Directory data access authority management method and device, storage medium, system and program product

Abstract

The invention provides a directory data access authority management method and device, a storage medium, a system and a program product, directory data comprises multi-layer tree nodes, and each user has an independent access authority for the directory data. The access permission of the same user to any node is configured as the access permission of the user to a father node of the node by default, and the access permission management method comprises the following steps: in response to an access permission setting request of a specified user to a specified node, determining the access permission of the specified user to the specified node, the access permission of the specified user to all the child nodes of the specified node is the same as the access permission of the specified user to the specified node based on default configuration. According to the method, the child node inherits the access permission of the father node through default setting, and permission control management can be achieved under the condition that a small amount of storage space is occupied. And meanwhile, when the access authority is modified, only the access authority of a small number of nodes is modified, so that the authority modification time is shortened.

Description

Technical Field

[0001] The present disclosure generally relates to the technical field of data authority management, and more specifically, to a method, device, storage medium, system and program product for managing access authority of directory data. Background Art

[0002] In the data age, many companies have data processing needs and need to effectively organize their various data resources. Therefore, data platforms have been increasingly widely used.

[0003] The data on many data platforms are organized according to the directory structure, and enterprises generally have the need to divide access rights by user for data access. Therefore, in terms of design, different users are required to have their own corresponding access rights to different data, and permission control by directory must be supported.

[0004] The current general implementation scheme is that for each node in the directory tree, there is a data status identification record indicating whether a certain user has access rights. If the node's status identification corresponding to the user is true, it can be accessed, otherwise it cannot be accessed. When modifying access rights, you only need to modify the status identification of the node and its lower-level nodes. The problem with this scheme is that if you want to authorize a user to access a directory node that contains many data nodes in the lower layer, you need to create a corresponding data record for all the nodes in the lower layer, which is slow and takes up a lot of storage space. Summary of the invention

[0005] The present disclosure provides a method, device, storage medium, system and program product for managing access rights of directory data, which are used to solve at least one of the above problems.

[0006] According to one aspect of the present disclosure, a method for managing access rights to directory data is provided, wherein the directory data includes a multi-level tree node, each user has independent access rights to the directory data, and the same user's access rights to any node are configured to inherit the user's access rights to the node's parent node by default, the method for managing access rights including: in response to a request by a specified user to set access rights to a specified node, determining the specified user's access rights to the specified node, wherein the specified user's access rights to all child nodes of the specified node are the same as the specified user's access rights to the specified node based on a default configuration.

[0007] Optionally, the top-level node of the directory data is configured to be accessible by default; or the top-level node of the directory data is configured to be inaccessible by default.

[0008] Optionally, the access permission management method also includes: in response to the designated user's request to set an access permission for the designated node, searching for nodes with access permissions opposite to those corresponding to the access permission setting request among all parent nodes of the designated node that have been set with access permissions, and marking the found nodes as incomplete nodes, wherein the incomplete nodes are nodes whose access permissions are not completely the same as those of their child nodes.

[0009] Optionally, the access permission management method also includes: creating a new node in response to a request to create a new node; searching for a parent node with the lowest level among all parent nodes of the new node that are set with access permissions, and recording it as a reference parent node; and when the reference parent node is the incomplete node, configuring the access permission of the specified user to the new node to be opposite to the access permission of the specified user to the reference parent node.

[0010] Optionally, the access permission setting request includes a first request and a second request, one of the first request and the second request is used to set the access permission to be accessible, and the other of the first request and the second request is used to set the access permission to be inaccessible; each node in the directory data is configured with an access identifier associated with a user, the access identifier is used to indicate the access permission of the corresponding user to the corresponding node, and the value range of the access identifier includes at least one of a first incomplete value and a second incomplete value and a first complete value, a second complete value and a third value; wherein the first incomplete value is used to indicate that the corresponding node is the incomplete node, and the corresponding user has the access permission corresponding to the first request to the corresponding node Access rights; the second incomplete value is used to indicate that the corresponding node is the incomplete node, and the corresponding user has the access rights corresponding to the second request for the corresponding node; the first complete value is used to indicate that the corresponding node is a complete node, and the corresponding user has the access rights corresponding to the first request for the corresponding node, and the complete node is a node with exactly the same access rights as its child node; the second complete value is used to indicate that the corresponding node is the complete node, and the corresponding user has the access rights corresponding to the second request for the corresponding node; the third value is used to indicate that the access rights of the corresponding user to the corresponding node are inherited from the user's access rights to the parent node of the node, and the third value is the default value of the access identifier.

[0011] Optionally, the first request is used to set the access permission to a global default permission, and the global default permission is accessible or inaccessible, wherein the response to the specified user's request to set the access permission for the specified node determines the access permission of the specified user to the specified node, including: in response to the specified user's second request for the specified node, setting the access identifier associated with the specified user of the specified node to the second complete value, so as to determine that the access permission of the specified user to the specified node and all its child nodes is different from the global default permission.

[0012] Optionally, the value range of the access identifier does not include the first incomplete value, and the determining of the access rights of the designated user to the designated node in response to the access right setting request of the designated user for the designated node further includes: in response to the first request of the designated user for the designated node, if the access identifier associated with the designated node and the designated user is not the first complete value, modifying or maintaining the access identifier associated with the designated node and the designated user to the third value, searching upward from the designated node for the most recent parent node whose access identifier associated with the designated user is not the third value, and if the access identifier associated with the designated user of the found parent node is not the first complete value, modifying the access identifier associated with the designated node and the designated user to the first complete value.

[0013] Optionally, the searching for a node with access rights opposite to those corresponding to the access rights setting request among all parent nodes of the specified node that are set with access rights, and marking the found node as an incomplete node, includes: when the access identifier associated with the specified node and the specified user is modified to the first complete value, searching for a parent node with an access identifier associated with the specified user being the second complete value among all parent nodes of the specified node, and modifying the access identifier associated with the found parent node and the specified user to the second incomplete value.

[0014] Optionally, the global default permission is inaccessible.

[0015] Optionally, the access permission management method further includes: in response to a target user's request to obtain access permission for a target node, if the target node records access permission related to the target user, determining the target user's access permission to the target node based on the record, and if the target node does not record the access permission related to the target user, searching upward from the target node for the nearest parent node that records the access permission related to the target user, and determining the target user's access permission to the found parent node as the target user's access permission to the target node.

[0016] According to another aspect of the present disclosure, there is provided an access rights management device for directory data, wherein the directory data comprises a multi-level tree-like node, each user has an independent access right to the directory data, and the access rights of the same user to any node are configured to inherit the user's access rights to the parent node of the node by default, and the access rights management device comprises: a determination unit, configured to determine the access rights of the specified user to the specified node in response to a request by the specified user to set the access rights to the specified node, wherein the access rights of the specified user to all child nodes of the specified node are the same as the access rights of the specified user to the specified node based on a default configuration.

[0017] Optionally, the top-level node of the directory data is configured to be accessible by default; or the top-level node of the directory data is configured to be inaccessible by default.

[0018] Optionally, the access permission management device also includes: a search unit, configured to respond to the designated user's request to set an access permission for the designated node, search for nodes with access permissions opposite to those corresponding to the access permission setting request among all parent nodes of the designated node that have been set with access permissions, and mark the found nodes as incomplete nodes, wherein the incomplete nodes are nodes whose access permissions are not completely the same as those of their child nodes.

[0019] Optionally, the access permission management device also includes: a creation unit, configured to create a new node in response to a request to create a new node; a reference unit, configured to find the lowest-level parent node among all parent nodes of the new node that are set with access permissions, and record it as a reference parent node; and a configuration unit, configured to, when the reference parent node is the incomplete node, configure the access permission of the specified user to the new node to be opposite to the access permission of the specified user to the reference parent node.

[0020] Optionally, the access permission setting request includes a first request and a second request, one of the first request and the second request is used to set the access permission to be accessible, and the other of the first request and the second request is used to set the access permission to be inaccessible; each node in the directory data is configured with an access identifier associated with a user, the access identifier is used to indicate the access permission of the corresponding user to the corresponding node, and the value range of the access identifier includes at least one of a first incomplete value and a second incomplete value and a first complete value, a second complete value and a third value; wherein the first incomplete value is used to indicate that the corresponding node is the incomplete node, and the corresponding user has the access permission corresponding to the first request to the corresponding node Access rights; the second incomplete value is used to indicate that the corresponding node is the incomplete node, and the corresponding user has the access rights corresponding to the second request for the corresponding node; the first complete value is used to indicate that the corresponding node is a complete node, and the corresponding user has the access rights corresponding to the first request for the corresponding node, and the complete node is a node with exactly the same access rights as its child node; the second complete value is used to indicate that the corresponding node is the complete node, and the corresponding user has the access rights corresponding to the second request for the corresponding node; the third value is used to indicate that the access rights of the corresponding user to the corresponding node are inherited from the user's access rights to the parent node of the node, and the third value is the default value of the access identifier.

[0021] Optionally, the first request is used to set the access permission to a global default permission, which is accessible or inaccessible. The determination unit is also configured to set the access identifier associated with the specified user of the specified node to the second complete value in response to the second request of the specified user to the specified node, so as to determine that the access permission of the specified user to the specified node and all its child nodes is different from the global default permission.

[0022] Optionally, the value range of the access identifier does not include the first incomplete value, and the determination unit is further configured to respond to the first request of the designated user to the designated node, and if the access identifier associated with the designated node and the designated user is not the first complete value, modify the access identifier associated with the designated node and the designated user to or maintain it as the third value, and search upward from the designated node for the most recent parent node whose access identifier associated with the designated user is not the third value; if the access identifier associated with the designated user of the found parent node is not the first complete value, modify the access identifier associated with the designated node and the designated user to the first complete value.

[0023] Optionally, the search unit is further configured to search for a parent node whose access identifier associated with the specified user is the second complete value among all parent nodes of the specified node when the access identifier associated with the specified node is modified to the first complete value, and to modify the access identifier associated with the specified user of the found parent node to the second incomplete value.

[0024] Optionally, the global default permission is inaccessible.

[0025] Optionally, the access permission management device also includes: an acquisition unit, configured to respond to a target user's request to acquire access permission for a target node, and when the target node records access permission related to the target user, determine the target user's access permission to the target node based on the record, and when the target node does not record the access permission related to the target user, search upward from the target node for the nearest parent node that records the access permission related to the target user, and determine the target user's access permission to the found parent node as the target user's access permission to the target node.

[0026] According to another aspect of the present disclosure, a computer-readable storage medium storing instructions is provided, wherein when the instructions are executed by at least one computing device, the at least one computing device is prompted to execute the access permission management method for directory data as described above.

[0027] According to another aspect of the present disclosure, a system is provided including at least one computing device and at least one storage device storing instructions, wherein the instructions, when executed by the at least one computing device, prompt the at least one computing device to execute the access permission management method for directory data as described above.

[0028] According to another aspect of the present disclosure, a computer program product is provided, comprising instructions, wherein when the instructions are executed by at least one computing device, the at least one computing device is prompted to execute the access permission management method for directory data as described above.

[0029] According to the access rights management method, device, storage medium, system and program product of the directory data of the exemplary embodiment of the present disclosure, by configuring the default permission inheritance system, the default setting is that the child node inherits the access rights of the parent node, and the control management of the access rights can be realized while occupying a small amount of storage space, supporting the access rights control of the directory data. At the same time, when modifying the access rights, only the access rights of a small number of nodes can be modified, thereby shortening the time consumption of the permission modification and solving the problem of too long time consumption caused by modifying multiple data records.

[0030] Additional aspects and / or advantages of the present general inventive concept will be set forth in part in the following description and in part will be apparent from the description or may be learned through practice of the present general inventive concept. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] These and / or other aspects and advantages of the present disclosure will become clear and more easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0032] Figure 1 is a flowchart illustrating a method for managing access rights to directory data according to an exemplary embodiment of the present disclosure;

[0033] Figure 2 is a schematic diagram showing the architecture of an access rights management system according to an exemplary embodiment of the present disclosure;

[0034] Figure 3 is a schematic diagram showing a process of canceling access rights according to a specific embodiment of the present disclosure;

[0035] Figure 4 is a schematic diagram showing a process of setting an access identifier for a new node according to a specific embodiment of the present disclosure;

[0036] Figure 5 is a schematic diagram showing a flow chart of determining user access rights according to a specific embodiment of the present disclosure;

[0037] Figure 6 is a block diagram illustrating an apparatus for managing access rights to directory data according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] The following description with reference to the accompanying drawings is provided to assist in a comprehensive understanding of the embodiments of the present invention as defined by the claims and their equivalents. Various specific details are included to assist in understanding, but these details are considered to be exemplary only. Therefore, one of ordinary skill in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. In addition, descriptions of well-known functions and structures are omitted for clarity and brevity.

[0039] It should be noted that the phrase "at least one of the items" in the present disclosure includes three types of parallel situations: "any one of the items", "a combination of any number of the items", and "all of the items". For example, "including at least one of A and B" includes the following three parallel situations: (1) including A; (2) including B; (3) including A and B. Another example is "executing at least one of step 1 and step 2" which means the following three parallel situations: (1) executing step 1; (2) executing step 2; (3) executing step 1 and step 2.

[0040] A method, apparatus, storage medium, system, and program product for managing access rights to directory data according to exemplary embodiments of the present disclosure.

[0041] Refer to the following Figures 1 to 6 A method, apparatus, storage medium, system, and program product for managing access rights to directory data according to exemplary embodiments of the present disclosure are described in detail.

[0042] The directory data targeted by the present disclosure includes multi-level tree nodes, where the nodes of the upper layer are the parent nodes of the nodes of the lower layer, and vice versa, the nodes of the lower layer are the child nodes of the nodes of the upper layer. In other words, the parent node and the child node are a pair of relative concepts. As an example, the nodes of each level in the directory data can also have different forms, such as directories and files. A directory can be understood as a folder, that is, a directory can contain subdirectories or files. Files are used to store data, and files cannot contain subfiles. Therefore, the parent node must be a directory, and the child node may be a directory or a file.

[0043] Directory data is usually stored on a data platform. Registered users in the data platform can access directory data, and each user has independent access rights to directory data. Therefore, each user's access rights need to be managed independently. It should be noted that each user discussed here can be an individual user or a group user including multiple individual users. If a group user has independent access rights, each individual user in the group user has the same access rights.

[0044] Figure 1 1 is a flowchart showing a method for managing access rights to directory data according to an exemplary embodiment of the present disclosure. The method for managing access rights to directory data according to an exemplary embodiment of the present disclosure can be implemented in a computing device with sufficient computing power.

[0045] Reference Figure 1 In step S101, in response to a request from a designated user to set access rights to a designated node, the access rights of the designated user to the designated node are determined.

[0046] Specifically, access rights include accessible and inaccessible, which respectively indicate having access rights and not having access rights. As an example, access rights may refer to unified read and write rights, or to separate read rights or write rights. For the latter, each type of rights only needs to be managed separately, and the specific management method for each type of rights is the same.

[0047] As an example, the registered users of the data platform may include administrator users, and the administrator users can send access permission setting requests to the background by performing access permission setting operations on the user terminal; the registered users of the data platform can also have different levels, and high-level users can set access permissions for low-level users to achieve user access permission management. The specific operation method of the access permission setting operation can be set as needed, which is not the focus of this disclosure and is not limited here.

[0048] In the access rights management method according to the exemplary embodiment of the present disclosure, the access rights of the same user to any node are configured to inherit the user's access rights to the parent node of the node by default. Therefore, the access rights of a specified user to all child nodes of a specified node are the same as the access rights of the specified user to the specified node based on the default configuration. By configuring the default permission inheritance system, the default setting is that the child node inherits the access rights of the parent node, and the control and management of access rights can be achieved while occupying a small amount of storage space, supporting access rights control for directory data. At the same time, when modifying access rights, only the access rights of a small number of nodes can be modified, thereby shortening the time consumption of permission modification and solving the problem of excessive time consumption caused by modifying multiple data records.

[0049] Based on the permission inheritance system disclosed in the present invention, the access rights of the top-level node of the directory data have an important impact on the access rights of other nodes in the lower layers.

[0050] Regarding the access rights of the top-level nodes, in some embodiments, optionally, the top-level nodes of the directory data are configured to be accessible by default; or the top-level nodes of the directory data are configured to be inaccessible by default. By configuring default access rights for the top-level nodes of the directory data, it is possible to configure global default permissions for the entire directory data based on the default permission inheritance system, and then, according to the management needs of the directory data, choose to configure the top-level nodes as accessible or inaccessible by default, so as to clarify how to set the access rights of each user and make the permission setting easy to operate. As an example, considering data security, the top-level nodes can be inaccessible by default; and for directory data where most of the data is accessible and only a small amount of data is inaccessible, the top-level nodes can be configured as accessible to reduce the operation of setting access rights.

[0051] In other embodiments, the default access rights of the top-level node are not configured, but step S101 is executed to determine the access rights of the specified user to the top-level node through the access rights setting request, and the specified node is the top-level node. As an example, the administrator user can directly configure the access rights of all users to the top-level node when a new top-level node is created. Of course, it can also be configured at other times, such as configuring the access rights of each new user to the top-level node when the user registers, and the present disclosure does not limit this.

[0052] It should be understood that, although the permission inheritance system disclosed herein allows the user to set access rights to all child nodes of a node when setting access rights to a node, the user's access rights to the parent node of the node will not be modified synchronously. Therefore, the same user may have different access rights to the parent node and the child node.

[0053] In this regard, optionally, the access rights management method according to the exemplary embodiment of the present disclosure further includes: in response to the access rights setting request of the designated user for the designated node, searching for the node with the access rights opposite to the access rights corresponding to the access rights setting request in all the parent nodes of the designated node that are set with access rights, and marking the found node as an incomplete node, where the access rights of the incomplete node are not completely the same as those of the child node. By marking the node in the parent node of the designated node that is set with access rights and has the opposite access rights to the designated node as an incomplete node when setting the access rights of the designated node, such special parent nodes can be clearly marked. It should be understood that since different users on the data platform have independent access rights, the parent node with access rights set recorded here is specifically the parent node to which the access rights of the designated user are set. Similarly, the part that does not specify the specific user in the following text all represents the access rights of the designated user, and will not be described one by one. It should also be understood that the parent node of the designated node that has not been set with access rights has the same access rights as its parent node based on the default permission inheritance system, and for such parent nodes that have not been set with access rights, it is not necessary to mark them as incomplete nodes.

[0054] Further optionally, the access rights management method according to the exemplary embodiment of the present disclosure also includes: creating a new node in response to a new node request; finding the lowest-level parent node among all parent nodes of the new node that are set with access rights, and recording it as a reference parent node; when the reference parent node is an incomplete node, configuring the access rights of the specified user to the new node to be opposite to the access rights of the specified user to the reference parent node. An incomplete node is a node whose access rights are not completely the same as those of a child node. Based on this, when a new node is created under an incomplete node, there is a certain possibility that the new node needs to have the opposite access rights to the incomplete node. By configuring the access rights of the new node to be opposite to the access rights of the reference parent node, the mark of the incomplete node can be fully utilized to reduce the setting of the access rights of the new node. As an example, when the access rights of the reference parent node are accessible and it is an incomplete node, the new node is configured to be inaccessible; when the access rights of the reference parent node are inaccessible and it is an incomplete node, the new node is configured to be accessible.

[0055] Optionally, the access permission setting request recorded in step S101 includes a first request and a second request, one of the first request and the second request is used to set the access permission to be accessible, and the other of the first request and the second request is used to set the access permission to be inaccessible, so as to achieve the setting of access permissions. Accordingly, in order to record different access permissions, each node in the directory data is configured with an access identifier associated with a user, and the access identifier is used to indicate the access permission of the corresponding user to the corresponding node, and the value range of the access identifier includes at least one of the first incomplete value and the second incomplete value and the first complete value, the second complete value and the third value. In other words, the value range of the access identifier must include the first complete value, the second complete value and the third value, but for the first incomplete value and the second incomplete value, only at least one of the two is included. Among them, the first incomplete value is used to indicate that the corresponding node is an incomplete node, and the corresponding user has the access rights corresponding to the first request to the corresponding node; the second incomplete value is used to indicate that the corresponding node is an incomplete node, and the corresponding user has the access rights corresponding to the second request to the corresponding node; the first complete value is used to indicate that the corresponding node is a complete node, and the corresponding user has the access rights corresponding to the first request to the corresponding node, and the complete node is a node with the same access rights as its child node; the second complete value is used to indicate that the corresponding node is a complete node, and the corresponding user has the access rights corresponding to the second request to the corresponding node; the third value is used to indicate that the access rights of the corresponding user to the corresponding node are inherited from the user's access rights to the parent node of the node, and the third value is the default value of the access identifier, which means that when a node does not have an access identifier (or the access identifier is empty), the access identifier of the node is considered to be equal to the third value.

[0056] By configuring access identifiers for nodes, different access rights can be represented by simple identification values, which helps to improve the efficiency of access rights management. Regarding the value of the access identifier, by configuring the corresponding access identifier values ​​based on the first request and the second request, different access requests of the node itself can be distinguished. For specific access requests, by further subdividing them into complete values ​​and incomplete values, complete nodes and incomplete nodes can also be distinguished. The third value can represent a node that has no access rights set and complies with the default permission inheritance system. In addition, for the first incomplete value and the second incomplete value, the value range of the access identifier can include at least one of the two, which can not only realize the clear identification of at least one type of incomplete node, but also reasonably control the number of access identifier values, simplifying the management calculation amount.

[0057] It should be understood that, in the case where the value range of the access identifier includes both the first incomplete value and the second incomplete value, for the parent node whose access identifier is equal to the first complete value or the second complete value, the access identifiers of all its child nodes should be the third value or have no access identifier. If the access rights of one of the child nodes are modified to the opposite access rights, the parent node needs to be modified to the first incomplete value or the second incomplete value accordingly. Of course, when the value range of the access identifier includes one of the first incomplete value and the second incomplete value, it only needs to be modified to a value within the value range of the access identifier. For example, in the case where the access identifier does not include the first incomplete value, if the original access identifier of the parent node is the first complete value, no modification is required. If the original access identifier of the parent node is the second complete value, it needs to be modified to the second incomplete value.

[0058] It should be noted that the specific numerical values ​​of the first incomplete value, the second incomplete value, the first complete value, the second complete value and the third value can be selected arbitrarily, and the present disclosure does not impose any limitation on this.

[0059] For the embodiment in which the access right has a global default right, it should be understood that the global default right is accessible or inaccessible. As an example, the global default right is inaccessible, which enables each user to access the directory data only after authorization, fully ensuring data security.

[0060] Optionally, the first request is used to set the access permission to the global default permission, and the second request is used to set the access permission to the access permission opposite to the global default permission, and the value range of the access identifier does not include the first incomplete value. This means that, in the presence of global default permissions, if the access permission of a parent node is the global default permission, but there are nodes in its child nodes that are opposite to the global default permission, then the parent node should theoretically belong to an incomplete node, but the parent node is not marked as an incomplete node. Correspondingly, in the case where the access identifier of the parent node is the first complete value, if the access permission of its child nodes is set to the opposite of the global default permission, there is no need to modify the access identifier of the parent node to the first incomplete value. At this time, step S101 includes: in response to the second request of the specified user to the specified node, the access identifier of the specified node associated with the specified user is set to the second complete value to determine that the access permission of the specified user to the specified node and all its child nodes is different from the global default permission. That is to say, it is only necessary to directly set the access identifier of the specified node to the second complete value. Even if there is a parent node with the access identifier of the first complete value in the parent node of the specified node, there is no need to modify the access identifier of the parent node from the first complete value to the first incomplete value, that is, there is no need to specially mark the parent node. On the one hand, this simplifies the corresponding access identifier setting, making the operation simple and quick. On the other hand, if a new node is created under the parent node at this time, the access identifier of the new node will be configured as the default third value, so that the access rights of the new node can be configured as the global default rights based on the inheritance authority system, ensuring the continuation of the global default rights. In addition, since the value range of the access identifier includes at least one of the first incomplete value and the second incomplete value, therefore, not including the first incomplete value means that the second incomplete value must be included, and it is also possible to mark such a parent node: its own access rights are opposite to the global default rights, but there is at least one child node with the global default rights. Such a mark can realize that when a new node is created under the parent node, the access rights of the new node are configured to be opposite to the access rights of the parent node, that is, configured as the global default rights, and the continuation of the global default rights can also be determined.

[0061] Based on this, compared to receiving the second request, when the first request is received and the access rights of the specified node need to be configured as the global default rights, more situations need to be considered when determining the access identifier. It should be understood that in response to the first request of the specified user to the specified node, when the access identifier associated with the specified node and the specified user is the first complete value, the access identifier can be maintained as the first complete value without modification. In the case where the access identifier associated with the specified node and the specified user is not the first complete value, although in theory the access identifier can be directly modified to the first complete value, since the first complete value represents the same access rights as the global default rights, it is highly likely that the default third value can be used to represent it, and if the first complete value is used to represent it at this time, data redundancy will result. Based on this, instead of directly modifying the access right to the first complete value, the nearest parent node whose access identifier associated with the specified user is not the third value is searched upward from the specified node, and the access identifier associated with the specified user at the specified node is determined to be set to the first complete value or the third value based on the access identifier associated with the specified user at the parent node. This allows the access identifier to be kept at the default third value as much as possible, thereby reducing data redundancy caused by repeatedly setting the first complete value in child nodes and reducing the difficulty of subsequent maintenance and management.

[0062] Regarding the specific operation when the access identifier associated with the designated node and the designated user is not the first complete value, in some embodiments, optionally, the nearest parent node whose access identifier associated with the designated user is not the third value is searched upward from the designated node, and if the access identifier associated with the designated user of the found parent node is the first complete value, the access identifier associated with the designated user of the designated node is modified to or maintained as the third value, and if the access identifier associated with the designated user of the found parent node is the second complete value or the second incomplete value, the access identifier associated with the designated user of the designated node is modified to the first complete value. This embodiment directly searches for the nearest parent node whose access identifier is not the third value, and performs different processing on the designated nodes with different access identifiers according to the different access identifiers of the parent node, and its logic is clear and in line with human thinking.

[0063] In other embodiments, the access identifier associated with the specified node and the specified user is optionally modified to or maintained at the third value, and the nearest parent node whose access identifier associated with the specified user is not the third value is searched upward from the specified node. If the access identifier associated with the specified user of the found parent node is not the first complete value (i.e., the second complete value or the second incomplete value), the access identifier associated with the specified node and the specified user is modified to the first complete value, otherwise it is maintained at the third value without modification. This embodiment directly sets the access identifier of the specified node to the third value when the access identifier of the specified node is not the first complete value, and then searches for the nearest parent node whose access identifier is not the third value. Based on whether the access identifier of the parent node is the first complete value, it is determined whether to maintain the access identifier of the specified node at the third value or modify it to the first complete value. This can make each judgment and operation as simple as possible, so that compared with some of the aforementioned embodiments, a simpler logic is used to achieve the same effect, reduce the computing load, and help save computing resources.

[0064] Combined with the above records, in the case of receiving the first request, it is also necessary to find the node with the opposite access right (here is the global default right) corresponding to the access right setting request (here is the first request) among all the parent nodes of the specified node whose access rights are set, and mark the found node as an incomplete node. Optionally, the operation specifically includes: in the case of modifying the access identifier associated with the specified node and the specified user to the first complete value, find the parent node with the access identifier associated with the specified user as the second complete value among all the parent nodes of the specified node, and modify the access identifier associated with the specified user found to the second incomplete value. Combined with the above, it can be seen that after the access identifier of the specified node is set in response to the first request, the access identifier has only two possibilities, namely the first complete value and the third value. For the case where the access identifier is set to the first complete value, among all the parent nodes whose access identifier is not the third value, the three access identifiers of the first complete value, the second complete value, and the second incomplete value may exist. By modifying the second complete value to the second incomplete value, the reliable marking of the incomplete node can be achieved. When the access identifier of a specified node is set to the third value, the access identifier of the most recent parent node whose access identifier is not the third value must be the first complete value. Therefore, all incomplete nodes above the parent node have been marked based on the previous rule and do not need to be executed repeatedly, which can significantly reduce repeated operations, saving computing resources and improving processing efficiency.

[0065] It should be understood that in response to a request from a specified user to set access rights for a specified node (whether it is the first request or the second request), in addition to determining the access identifier of the specified node (for the first request, it also involves the access identifier of the parent node of the specified node), if there are child nodes under the specified node, then the access identifiers of all child nodes of the specified node must be modified to a third value or deleted, so that the access rights of the specified user to all child nodes of the specified node can be the same as the access rights of the specified user to the specified node based on the default configuration.

[0066] The above describes several embodiments of how to configure access rights in the present disclosure. In addition, optionally, the access rights management method according to the exemplary embodiment of the present disclosure also includes: in response to the target user's access rights acquisition request for the target node, when the target node records the access rights related to the target user, determining the target user's access rights to the target node according to the record, and when the target node does not record the access rights related to the target user, searching upward from the target node for the nearest parent node that records the access rights related to the target user, and determining the target user's access rights to the found parent node as the target user's access rights to the target node. In the case of receiving a request to obtain access rights, the request needs to obtain the target user's access rights to the target node. By searching for the nearest parent node that records the access rights related to the target user when the target user does not record the access rights related to the target user, and using its access rights as the target user's access rights to the target node, the target user's access rights to the target node can be accurately and quickly obtained based on the permission inheritance system of the present disclosure, thereby realizing convenient access rights acquisition.

[0067] Tie down and combine Figures 2 to 5 , introduces a method for managing access rights to directory data according to a specific embodiment of the present disclosure.

[0068] In this specific embodiment, the access permission has a global default permission, and the global default permission is inaccessible. The first request is used to set the access permission to inaccessible, and the second request is used to set the access permission to accessible. Each node of the directory data is configured with an access identifier associated with the user. The value range of the access identifier includes a first complete value, a second complete value, a second incomplete value, and a third value, which are -1, 1, 2, and 0 respectively. The following Table 1 records the access permission status represented by different access identifiers and their meanings: inaccessible, accessible and inheritable, accessible and non-inheritable, and inherited from the parent node. The access permission of each node depends not only on its own access permission status, but may also be related to the access permission status of the parent node.

[0069] Table 1

[0070]

[0071] The access permission management system used to execute the access permission management method disclosed in the present invention is as follows: Figure 2 As shown, it includes a state storage device, a data permission judgment device, a data viewing device, and a data permission operation device. The state storage device is used to record the access status of each node of a certain user; the data permission judgment device is used to judge whether a certain node has access rights; the data viewing device is used for users to view the nodes they have access rights to according to the node hierarchy in the directory data; the data permission operation device is used to authorize or cancel the access to a certain node to a certain user. The device supports directory access rights, that is, if the directory (parent node) is accessible, all subdirectories and files (all child nodes) under the directory are accessible, and also supports the cancellation of access rights to subdirectories and files under the directory separately.

[0072] Specifically, when setting the access rights of the designated user to the designated node, if the second request is received, that is, granting the designated user access rights to the designated node, the data permission operation device can directly set the access flag of the designated node to 1, that is, the accessible inheritable state. At this time, there is no need to check the access flag of the parent node of the designated node, which can simplify the operation.

[0073] If the first request is received, that is, to cancel the access rights of the specified user to the specified node, the operation of the data permission operation device can refer to Figure 3 The flowchart of canceling access rights is shown in FIG. Because it is necessary to support both the accessibility of the parent node and the inaccessibility of some child nodes under the parent node. This involves whether the newly created node is accessible. Generally speaking, if the parent node is accessible, then all child nodes under the parent node should be accessible. At the same time, the new nodes created under the parent node should also be accessible.

[0074] However, if a child node under the parent node controls the permissions independently and becomes inaccessible, then the accessible state of the parent node is not complete. In this specific embodiment, it is defined that if the access permissions of a child node under the parent node become inaccessible, the parent node has incomplete access permissions, and the subsequent newly created child nodes will not be accessible by default.

[0075] Combination Figure 3The process of canceling access rights is that when canceling access rights, if the access identifier of the specified node (specifically, the access identifier associated with the specified node and the specified user, the same below, no longer explained one by one) is 1 or 2, it is set to 0, that is, inheriting the access rights of the parent node. This means that if the access identifier of the specified node is -1 or 0, it remains unchanged. Then, when the access identifier of the specified node is 0, find the parent node with a non-0 access identifier at the nearest level. If its access identifier is greater than 0, that is, 1 or 2, the access identifier of the specified node is set to -1, that is, inaccessible and does not inherit the access status of the parent node. This means that if the access identifier of the parent node found is -1, the access identifier of the specified node remains 0. The access identifier is not directly set to -1 here because if the access right status of the parent node itself is inaccessible, repeated settings at the lower level will cause data redundancy and subsequent maintenance and management will be difficult. In addition, if there are child nodes under the specified node (the specified node must be a directory node in this case), canceling the access rights of the specified node also requires setting the access identifiers of all its child nodes to 0, that is, the default value. This can be achieved by deleting the corresponding entry from the database of the state storage device and using the default logic, that is, the access flag defaults to 0. In addition, for all parent nodes of the specified node with an access flag of 1, the access flag is set to 2, so that when a new node is created under these parent nodes, the new node is inaccessible by default.

[0076] This specific embodiment determines the specific access identifier of the new node according to the access identifier of the parent node of the new node when creating the new node. Figure 4 is a schematic diagram showing a flow chart of setting an access identifier for a new node according to a specific embodiment of the present disclosure. Figure 4 When creating a new node, first find the parent node with a non-0 access flag at the nearest level. Then determine whether the access flag of the parent node is 2 (accessible but not inheritable). If so, the new node is inaccessible, and the access flag of the new node is set to -1; if not, that is, the access flag of the parent node is 1 (accessible and inheritable) or -1 (inaccessible), then the access flag of the new node is set to the default 0, that is, inheriting the access rights of the parent node. If the parent node is accessible, the new node is also accessible. If the parent node is inaccessible, the new node is also inaccessible.

[0077] When the data permission judgment device of this specific embodiment judges whether a user has the permission to access a node, if the node itself does not have a clear access permission, it needs to refer to the access identifier of its parent node (of course, the access identifier of the parent node related to the current user, and the access identifier of the current node is the same, which will not be explained again). If it is an accessible identifier (that is, 1 or 2), the current node is also accessible, unless the current node sets the access identifier to -1. The specific judgment process is as follows: Figure 5 See Figure 5 , first read the access identifier of the current node, of course, it is the access identifier associated with the current node and the current user. If the access identifier is -1, the current node is inaccessible. If the access identifier is greater than 0, that is, 1 or 2, the current node is accessible. If the access identifier is 0, iterate from bottom to top to obtain the access identifiers of the parent nodes of the current node at each level until a parent node whose access identifier is not 0 is found. If the access identifier of the found parent node is greater than 0, the current node is accessible, otherwise it means that the current node is inaccessible. In particular, if the access identifier is still 0 when searching all the way to the top-level directory node, then based on the global default permissions, it is determined that the current node is inaccessible.

[0078] The access rights management method for directory data of this specific embodiment defines the access rights status of accessible or inaccessible for each node by defining the access identifier of the node, and specifically determines whether the user has access rights to the node through a set of access rights judgment logic. When performing the access rights modification operation, the access rights status of the upper and lower related nodes are modified at the same time. This specific embodiment can realize the control management of access rights while occupying the least storage, and supports the access rights control of directory structure data. At the same time, when modifying the access rights, the risk of taking too long due to modifying many data records can be reduced.

[0079] Figure 6 The block diagram shows an apparatus for managing access rights of directory data according to an exemplary embodiment of the present disclosure. The directory data includes multi-level tree nodes, each user has independent access rights to the directory data, and the access rights of the same user to any node are configured to inherit the user's access rights to the parent node of the node by default.

[0080] Reference Figure 6 , the access permission management device 600 for directory data includes a determining unit 601.

[0081] The determination unit 601 may determine the access rights of the designated user to the designated node in response to the access rights setting request of the designated user to the designated node, wherein the access rights of the designated user to all subnodes of the designated node are the same as the access rights of the designated user to the designated node based on the default configuration.

[0082] Optionally, the top-level node of the directory data is configured to be accessible by default; or the top-level node of the directory data is configured to be inaccessible by default.

[0083] Optionally, the access permission management device 600 also includes a search unit (not shown in the figure), which can respond to a request from a specified user to set an access permission for a specified node, search for nodes with access permissions opposite to those corresponding to the access permission setting request among all parent nodes of the specified node that have been set with access permissions, and mark the found nodes as incomplete nodes, which are nodes that are not completely the same as the access permissions of their child nodes.

[0084] Optionally, the access rights management device 600 further includes a creation unit, a reference unit, and a configuration unit (all not shown in the figure). The creation unit may create a new node in response to a request to create a new node; the reference unit may search for a parent node with the lowest level among all parent nodes of the new node that are set with access rights, and record it as a reference parent node; the configuration unit may configure the access rights of a specified user to the new node to be opposite to the access rights of the specified user to the reference parent node when the reference parent node is an incomplete node.

[0085] Optionally, the access permission setting request includes a first request and a second request, one of the first request and the second request is used to set the access permission to be accessible, and the other of the first request and the second request is used to set the access permission to be inaccessible; each node in the directory data is configured with an access identifier associated with a user, the access identifier is used to indicate the access permission of the corresponding user to the corresponding node, and the value range of the access identifier includes at least one of the first incomplete value and the second incomplete value and the first complete value, the second complete value and the third value; wherein the first incomplete value is used to indicate that the corresponding node is an incomplete node, and the corresponding user has the access permission corresponding to the first request to the corresponding node; the second incomplete value is used to indicate that the corresponding node is an incomplete node, and the corresponding user has the access permission corresponding to the second request to the corresponding node; the first complete value is used to indicate that the corresponding node is a complete node, and the corresponding user has the access permission corresponding to the first request to the corresponding node, and the complete node is a node with the same access permission as the child node; the second complete value is used to indicate that the corresponding node is a complete node, and the corresponding user has the access permission corresponding to the second request to the corresponding node; the third value is used to indicate that the access permission of the corresponding user to the corresponding node is inherited from the user's access permission to the parent node of the node, and the third value is the default value of the access identifier.

[0086] Optionally, the first request is used to set the access permission to a global default permission, which is accessible or inaccessible. The determination unit 601 may also set the access identifier associated with the specified user of the specified node to a second complete value in response to a second request from the specified user for the specified node, so as to determine that the access permission of the specified user to the specified node and all its child nodes is different from the global default permission.

[0087] Optionally, the value range of the access identifier does not include the first incomplete value. The determination unit 601 may also respond to the first request of the specified user for the specified node. If the access identifier associated with the specified node and the specified user is not the first complete value, the access identifier associated with the specified node and the specified user may be modified to or maintained as the third value, and the nearest parent node whose access identifier associated with the specified user is not the third value is searched upward from the specified node. If the access identifier associated with the specified user of the found parent node is not the first complete value, the access identifier associated with the specified node and the specified user is modified to the first complete value.

[0088] Optionally, the search unit may also search for a parent node whose access identifier associated with the specified user is a second complete value among all parent nodes of the specified node, while modifying the access identifier associated with the specified node and the specified user to a first complete value, and modify the access identifier associated with the specified user of the found parent node to a second incomplete value.

[0089] Optionally, the global default permission is no access.

[0090] Optionally, the access permission management device also includes an acquisition unit (not shown in the figure), which can respond to the target user's request to obtain access permission for the target node. When the target node records the access permission related to the target user, the acquisition unit determines the target user's access permission to the target node based on the record. When the target node does not record the access permission related to the target user, the acquisition unit searches upward from the target node for the nearest parent node that records the access permission related to the target user, and determines the target user's access permission to the found parent node as the target user's access permission to the target node.

[0091] The above has been referred to Figures 1 to 6 A method and apparatus for managing access rights to directory data according to exemplary embodiments of the present disclosure are described.

[0092] Figure 6 Each unit in the illustrated directory data access rights management device may be configured as software, hardware, firmware, or any combination of the above items to perform a specific function. For example, each unit may correspond to a dedicated integrated circuit, or may correspond to a pure software code, or may correspond to a module combining software and hardware. In addition, one or more functions implemented by each unit may also be uniformly executed by components in a physical entity device (e.g., a processor, a client, or a server, etc.).

[0093] In addition, refer to Figure 1The described access rights management method for directory data can be implemented by a program (or instruction) recorded on a computer-readable storage medium. For example, according to an exemplary embodiment of the present disclosure, a computer-readable storage medium storing instructions can be provided, wherein when the instructions are executed by at least one computing device, the at least one computing device is prompted to execute the access rights management method for directory data according to the present disclosure.

[0094] The computer program in the computer-readable storage medium can be run in an environment deployed in a computer device such as a client, a host, an agent device, a server, etc. It should be noted that the computer program can also be used to perform additional steps in addition to the above steps or perform more specific processing when performing the above steps. The contents of these additional steps and further processing have been described in reference to Figure 1 It is mentioned in the description of the related method, so it will not be repeated here to avoid repetition.

[0095] It should be noted that each unit in the access permission management device for directory data according to the exemplary embodiment of the present disclosure can completely rely on the operation of the computer program to realize the corresponding function, that is, each unit corresponds to each step in the functional architecture of the computer program, so that the entire system is called through a special software package (for example, lib library) to realize the corresponding function.

[0096] on the other hand, Figure 6 The various units shown may also be implemented by hardware, software, firmware, middleware, microcode, or any combination thereof. When implemented by software, firmware, middleware, or microcode, the program code or code segment for performing the corresponding operation may be stored in a computer-readable medium such as a storage medium, so that the processor may perform the corresponding operation by reading and running the corresponding program code or code segment.

[0097] For example, an exemplary embodiment of the present disclosure may also be implemented as a computing device, which includes a storage component and a processor, wherein a set of computer executable instructions is stored in the storage component. When the set of computer executable instructions is executed by the processor, the method for managing access rights to directory data according to the exemplary embodiment of the present disclosure is executed.

[0098] Specifically, the computing device can be deployed in a server or client, or can be deployed on a node device in a distributed network environment. In addition, the computing device can be a PC, a tablet device, a personal digital assistant, a smart phone, a web access permission management device, or other devices capable of executing the above instruction set.

[0099] Here, the computing device is not necessarily a single computing device, but may also be any device or circuit collection that can execute the above instructions (or instruction sets) individually or jointly. The computing device may also be part of an integrated control system or system manager, or may be configured as a portable electronic device that is interconnected with a local or remote (e.g., via wireless transmission) interface.

[0100] In a computing device, a processor may include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller, or a microprocessor. By way of example and not limitation, a processor may also include an analog processor, a digital processor, a microprocessor, a multi-core processor, a processor array, a network processor, etc.

[0101] According to the exemplary embodiment of the present disclosure, some operations described in the method for managing access rights to directory data may be implemented by software, some operations may be implemented by hardware, and further, these operations may be implemented by a combination of software and hardware.

[0102] The processor may execute instructions or codes stored in one of the storage components, which may also store data. Instructions and data may also be sent and received over a network via a network interface device, which may employ any known transmission protocol.

[0103] The storage component may be integrated with the processor, for example, RAM or flash memory is arranged within an integrated circuit microprocessor, etc. In addition, the storage component may include a separate device, such as an external disk drive, a storage array, or any other storage device that can be used by a database system. The storage component and the processor may be operatively coupled, or may communicate with each other, such as through an I / O port, a network connection, etc., so that the processor can read files stored in the storage component.

[0104] In addition, the computing device may also include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, a mouse, a touch input device, etc.) All components of the computing device may be connected to each other via a bus and / or a network.

[0105] The access authority management method for directory data according to the exemplary embodiment of the present disclosure can be described as various interconnected or coupled functional blocks or functional diagrams. However, these functional blocks or functional diagrams can be equally integrated into a single logical device or operate according to non-exact boundaries.

[0106] Therefore, refer to Figure 1 The described method for managing access rights to directory data may be implemented by a system including at least one computing device and at least one storage device storing instructions.

[0107] According to an exemplary embodiment of the present disclosure, at least one computing device is a computing device for executing the access permission management method for directory data according to an exemplary embodiment of the present disclosure, and a computer executable instruction set is stored in the storage device. When the computer executable instruction set is executed by the at least one computing device, the execution references Figure 1 Described is a method for managing access rights to directory data.

[0108] According to an exemplary embodiment of the present disclosure, a computer program product may also be provided, including instructions, which, when executed by at least one computing device, prompt the at least one computing device to execute the access permission management method for directory data according to the present disclosure.

[0109] The above describes various exemplary embodiments of the present disclosure, and it should be understood that the above description is only exemplary and not exhaustive, and the present disclosure is not limited to the disclosed exemplary embodiments. Without departing from the scope and spirit of the present disclosure, many modifications and changes are obvious to those of ordinary skill in the art. Therefore, the scope of protection of the present disclosure should be based on the scope of the claims.

Claims

1. A method for managing access rights to directory data, characterized in that: The directory data includes multi-level tree nodes, each user has independent access rights to the directory data, and the access rights of the same user to any node are configured to inherit the user's access rights to the parent node of the node by default. The access rights management method includes: In response to a request from a specified user to set an access permission for a specified node, determining the access permission of the specified user for the specified node, The access rights of the designated user to all subnodes of the designated node are the same as the access rights of the designated user to the designated node based on the default configuration.

2. The access rights management method according to claim 1, characterized in that: The top-level node of the directory data is configured to be accessible by default; or The top-level nodes of the directory data are configured to be inaccessible by default.

3. The access rights management method according to claim 1, characterized in that: The access rights management method further includes: In response to the designated user's request to set access rights for the designated node, search for nodes with access rights opposite to those corresponding to the access rights setting request among all parent nodes of the designated node that have been set with access rights, and mark the found nodes as incomplete nodes, where the incomplete nodes are nodes whose access rights are not exactly the same as those of their child nodes.

4. The access rights management method according to claim 3, characterized in that: The access rights management method further includes: In response to the new node creation request, create a new node; Find the lowest-level parent node among all parent nodes of the new node that are set with access rights, and record it as the reference parent node; In the case that the reference parent node is the incomplete node, the access permission of the designated user to the new node is configured to be opposite to the access permission of the designated user to the reference parent node.

5. The access rights management method according to claim 3, characterized in that: The access permission setting request includes a first request and a second request, one of the first request and the second request is used to set the access permission to be accessible, and the other of the first request and the second request is used to set the access permission to be inaccessible; Each node in the directory data is configured with an access identifier associated with a user, the access identifier is used to indicate the access rights of the corresponding user to the corresponding node, and the value range of the access identifier includes at least one of a first incomplete value and a second incomplete value and a first complete value, a second complete value and a third value; The first incomplete value is used to indicate that the corresponding node is the incomplete node, and the corresponding user has the access authority corresponding to the first request for the corresponding node; The second incomplete value is used to indicate that the corresponding node is the incomplete node, and the corresponding user has the access authority corresponding to the second request for the corresponding node; The first complete value is used to indicate that the corresponding node is a complete node, and the corresponding user has the access permission corresponding to the first request to the corresponding node, and the complete node is a node with the same access permission as the child node; The second complete value is used to indicate that the corresponding node is the complete node, and the corresponding user has the access authority corresponding to the second request for the corresponding node; The third value is used to indicate that the access right of the corresponding user to the corresponding node is inherited from the user's access right to the parent node of the node, and the third value is a default value of the access identifier.

6. The access rights management method according to claim 5, characterized in that: The first request is used to set the access permission to a global default permission, the global default permission is accessible or inaccessible, the value range of the access identifier does not include the first incomplete value, wherein, in response to the access permission setting request of the specified user for the specified node, determining the access permission of the specified user to the specified node includes: In response to the second request of the specified user to the specified node, the access identifier associated with the specified user of the specified node is set to the second complete value to determine that the access rights of the specified user to the specified node and all its child nodes are different from the global default rights.

7. The access rights management method according to claim 6, characterized in that: The step of determining the access rights of the specified user to the specified node in response to the request of the specified user to set the access rights to the specified node further includes: In response to the first request of the designated user to the designated node, if the access identifier associated with the designated node and the designated user is not the first complete value, the access identifier associated with the designated node and the designated user is modified to or maintained as the third value, and the nearest parent node whose access identifier associated with the designated user is not the third value is searched upward from the designated node; if the access identifier associated with the designated user of the found parent node is not the first complete value, the access identifier associated with the designated node and the designated user is modified to the first complete value.

8. The access rights management method according to claim 7, characterized in that: The searching for a node having an access right opposite to that corresponding to the access right setting request among all parent nodes of the designated node that are set with access rights, and marking the found node as an incomplete node, includes: When the access identifier associated with the specified node and the specified user is modified to the first complete value, a parent node whose access identifier associated with the specified user is the second complete value is searched among all parent nodes of the specified node, and the access identifier associated with the specified user of the found parent node is modified to the second incomplete value.

9. A device for managing access rights to directory data, characterized in that: The directory data includes multi-level tree nodes, each user has independent access rights to the directory data, and the access rights of the same user to any node are configured to inherit the user's access rights to the parent node of the node by default. The access rights management device includes: a determining unit configured to determine the access rights of the specified user to the specified node in response to a request from the specified user to set the access rights to the specified node, The access rights of the designated user to all subnodes of the designated node are the same as the access rights of the designated user to the designated node based on the default configuration.

10. A computer-readable storage medium storing instructions, characterized in that: When the instructions are executed by at least one computing device, the at least one computing device is prompted to execute the method for managing access rights to directory data as claimed in any one of claims 1 to 8.

Images