibited, generate an access failure reminder, and push the access failure reminder to the target role.

[0121] In a specific application scenario, the query module is used to determine that the interface permission information indicates that access to the target interface is prohibited if the status information indicates that the target interface is unavailable, generate the access failure reminder, and push the access failure reminder to the target role; if the status information indicates that the target interface is available, determine that the interface permission information indicates that access to the target interface is allowed.

[0122] In a specific application scenario, the control module 303 is used to obtain an association table, and query whether the target interface is associated with a menu item in the association table, wherein the association table records the association between the interface and the menu item; when it is queried that the target interface is associated with at least one menu item, the at least one menu item is sorted according to the hierarchical relationship of the at least one menu item to obtain the target menu; obtain a platform information table, and based on the platform identifier of the target platform, obtain the target routing information of the target platform in the platform information table, wherein the platform information table records the association between the platform identifier and the routing information; jump to the target platform according to the target routing information, and control the target platform to display the target menu, so that the target character can access the target menu in the target platform; wherein, when it is queried that the target interface is not associated with a menu item, query the jumpable menu indicated by the target interface, and use the jumpable menu as the target menu.

[0123] In a specific application scenario, the device also includes:

[0124] An update module is used to determine the platform to be accessed in response to a platform access request, and obtain the platform to be accessed identifier and the routing information to be accessed of the platform to be accessed; obtain a platform information table, associate the platform to be accessed identifier and the routing information to be accessed, and store them in the platform information table, wherein the platform information table records the association relationship between the platform identifier and the routing information; identify multiple platform interfaces of the platform to be accessed, and construct the platform to be accessed permission information of the platform to be accessed based on the multiple platform interfaces; record the platform to be accessed permission information under the platform to be accessed in the permission information table, wherein the permission information table records the platform permission information of multiple platforms, and each of the platform permission information records the association relationship between at least one role information and interface information, and when a request to create a role in the platform to be accessed is detected, determine the role to be created information of the role to be created and at least one interface information to be associated input for the role to be created, and establish the association relationship between the role information to be created and the at least one interface information to be associated under the platform permission information to be accessed stored in the permission information table.

[0125] The device provided in the embodiment of the present application responds to a system access request, determines the target interface to be accessed indicated by the system access request, obtains the role information of the target role initiating the system access request and determines the target platform associated with the role information, matches the interface permission information of the target role under the target platform, generates a target menu based on the target interface when the interface permission information indicates that access to the target interface is allowed, and controls the target role to access the target menu, performs permission management through the interface, realizes fine-grained control of permissions, enhances the security protection capability of the system, ensures that different user roles can only access their authorized data resources, meets the enterprise's permission control needs in complex business scenarios, and provides a solid security guarantee for the enterprise's informatization construction.

[0126] It should be noted that for other corresponding descriptions of the functional units involved in the permission control device provided in the embodiment of the present application, please refer to Figure 1 and FIG. 2A to FIG. 2D The corresponding description in will not be repeated here.

[0127] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0128] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0129] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

[0130] In an exemplary embodiment, see Figure 4 , and also provides a computer device, which includes a bus, a processor, a memory and a communication interface, and may also include an input and output interface and a display device, wherein each functional unit can communicate with each other through the bus. The memory stores a computer program, and the processor is used to execute the program stored in the memory and execute the permission control method in the above embodiment.

[0131] A computer-readable storage medium stores a computer program, which implements the steps of the permission control method when executed by a processor.

[0132] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by hardware, or by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0133] Those skilled in the art will appreciate that the accompanying drawings are merely schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily required for implementing the present application.

[0134] Those skilled in the art will appreciate that the modules in the device in the implementation scenario can be distributed in the device in the implementation scenario according to the implementation scenario description, or can be changed accordingly and located in one or more devices different from the implementation scenario. The modules in the above implementation scenario can be combined into one module, or can be further split into multiple sub-modules.

[0135] The above application serial numbers are for description only and do not represent the advantages or disadvantages of the implementation scenarios.

[0136] The above disclosure only discloses several specific implementation scenarios of the present application. However, the present application is not limited thereto, and any changes that can be conceived by technicians in this field should fall within the scope of protection of the present application.

Claims

1. A permission control method, characterized in that: include: In response to a system access request, determining a target interface to be accessed as indicated by the system access request; Obtaining role information of a target role initiating the system access request and determining a target platform associated with the role information, and matching interface permission information of the target role on the target platform; When the interface permission information indicates that access to the target interface is allowed, a target menu is generated based on the target interface, and the target role is controlled to access the target menu.

2. The method according to claim 1, characterized in that The obtaining the role information of the target role initiating the system access request and determining the target platform associated with the role information, and matching the interface permission information of the target role on the target platform, includes: Determining a target user identifier based on a target system account logged in when initiating the system access request; Obtaining a role information table, and using the role information associated with the target user identifier in the role information table as the role information of the target role, wherein the role information table records the association relationship between the user identifier and the role information and each role information is associated with a platform identifier; Using the platform identifier associated with the role information of the target role in the role information table as the target platform identifier, and using the platform indicated by the target platform identifier as the target platform; Obtaining a permission information table, obtaining target platform permission information under the target platform in the permission information table, wherein the permission information table records platform permission information of multiple platforms, and each platform permission information records an association relationship between at least one role information and interface information; The interface information associated with the role information of the target role in the target platform permission information is used as the interface permission information.

3. The method according to claim 2, characterized in that The determining of the target user identifier based on the target system account logged in when initiating the system access request includes: Querying the login status information when the system access request is initiated, and determining the target system account according to the login status information; A user information table is obtained, and a user identifier associated with the target system account in the user information table is used as the target user identifier, wherein the user information table records the association relationship between the user's system account and the user identifier.

4. The method according to claim 1, characterized in that: After obtaining the role information of the target role initiating the system access request and determining the target platform associated with the role information, and matching the interface permission information of the target role under the target platform, the method further includes: Query whether the interface authority information includes the interface name of the target interface; When the interface permission information includes the interface name of the target interface, reading the status information of the target interface in the interface permission information, and determining whether to allow access to the target interface based on the status information; When the interface name of the target interface is not included in the interface permission information, query whether the target interface is a public interface, and when the query determines that the target interface is a public interface, determine that the interface permission information indicates that the target role is allowed to access the target interface, and when the query determines that the target interface is not a public interface, determine that the interface permission information indicates that access to the target interface is prohibited, generate an access failure reminder, and push the access failure reminder to the target role.

5. The method according to claim 4, characterized in that The determining whether to allow access to the target interface based on the status information comprises: If the status information indicates that the target interface is unavailable, determining that the interface permission information indicates that access to the target interface is prohibited, generating the access failure reminder, and pushing the access failure reminder to the target role; If the status information indicates that the target interface is available, it is determined that the interface permission information indicates that access to the target interface is permitted.

6. The method according to claim 1, characterized in that The generating a target menu based on the target interface includes: Obtaining an association table, querying in the association table whether the target interface is associated with a menu item, wherein the association table records the association relationship between the interface and the menu item; When it is found that the target interface is associated with at least one menu item, the at least one menu item is sorted according to the hierarchical relationship of the at least one menu item to obtain the target menu; Acquire a platform information table, and based on the platform identifier of the target platform, acquire target routing information of the target platform in the platform information table, wherein the platform information table records the association relationship between the platform identifier and the routing information; Jump to the target platform according to the target routing information, and control the target platform to display the target menu, so that the target character can access the target menu in the target platform; When it is found that the target interface is not associated with a menu item, a jumpable menu indicated by the target interface is queried, and the jumpable menu is used as the target menu.

7. The method according to claim 1, characterized in that The method further comprises: In response to the platform access request, determining a platform to be accessed, and acquiring a platform identifier and routing information of the platform to be accessed; Acquire a platform information table, associate the identifier of the platform to be accessed with the routing information to be accessed, and store them in the platform information table, wherein the platform information table records the association relationship between the platform identifier and the routing information; Identifying multiple platform interfaces of the platform to be accessed, and constructing the platform permission information of the platform to be accessed based on the multiple platform interfaces; The permission information of the platform to be accessed is recorded in the permission information table under the platform to be accessed, wherein the permission information table records platform permission information of multiple platforms, and each platform permission information records an association relationship between at least one role information and interface information. When a request to create a role in the platform to be accessed is detected, the role information to be created of the role to be created and at least one interface information to be associated input for the role to be created are determined, and under the permission information of the platform to be accessed stored in the permission information table, an association relationship between the role information to be created and the at least one interface information to be associated is established.

8. A permission control device, characterized in that: include: A determination module, configured to determine, in response to a system access request, a target interface to be accessed as indicated by the system access request; A matching module, used to obtain the role information of the target role initiating the system access request and determine the target platform associated with the role information, and match the interface permission information of the target role under the target platform; The control module is used to generate a target menu based on the target interface and control the target role to access the target menu when the interface permission information indicates that access to the target interface is allowed.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images