Access control method and system, storage medium and program product
By obtaining and parsing access control table update events from the preset expression library and updating access control tables, the problem of high complexity in access control table updates in the prior art is solved, and more efficient management and security are achieved.
Patent Information
- Application Number
- CN202411320191.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-20
- Publication Date
- 2024-12-31
AI Technical Summary
When updating access control tables in the prior art, since each type of access control table has specific update logic and rules, it is necessary to customize the development code logic, resulting in high complexity.
Access control is achieved by obtaining the target expression from the preset expression library, parsing the update event, obtaining the access control table to be updated, and updating the table according to the target update field instance.
Reduces the complexity of access control table updates, improves management efficiency, reduces administrative expenses, avoids naming conflicts and understanding differences between different developers or teams, and improves data consistency and security.
Smart Images
Figure CN119227108A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of computer technology, and in particular to an access control method, system, storage medium and program product. Background Art
[0002] Generally speaking, the three most concerned issues in the process of information resource transmission are "which resources need to be protected", "which subjects can access the protected resources", and "which operations can these authorized subjects perform on the protected resources". The three types of questions correspond to three types of resources, namely subjects, objects, and permissions. In essence, access control is to achieve system resource management and access restriction through subjects, objects, and control strategies to prevent illegal users from entering the system to damage information resources, illegally use them, and use resource information for illegal activities.
[0003] In the existing technology, methods such as discretionary access control (DAC), mandatory access control (MAC) and role-based access control (RBAC) can all implement access control. In the process of implementing access control, it is necessary to maintain the access control list, which can be maintained for updating, reviewing, backing up and restoring the content of the access control list.
[0004] However, in the process of updating the access control list, since each type of access control list has its own specific update logic and rules, it is necessary to customize the development code logic for each type of access control list to implement the update, which is highly complex. Summary of the invention
[0005] In order to solve one of the above technical problems, the present disclosure provides an access control method, system, storage medium and program product.
[0006] According to one aspect of the present disclosure, there is provided an access control method, comprising: In response to any access control list update event, obtaining a target expression corresponding to the access control list update event from a preset expression library; Parsing the access control list update event according to the target expression to obtain a target update field instance; Obtain the access control list to be updated corresponding to the access control list update event; Update the access control list to be updated according to the target update field instance to obtain a target access control list; Among them, the target access control list is used to implement access control; the preset expression library is used to store multiple query language expressions, and the query language expressions are used to parse field instances from corresponding access control list update events according to query syntax corresponding to access control list update rules.
[0007] According to the access control method provided by at least one embodiment of the present disclosure, in response to any access control table update event, obtaining a target expression corresponding to the access control table update event from a preset expression library includes: Get the monitored operation events; Determining whether the operation event is an access control list update event; If yes, get the target expression corresponding to the operation event from the preset expression library.
[0008] According to the access control method provided by at least one embodiment of the present disclosure, the step of obtaining a target expression corresponding to the access control table update event from a preset expression library includes: Obtain control-related events that affect access control relationships; Obtaining a query language expression corresponding to the control-related event; Constructing the preset expression library according to the query language expression; A target expression corresponding to the access control list update event is obtained from the preset expression library.
[0009] According to the access control method provided by at least one embodiment of the present disclosure, the step of obtaining the access control list to be updated corresponding to the access control list update event includes: Obtain multiple initial access control lists; Grouping the multiple initial access control tables according to a preset grouping dimension to obtain a control table group; The control tables in the control table group are integrated to obtain the access control table to be updated.
[0010] According to the access control method provided by at least one embodiment of the present disclosure, the integrating the control tables in the control table group includes: Obtain the first field name of the control table in the control table group; Obtaining a field name mapping relationship between a preset second field name of the access control table to be updated and the first field name; The control tables in the control table group are integrated according to the first field name and the field name mapping relationship.
[0011] According to the access control method provided by at least one embodiment of the present disclosure, the updating of the to-be-updated access control table according to the target update field instance includes: Obtain the update method corresponding to the access control list update event; The access control list to be updated is updated according to the target update field instance and the update mode.
[0012] According to at least one embodiment of the present disclosure, the access control method provided further includes: In response to the accuracy verification being triggered, obtaining the verification update field instance, the start access control list and the end access control list corresponding to the accuracy verification according to the target update field instance, the access control list to be updated and the target access control list obtained during the access control list update process; The verification update field instance, the start access control list and the end access control list are verified for accuracy to obtain a verification result.
[0013] According to another aspect of the present disclosure, there is provided an access control system, comprising: a memory storing execution instructions; and A processor executes the execution instruction stored in the memory, so that the processor executes the access control method provided by any embodiment of the present disclosure.
[0014] According to another aspect of the present disclosure, a readable storage medium is provided, wherein the readable storage medium stores execution instructions, and when the execution instructions are executed by a processor, the access control method provided in any embodiment of the present disclosure is implemented.
[0015] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the access control method provided in any embodiment of the present disclosure is implemented. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] The accompanying drawings illustrate exemplary embodiments of the present disclosure and together with the description serve to explain the principles of the present disclosure. These drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification.
[0017] Figure 1 It is a schematic flowchart of an access control method provided according to an embodiment of the present disclosure.
[0018] Figure 2 This is the process of the access control method provided in Example 1 of the present disclosure Figure 1 .
[0019] Figure 3 yes Figure 2 The process of obtaining the target expression method in the access control method shown Figure 1 .
[0020] Figure 4 yes Figure 2 The process of obtaining the target expression method in the access control method shown Figure 2 .
[0021] Figure 5 yes Figure 2 A flowchart of a method for obtaining a field instance in the access control method shown.
[0022] Figure 6 yes Figure 2 A flowchart of a method for obtaining an access control list to be updated in the access control method shown.
[0023] Figure 7 yes Figure 6 The flowchart of the control table integration method in the method of obtaining the access control list to be updated is shown.
[0024] Figure 8 yes Figure 2 A flowchart of a control table updating method in an access control method is shown.
[0025] Fig. 9 This is the process of the access control method provided in Example 1 of the present disclosure Figure 2 .
[0026] Fig.10 This is the process of the access control method provided in Example 1 of the present disclosure Figure 3 .
[0027] Fig.11 This is the process of the access control method provided in Example 1 of the present disclosure Figure 4 .
[0028] Fig.12 This is a schematic diagram of the structure of the access control system provided by Example 2 of the present disclosure. Figure 1 .
[0029] Fig.13 This is a schematic diagram of the structure of the access control system provided by Example 2 of the present disclosure. Figure 2 . DETAILED DESCRIPTION
[0030] The present disclosure is further described in detail below in conjunction with the accompanying drawings and examples. It is understood that the specific examples described herein are only used to explain the relevant content, rather than to limit the present disclosure. It should also be noted that, for ease of description, only the parts related to the present disclosure are shown in the accompanying drawings.
[0031] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in the present disclosure can be combined with each other. The technical solution of the present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0032] Access control is a technology that limits user access to certain information items or the use of certain control functions based on user identity and the defined group to which they belong. In discretionary access control (DAC), each resource (such as files and directories) has an associated access control list, which records in detail which users or user groups can perform which operations (read, write, execute, etc.); mandatory access control (MAC) determines access rights through security labels (such as security levels and classifications). In the implementation process, it is necessary to maintain access control lists that describe the security levels of subjects and objects; role-based access control (RBAC) associates permissions with roles through access control lists. That is, the access control process generally requires the maintenance of access control lists to execute corresponding decisions. This maintenance can be for updating, reviewing, backing up, and restoring the content of the access control list; and in the process of updating the access control list, since each type of access control list has its own specific update logic and rules, it is necessary to customize the development code logic for each type of access control list to implement the update, which is relatively complex.
[0033] Figure 1 A schematic flow chart of the access control method according to an embodiment of the present disclosure is shown. Figure 1 The detailed description is for a clearer understanding of the technical solution of the present disclosure and should not be considered as a limitation of the protection scope of the present disclosure. In the process of implementing the technical idea of the present disclosure, one or some steps may be omitted, or other alternatives may be adopted.
[0034] refer to Figure 1 , the access control method of this embodiment includes: Step S110, obtaining monitored operation events.
[0035] Step S111, determining whether the operation event is an access control list update event.
[0036] Step S112: If yes, obtain control-related events that affect the access control relationship.
[0037] Step S113, obtaining a query language expression corresponding to the control-related event.
[0038] Step S114, constructing a preset expression library according to the query language expression.
[0039] Step S115, obtaining a target expression corresponding to the operation event from a preset expression library.
[0040] Step S116: try to parse the operation event through the target expression.
[0041] In some embodiments of the present disclosure, if the attempt through step S116 fails, step S116 is re-executed until it is terminated when a preset termination condition is reached; if the attempt through step S116 is successful, step S117 is executed.
[0042] Step S117, obtaining a target update field instance obtained by parsing the operation event.
[0043] Step S118, obtaining multiple initial access control lists.
[0044] Step S119: grouping the multiple initial access control lists according to a preset grouping dimension to obtain a control list group.
[0045] Step S120, obtaining the first field name of the control table in the control table group.
[0046] Step S121, obtaining a field name mapping relationship between a preset second field name and a first field name of the access control table to be updated.
[0047] Step S122: integrating the control tables in the control table group according to the first field name and the field name mapping relationship to obtain an access control table to be updated.
[0048] Step S123, obtaining the update method corresponding to the operation event.
[0049] Step S124, updating the access control list to be updated according to the target update field instance and the update mode to obtain the target access control list.
[0050] In some embodiments of the present disclosure, a target access control list is used to implement access control.
[0051] Step S125, backing up the access control list to be updated before and after the update.
[0052] Step S126, in response to the accuracy verification being triggered, obtain the verification update field instance, the starting access control list and the ending access control list corresponding to the accuracy verification according to the target update field instance, the access control list to be updated and the target access control list obtained during the access control list update process.
[0053] Step S127, verify the accuracy of the verification update field instance, the start access control list and the end access control list to obtain a verification result.
[0054] Step S128: When the verification result is inconsistent, data compensation is performed according to the verification result.
[0055] Combine the following Figures 2 to 11 The access control method disclosed in the present invention is described in detail.
[0056] Embodiment 1: Figure 2 Flowchart M200 of an access control method according to an embodiment of the present disclosure.
[0057] Step S210: In response to any access control list update event, a target expression corresponding to the access control list update event is obtained from a preset expression library.
[0058] Step S220: parsing the access control list update event according to the target expression to obtain a target update field instance.
[0059] Step S230: obtaining the access control list to be updated corresponding to the access control list update event.
[0060] Step S240: updating the access control list to be updated according to the target update field instance to obtain the target access control list.
[0061] Among them, the target access control list is used to implement access control; the preset expression library is used to store multiple query language expressions, and the query language expressions are used to parse field instances from corresponding access control list update events according to the query syntax corresponding to the access control list update rules.
[0062] The access control method provided by the present disclosure parses the access control table update event through the target expression corresponding to the access control table update event, obtains the target update field instance, and then updates the access control table to be updated according to the target update field instance to obtain the target access control table, thereby realizing access control. The access control method realizes the management of the access control table update rules by controlling the query syntax of the query language expression, thereby improving the management efficiency, reducing the management cost, and solving the problem that in the process of updating the access control table in the prior art, since each type of access control table has its own specific update logic and rules, it is necessary to customize the development code logic for each type of access control table to realize the update, which results in high complexity.
[0063] In some embodiments of the present disclosure, the access control list update event in step S210 usually occurs when the security policy in the network device, server, application or cloud service needs to be adjusted, for example: user role change (such as when user X is promoted to administrator, the user will have more access rights; when user X leaves, all access rights of the user need to be revoked, etc.), security policy change (such as restricting access to certain external IP addresses, relaxing access to certain services in the internal network, etc.), network device or service addition (such as when a new server, network device or application service is introduced, new access control rules need to be added to control access to the new server, network device or application service), etc. Figure 3 As shown, step S210 may include: step S211, obtaining the monitored operation event; step S212, determining whether the operation event belongs to an access control list update event; step S213, if it does, obtaining the target expression corresponding to the operation event from the preset expression library. The operation event of the access control object can be monitored, and if monitored, it is obtained through step S211; if not monitored or it is determined through step S212 that the monitored operation event does not belong to an access control list update event, the step of monitoring the operation event of the access control object can be continued. Step S212 can first obtain the control-related events that affect the access control relationship, and then determine whether the control-related events include the operation event; if included, the operation event belongs to an access control list update event; otherwise, the operation event does not belong to an access control list update event. Among them, the operation event refers to an event related to the user interface interaction or the change of the internal state of the system.
[0064] In some embodiments of the present disclosure, Figure 4 As shown, step S210 may also include: step S214, obtaining control-related events that affect access control relationships; step S215, obtaining query language expressions corresponding to control-related events; step S216, building a preset expression library based on the query language expressions; step S217, obtaining a target expression corresponding to the access control table update event from the preset expression library. The content of the control-related events may be preset; the process of obtaining the query language expression in step S215 may include: first obtaining the access control table update rule corresponding to the control-related event, and then obtaining the query language expression based on the access control table update rule. The query language expression is a language structure used to retrieve, filter and operate data in databases and data processing; the query language expression in the present disclosure is specifically a language structure for parsing field instances from update events.
[0065] In some embodiments of the present disclosure, Figure 5As shown, step S220 may include: step S221, attempting to parse the access control table update event through the target expression; if the attempt is successful through step S221, executing step S222; if the attempt fails through step S221, re-executing step S221 until the preset deadline condition is reached; step S222, obtaining the target update field instance obtained by parsing the access control table update event. The preset deadline condition may be that the number of attempts reaches a preset threshold, the attempt time reaches a preset threshold, etc.; the target update field instance is an instance of a specific data item or column in the access control table to be updated.
[0066] In some embodiments of the present disclosure, Figure 6 As shown, step S230 may include: step S231, obtaining multiple initial access control lists; step S232, grouping the multiple initial access control lists according to a preset grouping dimension to obtain a control list group; step S233, integrating the control lists in the control list group to obtain an access control list to be updated. Among them, the multiple initial access control lists may be access control lists generated as business scenarios develop. Taking the application of access control lists to order access control as an example, the multiple initial access control lists may be organization order access control lists, service provider order access control lists, business manager order access control lists, user order access control lists, relative number order access control lists, project order access control lists, platform personnel order access control lists, and the like. The preset grouping dimension in step S232 refers to the dimension for grouping access control lists, which may be an object-oriented dimension (such as user side, system side), a number range dimension, a control mode dimension (such as autonomous control, mandatory control), and the like. Figure 7 As shown, step S233 may include: step S2331, obtaining the first field name of the control table in the control table group; step S2332, obtaining the field name mapping relationship between the preset second field name and the first field name of the access control table to be updated; step S2333, integrating the control tables in the control table group according to the first field name and the field name mapping relationship. The field name of a control table is the descriptive name of the column in the control table, which is used to identify and understand the data content stored in the column; the first field name can be named by different developers or teams, and the first field names of different control tables can be different; the preset second field name can be a preset unified name of the key content, and the mapping relationship is the corresponding relationship between the first field name and the second field name; integrating the control table is the process of collating and merging multiple control tables into one control table. The second field name may include order_no, entity_code, entity_name, entity_type, entity_sub_type, create_time, update_time, status and ext_info, etc.
[0067] Taking the control table group including three control tables A, B and C, the first field names of control table A include order_no, service_name, service_id and service_role, the first field names of control table B include order_no, organization_code, organization_level and gbcode, and the first field names of control table C include order_no, project_id, project_type and gbcode as an example, the mapping relationship can be that service_id, organization_code and project_id correspond to entity_code, service_role, organization_level and project_type correspond to entity_sub_type, etc.
[0068] In some embodiments of the present disclosure, when access control is first executed, the access control list to be updated can be obtained through steps S231 to S233; in the subsequent access control execution process, the access control list to be updated is the target access control list obtained in the previous access control process. Steps S231 to S233 implement access control through grouped access control lists corresponding to preset dimensions, which reduces the number of access control lists, prevents the rapid expansion of access control lists, improves response time and overall performance, reduces the risk of errors, and avoids naming conflicts and differences in understanding between different developers or teams, reduces confusion, and improves data consistency.
[0069] In some embodiments of the present disclosure, Figure 8 As shown, step S240 may include: step S241, obtaining the update mode corresponding to the access control table update event; step S242, updating the access control table to be updated according to the target update field instance and the update mode. Among them, the update mode can be in-place update (modifying data directly at the current location of the data, usually used when the data size remains unchanged or changes very little, which can reduce storage overhead and improve space utilization) or write update after deletion (writing new data to a new location and marking the original data as invalid or deleted, suitable for situations where the data size may change), etc. When updating the access control table to be updated according to the target update field instance, it can be determined first according to the target update field instance which field of the access control table to be updated needs to be updated (such as the first field of the first access control table to be updated needs to be updated), and then the first field of the first access control table to be updated is updated according to the target update field instance. The update mode can be set based on each access control table update event, or it can be set based on the event type of the access control table update event, etc.
[0070] Furthermore, if Fig. 9 As shown, the access control method provided by the embodiment of the present disclosure may also include: Step S250, backing up the access control list to be updated before and after the update.
[0071] In some embodiments of the present disclosure, in order to ensure data security and business continuity, the control table before and after the update can be backed up in step S250, and the data backup can be a full backup, an incremental backup, or a remote backup. The content of the data backup can be stored in a change record table, and the content of the change record table may include: field name, field instance before change, field instance after change, change time, etc.
[0072] Furthermore, if Fig.10 As shown, the access control method provided by the embodiment of the present disclosure may further include, after obtaining the target access control list: Step S260, in response to accuracy verification being triggered, obtain the verification update field instance, the start access control list and the end access control list corresponding to the accuracy verification according to the target update field instance, the access control list to be updated and the target access control list obtained during the access control list update process.
[0073] In some embodiments of the present disclosure, the accuracy verification in step S260 is triggered, including the accuracy verification being triggered by a timer, an instruction, or a preset event; the verification update field instance obtained by step S260 can be a field instance corresponding to all access control table update events that occurred from the previous accuracy verification to the current accuracy verification; the starting access control table obtained by step S260 is the control table at the time of the previous accuracy verification; the ending access control table obtained by step S260 is the control table at the time of the current accuracy verification.
[0074] Step S270, verify the accuracy of the verification update field instance, the start access control list and the end access control list to obtain a verification result.
[0075] In some embodiments of the present disclosure, the accuracy verification process of step S270 can be a process of updating the control table according to the starting access control table and the updated field instance and then determining whether the updated result is consistent with the ending access control table. Figure 2 Similar to that shown.
[0076] At this time, when the verification result obtained by step S270 is inconsistent, Fig.11 As shown, the access control method may further include: Step S280: Perform data compensation according to the verification result.
[0077] In some embodiments of the present disclosure, the process of performing data compensation through step S280 may include: first obtaining error data according to the verification result; and then obtaining compensation data corresponding to the error data according to the starting access control table and the update field instance.
[0078] Step S290: Send an inconsistency notification to a preset terminal.
[0079] In some embodiments of the present disclosure, when the verification result is inconsistent, an alarm process can be executed to send an inconsistency notification to relevant users, who may be administrators, operation and maintenance personnel, security personnel, etc.; the preset terminal in step S290 is the terminal corresponding to the relevant user.
[0080] The access control method provided in the embodiment of the present disclosure may only include step S280 or step S290. In this case, the access control process is the same as Fig.11 By triggering accuracy verification at a fixed time, the access control table anomalies can be discovered and repaired in a timely manner, the accuracy and integrity of the access control table can be guaranteed, security can be improved, and losses caused by anomalies can be avoided.
[0081] Figure 12 to Figure 13 The access control system of the present invention can be implemented based on a hardware implementation method using a processor.
[0082] Embodiment 2: An embodiment of the present disclosure provides an access control system.
[0083] The system may include corresponding modules for executing each or several steps in the above flowchart. Therefore, each step or several steps in the above flowchart may be executed by the corresponding module, and the system may include one or more modules in these modules. The module may be one or more hardware modules specially configured to execute the corresponding steps, or implemented by a processor configured to execute the corresponding steps, or stored in a computer-readable medium for implementation by a processor, or implemented by some combination.
[0084] Fig.12 An access control system 1000 is shown that employs a hardware implementation of a processing system. The hardware may be implemented using a bus architecture. The bus architecture may include any number of interconnecting buses and bridges, depending on the specific application and overall design constraints of the hardware. The bus 1100 connects together various circuits including one or more processors 1200, memory 1300, and / or hardware modules. The bus 1100 may also connect various other circuits 1400 such as peripherals, voltage regulators, power management circuits, external antennas, etc., which are conventional techniques in the art and will not be described further.
[0085] like Fig.12 As shown, the access control system according to the present disclosure may include: The target expression module 1010 is used to obtain a target expression corresponding to any access control list update event from a preset expression library in response to the access control list update event.
[0086] The update field instance module 1020 is used to parse the access control list update event according to the target expression to obtain a target update field instance.
[0087] The access control list module 1030 is used to obtain the access control list to be updated corresponding to the access control list update event.
[0088] The control table updating module 1040 is used to update the access control table to be updated according to the target update field instance to obtain the target access control table.
[0089] Among them, the target access control list is used to implement access control; the preset expression library is used to store multiple query language expressions, and the query language expressions are used to parse field instances from corresponding access control list update events according to the query syntax corresponding to the access control list update rules.
[0090] Furthermore, the access control system provided by the embodiment of the present disclosure may also include: The backup module 1050 is used to back up the access control list to be updated before and after the update.
[0091] Furthermore, the access control system provided by the embodiment of the present disclosure may also include: The verification parameter module 1060 is used to obtain the verification update field instance, the start access control list and the end access control list corresponding to the accuracy verification according to the target update field instance, the access control list to be updated and the target access control list obtained in the access control list update process in response to the accuracy verification being triggered; The accuracy verification module 1070 is used to verify the accuracy of the verification update field instance, the start access control list and the end access control list to obtain a verification result.
[0092] When the verification result is inconsistent, the access control system may further include: Notification module 1080, used to send an inconsistency notification to a preset terminal; The data compensation module 1090 is used to perform data compensation according to the verification result.
[0093] In some embodiments of the present disclosure, the access control system may also include only one of the notification module 1080 and the data compensation module 1090 .
[0094] When the access control system provided by the embodiment of the present disclosure includes all the above modules, the structure of the access control system is as follows: Fig.13 As shown; when the access control system only includes some of the above modules, its structure is similar to Fig.13 The process of implementing access control through the above modules in the access control system and the process of implementing the functions of each module in the access control system are similar to those provided in the embodiment 1 of the present disclosure.
[0095] The access control system provided in the embodiments of the present disclosure may be an electronic device, such as a server, etc. The resources monitored and managed by the access control system may include: physical resources (such as controlling access to specific buildings, floors or rooms, controlling the operation or contact of sensitive equipment such as laboratory equipment, IT hardware, server rooms, etc.), digital resources (such as controlling access to internal networks, external networks or specific network services, controlling access to specific folders, documents, data resources, etc.); wherein the data resources may be customer information, financial data, human resources information, supply chain data, sales data, production data or order data, etc.
[0096] The present disclosure also provides a readable storage medium, in which a computer program is stored, and the computer program is used to implement the above method when executed by a processor. "Readable storage medium" can be any device that can contain, store, communicate, propagate or transmit a program for use in an instruction execution system, device or equipment or in combination with these instruction execution systems, devices or equipment. More specific examples of readable storage media include the following: an electrical connection portion (electronic device) with one or more wirings, a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable read-only memory (CDROM), etc.
[0097] The present disclosure also provides a computer program product. The method of the present disclosure can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed, the process or function of the present disclosure is executed in whole or in part.
[0098] The computer program or instructions may be stored in a readable storage medium or transmitted from one readable storage medium to another readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The readable storage medium may be any available medium that can be accessed or a data storage device such as a server, data center, etc. that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid state drive. The computer readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.
[0099] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0100] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0101] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0103] In the description of this specification, the description with reference to the terms "one embodiment / method", "some embodiments / methods", "example", "specific example", or "some examples" etc. means that the specific features, structures, or characteristics described in conjunction with the embodiment / method or example are included in at least one embodiment / method or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment / method or example. Moreover, the specific features, structures, or characteristics described may be combined in any one or more embodiments / methods or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments / methods or examples described in this specification and features of different embodiments / methods or examples, unless they are contradictory.
[0104] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, "plurality" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.
[0105] Those skilled in the art should understand that the above embodiments are only for the purpose of clearly illustrating the present disclosure, and are not intended to limit the scope of the present disclosure. For those skilled in the art, other changes or modifications may be made based on the above disclosure, and these changes or modifications are still within the scope of the present disclosure.
Claims
1. An access control method, characterized in that: include: In response to any access control list update event, obtaining a target expression corresponding to the access control list update event from a preset expression library; Parsing the access control list update event according to the target expression to obtain a target update field instance; Obtain the access control list to be updated corresponding to the access control list update event; as well as Update the access control list to be updated according to the target update field instance to obtain a target access control list; Among them, the target access control list is used to implement access control; the preset expression library is used to store multiple query language expressions, and the query language expressions are used to parse field instances from corresponding access control list update events according to query syntax corresponding to access control list update rules.
2. The access control method according to claim 1, characterized in that: The step of obtaining, in response to any access control list update event, a target expression corresponding to the access control list update event from a preset expression library comprises: Get the monitored operation events; Determining whether the operation event is an access control list update event; and If yes, get the target expression corresponding to the operation event from the preset expression library.
3. The access control method according to claim 1, characterized in that: The step of obtaining a target expression corresponding to the access control list update event from a preset expression library includes: Obtain control-related events that affect access control relationships; Obtaining a query language expression corresponding to the control-related event; Constructing the preset expression library according to the query language expression; and A target expression corresponding to the access control list update event is obtained from the preset expression library.
4. The access control method according to any one of claims 1 to 3, characterized in that: The obtaining of the access control list to be updated corresponding to the access control list update event includes: Obtain multiple initial access control lists; Grouping the multiple initial access control tables according to a preset grouping dimension to obtain a control table group; and The control tables in the control table group are integrated to obtain the access control table to be updated.
5. The access control method according to claim 4, characterized in that: The integrating the control tables in the control table group includes: Obtain the first field name of the control table in the control table group; Acquire a field name mapping relationship between a preset second field name of the access control table to be updated and the first field name; and The control tables in the control table group are integrated according to the first field name and the field name mapping relationship.
6. The access control method according to any one of claims 1 to 3, characterized in that: The updating of the to-be-updated access control list according to the target update field instance comprises: Obtaining the update method corresponding to the access control list update event; and The access control list to be updated is updated according to the target update field instance and the update mode.
7. The access control method according to any one of claims 1 to 3, characterized in that: After obtaining the target access control list, it also includes: In response to the accuracy verification being triggered, obtaining the verification update field instance, the start access control list and the end access control list corresponding to the accuracy verification according to the target update field instance, the access control list to be updated and the target access control list obtained during the access control list update process; and The verification update field instance, the start access control list and the end access control list are verified for accuracy to obtain a verification result.
8. An access control system, characterized in that: include: A memory storing execution instructions; as well as A processor, wherein the processor executes the execution instruction stored in the memory, so that the processor executes the access control method according to any one of claims 1 to 7.
9. A readable storage medium, characterized in that: The readable storage medium stores execution instructions, which are used to implement the access control method according to any one of claims 1 to 7 when executed by a processor.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the access control method according to any one of claims 1 to 7 is implemented.