User access control method, system and device, equipment and storage medium

Abstract

The embodiment of the invention provides a user access control method, system and device, electronic equipment and a storage medium. The method comprises the following steps: receiving an access request sent by a client; the access request comprises identification information of a user; obtaining mapping information according to the identification information of the user; the mapping information comprises identification information and authority information of a target user mapped by the user; and executing an access operation corresponding to the access request according to the identification information and the authority information of the target user. According to the method, a file access control list does not need to be set for each user, only a small number of target users need to be configured in the server side, and the permission access control requirements of a large number of users can be met in the mode that the users are mapped to the target users.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a user access control method, a user access control system, a user access control device, an electronic device and a computer-readable storage medium. Background Art

[0002] With the rapid development of the Internet, in the current implementation of the network file system protocol, the directory permission management of the network file system share export supports the permission management at the entire client level, that is, the specified client Internet communication protocol or network segment has unified permissions, such as read-only, read-write, and prohibited. If you want to set permission management for users, you need to use the file access control list permission control to set the permissions of the specified user for the directory or file. If there are many users, you need to set a file access control list for each user.

[0003] Since the number of file access control list entries that can be set for a single directory / file is not unlimited, there is an upper limit. Therefore, if the number of users exceeds the upper limit, the corresponding file access control list permissions cannot be set for the excess users. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a user access control method, a user access control system, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] In a first aspect, an embodiment of the present invention discloses a user access control method, which is applied to a server, and the method includes:

[0006] Receiving an access request sent by a client; the access request includes identification information of the user;

[0007] According to the identification information of the user, mapping information is acquired; the mapping information includes identification information and permission information of the target user mapped by the user;

[0008] An access operation corresponding to the access request is performed according to the identification information and permission information of the target user.

[0009] Optionally, the mapping information also includes a validity period;

[0010] The performing the access operation corresponding to the access request according to the identification information and permission information of the target user includes:

[0011] Determining whether the validity period has expired;

[0012] If the validity period has not expired, the access operation corresponding to the access request is performed according to the identification information and permission information of the target user.

[0013] Optionally, it also includes:

[0014] If the validity period has expired, obtaining the permission information of the user;

[0015] An access operation corresponding to the access request is performed according to the identification information and permission information of the user.

[0016] Optionally, it also includes:

[0017] After receiving the access request sent by the client, determining whether the user of the client turns on the mapping function;

[0018] The acquiring mapping information according to the identification information of the user includes:

[0019] If the user of the client has enabled the mapping function, the mapping information is obtained according to the identification information of the user.

[0020] Optionally, it also includes:

[0021] Receiving a mapping information configuration request sent by the client; the mapping information configuration request includes identification information of the user and a configuration instruction;

[0022] Mapping information is configured for the user according to the identification information and the configuration instruction of the user.

[0023] Optionally, configuring mapping information for the user according to the identification information and the configuration instruction of the user includes:

[0024] When the configuration instruction is an add instruction, determining whether corresponding mapping information exists according to the identification information of the user; if mapping information corresponding to the identification information of the user does not exist, assigning a target user and a validity period to the user; using the identification information, permission information and the validity period of the target user as the mapping information of the user; and storing the identification information of the user and the mapping information in correspondence;

[0025] When the configuration instruction is a deletion instruction, if mapping information corresponding to the identification information of the user exists, the mapping information corresponding to the identification information of the user is deleted;

[0026] When the configuration instruction is a modification instruction, if mapping information corresponding to the user's identification information exists, at least one of the identification information, permission information and validity period of the target user in the mapping information corresponding to the user's identification information is modified.

[0027] Optionally, it also includes:

[0028] Sending the mapping information of the user to the client;

[0029] After the server is restarted, the mapping information of the user is obtained from the client.

[0030] In a second aspect, an embodiment of the present invention discloses a user access control system, including: a server and a client;

[0031] The client is used to send an access request to the server; the access request includes user identification information;

[0032] The server is used to receive an access request sent by a client; obtain mapping information based on the user's identification information; the mapping information includes the identification information and permission information of the target user mapped by the user; and execute the access operation corresponding to the access request based on the identification information and permission information of the target user.

[0033] Optionally, the mapping information also includes a validity period;

[0034] The server is used to determine whether the validity period has expired; if the validity period has not expired, the server is used to perform the access operation corresponding to the access request according to the identification information and permission information of the target user.

[0035] Optionally, the server is further configured to obtain permission information of the user if the validity period has expired; and execute an access operation corresponding to the access request according to the identification information and permission information of the user.

[0036] Optionally, the server is further used to determine whether the user of the client has turned on the mapping function after receiving the access request sent by the client; if the user of the client has turned on the mapping function, the server obtains the mapping information according to the identification information of the user.

[0037] Optionally, the server is further used to receive a mapping information configuration request sent by the client; the mapping information configuration request includes the user's identification information and configuration instructions; and configure mapping information for the user according to the user's identification information and configuration instructions.

[0038] Optionally, the server is used to determine whether corresponding mapping information exists according to the user's identification information when the configuration instruction is an add instruction; if mapping information corresponding to the user's identification information does not exist, assign a target user and a validity period to the user; use the target user's identification information, permission information and the validity period as the user's mapping information; store the user's identification information and the mapping information in correspondence; when the configuration instruction is a delete instruction, if mapping information corresponding to the user's identification information exists, delete the mapping information corresponding to the user's identification information; when the configuration instruction is a modify instruction, if mapping information corresponding to the user's identification information exists, modify at least one of the target user's identification information, permission information and the validity period in the mapping information corresponding to the user's identification information.

[0039] Optionally, the server is further configured to send mapping information of the user to the client; and obtain the mapping information of the user from the client after the server is restarted.

[0040] In a third aspect, an embodiment of the present invention discloses a user access control device, including:

[0041] A mapping information acquisition module, used to send an access request to the server; the access request includes user identification information;

[0042] The first execution module is used to receive an access request sent by a client; obtain mapping information according to the identification information of the user; the mapping information includes the identification information and permission information of the target user mapped by the user;

[0043] The request operation module is used to execute the access operation corresponding to the access request according to the identification information and permission information of the target user.

[0044] Optionally, the mapping information also includes a validity period;

[0045] The request operation module includes:

[0046] A request determination submodule is used to determine whether the validity period has expired;

[0047] The request operation submodule is used to execute the access operation corresponding to the access request according to the identification information and permission information of the target user if the validity period has not expired.

[0048] Optionally, it also includes:

[0049] A permission acquisition module, for acquiring permission information of the user if the validity period has expired;

[0050] The second execution module is used to execute the access operation corresponding to the access request according to the identification information and permission information of the user.

[0051] Optionally, it also includes:

[0052] A mapping enabling module, used to determine whether the user of the client has enabled the mapping function after receiving an access request sent by the client;

[0053] The mapping information acquisition module includes:

[0054] The mapping acquisition submodule is used to acquire mapping information according to the identification information of the user if the user of the client has turned on the mapping function.

[0055] Optionally, it also includes:

[0056] A configuration receiving module, configured to receive a mapping information configuration request sent by the client; the mapping information configuration request includes the identification information of the user and a configuration instruction;

[0057] The information configuration module is used to configure mapping information for the user according to the identification information and configuration instructions of the user.

[0058] Optionally, the information configuration module includes:

[0059] An information adding submodule, for determining whether corresponding mapping information exists according to the identification information of the user when the configuration instruction is an adding instruction; if the mapping information corresponding to the identification information of the user does not exist, assigning a target user and a validity period to the user; using the identification information, permission information and the validity period of the target user as the mapping information of the user; and storing the identification information of the user and the mapping information in correspondence;

[0060] an information deletion submodule, for deleting the mapping information corresponding to the identification information of the user if the mapping information corresponding to the identification information of the user exists when the configuration instruction is a deletion instruction;

[0061] The information modification submodule is used to modify at least one of the identification information, permission information and validity period of the target user in the mapping information corresponding to the user's identification information if there is mapping information corresponding to the user's identification information when the configuration instruction is a modification instruction.

[0062] Optionally, it also includes:

[0063] The information sending module is used to send the mapping information of the user to the client; after the server is restarted, the mapping information of the user is obtained from the client.

[0064] In a fourth aspect, the present invention shows an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned user access control method when executing the computer program.

[0065] In a fifth aspect, the present invention shows a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned user access control method are implemented.

[0066] It can be seen from the above technical solutions that the embodiments of the present invention include the following advantages:

[0067] The present invention proposes a user mapping permission management optimization scheme based on the network file system protocol. In this scheme, the user specified by the client is converted to other users on the storage end by means of user conversion, so that the client has the permissions of the converted user, and multiple users can be converted to one user, thereby solving the problem of limiting the number of entries in the file access control list for multiple users. The present invention only needs to set the permissions of the target user. When other users need the same permissions, the permissions of the target user can be obtained by user mapping. There is no need to set a file access control list for each user. Only a small number of target users need to be configured on the server end. By mapping users to target users, the permission access control requirements of a large number of users can be met. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is a flowchart of a user access control method provided by an embodiment of the present invention;

[0069] Figure 2 is a flowchart of another method for user access control provided by an embodiment of the present invention;

[0070] Figure 3 is a structural block diagram of a user access control device provided by an embodiment of the present invention;

[0071] Figure 4 is a structural block diagram of an electronic device provided by an embodiment of the present invention;

[0072] Figure 5 It is a structural block diagram of a computer-readable storage medium provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0073] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0074] One of the core concepts of the embodiments of the present invention is that the present invention designates a user as a specific user without setting permissions for the user, so that the user has the access permissions of an existing designated user; and a validity period can be set for the mapping, after which the user mapping is no longer effective, and permissions can be temporarily granted to a user. The present invention converts the user designated by the client to another user on the storage end by user conversion, so that the client has the permissions of the converted user, and allows multiple users to be converted to one user, solving the problem of limited number of user file access control list permission settings and the problem of too many file access control list entries affecting performance.

[0075] Figure 1 : is a flowchart of a user access control method provided by an embodiment of the present invention, the method comprising:

[0076] Step 101, receiving an access request sent by a client; the access request includes user identification information;

[0077] The embodiments of the present invention can be applied to systems that need to be managed based on user permissions. For example, a system based on the NFS (Network File System) protocol. In a system based on the NFS protocol, a remote client can be allowed to access the network in the same way as a local file system. The present invention can be applied to a variety of network protocols, which are not limited by the embodiments of the present invention.

[0078] In an embodiment of the present invention, the server is connected to the client. When the client needs to access a file on the server, the client can send an access request to the server, and the server can receive the access request sent by the client, and the access request includes the user's identification information. Exemplarily, the user's identification information includes the user's uid (user identifier, User ID) and gid (group identifier, Group ID). In different systems, the user's identification information can also be other identifiers.

[0079] Step 102, acquiring mapping information according to the identification information of the user; the mapping information includes the identification information and permission information of the target user mapped by the user;

[0080] The target user is a user pre-set in the server that can be used by multiple users. Different target users can have different permission information. The server can assign corresponding target users to users according to their actual needs. The server can assign the same target user to users of multiple clients.

[0081] The server may store the user's identification information and the corresponding mapping information in correspondence with each other. For example, a binary tree data structure of a file access control list is used to store the user's identification information and the corresponding mapping information in correspondence with each other.

[0082] After receiving the access request sent by the client, the server can look up the corresponding mapping information according to the user's identification information.

[0083] Step 103: Execute the access operation corresponding to the access request according to the identification information and permission information of the target user.

[0084] When executing the access operation corresponding to the access request, processes that require verification of the user's identification information and permission information are involved. In these processes, the target user's identification information and permission information can be used for verification, and the access operation can be continued after the verification is passed.

[0085] In the present invention, the client sends an access request to the server, and the access request includes the user's identification information; the server obtains mapping information according to the user's identification information; the mapping information includes the identification information and permission information of the target user mapped by the user; the server performs the access operation corresponding to the access request according to the identification information and permission information of the target user. The embodiment of the present invention does not need to set a file access control list for each user, and only a small number of target users need to be configured in the server. By mapping users to target users, the permission access control requirements of a large number of users can be met.

[0086] Figure 2 is a flowchart of another method for user access control provided by an embodiment of the present invention, the method comprising:

[0087] Step 201, receiving a mapping information configuration request sent by the client; the mapping information configuration request includes the identification information of the user and a configuration instruction;

[0088] In an embodiment of the present invention, by receiving a mapping information configuration request, corresponding configuration operations can be performed on the mapping information of the target user. When the client needs to configure the mapping information, the client sends a mapping information configuration request to the server, wherein the mapping information configuration request includes the user's identification information and configuration instructions.

[0089] Step 202: Configure mapping information for the user according to the identification information and configuration instructions of the user.

[0090] In this embodiment, the server can receive a mapping information configuration request sent by the client, the mapping information configuration request including the user's identification information and configuration instructions. The server can respond to the mapping information configuration request and configure the user's mapping information, thereby more flexibly meeting the requirements of permission access control.

[0091] In some embodiments, step 202 may include the following sub-steps:

[0092] Sub-step S11, when the configuration instruction is an add instruction, determining whether corresponding mapping information exists according to the identification information of the user; if mapping information corresponding to the identification information of the user does not exist, assigning a target user and a validity period to the user; using the identification information, permission information and the validity period of the target user as the mapping information of the user; and storing the identification information of the user and the mapping information in correspondence;

[0093] If there is no mapping information corresponding to the user's identification information, it means that no mapping information has been assigned to the user before. If there is mapping information corresponding to the user's identification information, it means that the mapping information has been assigned to the user before. If the configuration instruction is an add instruction and there is mapping information corresponding to the user's identification information, the server can perform an error processing to prompt the user of the client.

[0094] Sub-step S12, when the configuration instruction is a deletion instruction, if mapping information corresponding to the identification information of the user exists, deleting the mapping information corresponding to the identification information of the user;

[0095] When the configuration instruction is a deletion instruction and there is no mapping information corresponding to the user's identification information, the server may perform an error reporting process to prompt the user of the client.

[0096] Sub-step S13, when the configuration instruction is a modification instruction, if there is mapping information corresponding to the user's identification information, modify at least one of the identification information, permission information and validity period of the target user in the mapping information corresponding to the user's identification information.

[0097] When the configuration instruction is a modification instruction and there is no mapping information corresponding to the user's identification information, the server may perform an error reporting process to prompt the user of the client.

[0098] Adding, deleting and modifying mapping information can help ensure data integrity and consistency, dynamically adjust data mapping relationships, thereby improving the flexibility and adaptability of access operations, and simplify complex mapping information operations into a more intuitive form, allowing users to operate more easily.

[0099] In some embodiments, the method may further include: sending the mapping information of the user to the client; and obtaining the mapping information of the user from the client after the server is restarted.

[0100] In the implementation of the present invention, after the server completes the access operation corresponding to the access request, it can feed back the corresponding access result to the client, and send the accessed file result and the mapping information of the target user to the client. The server also needs to choose whether to restore the user mapping information to the original user information by adjusting the configuration options in the file. By adjusting the relevant configuration options in the ' / etc / exports' and ' / etc / idmapd.conf' files, it can be controlled whether the server restores the user mapping information to the original user information, remove or comment out the 'anonuid, anongid, all_squash' options, or add the 'no_root_squash' option, and remove or comment out the 'Domain' option, to achieve this choice. If you choose to restore the user information, you need to convert the target user mapping information into user information. When the access operation needs to be performed after the server is restarted, the server will obtain the mapping information of the target user from the client and the validity period will be reallocated to the user.

[0101] Specifically, in the present invention, after completing the access operation, the server sends the user's mapping information to the client. After the server is restarted, the server can obtain the user's mapping information from the client to perform the access operation. By obtaining the user's mapping information from the client, the service can be quickly restored, the system downtime can be reduced, the risk of data loss can be reduced, and the integrity and consistency of the data can be ensured.

[0102] Among them, the server chooses whether to restore the user mapping information to the original user information by adjusting the configuration options in the file. If you choose to restore the user information, you need to convert the user mapping information into the original user information, and then feed it back to the client together with the access result. If you choose not to restore the user information, the user mapping information and the access result will be directly fed back to the user. In addition to saving the target user mapping information in the file access control list binary tree, a configuration will also be saved in the client's local configuration file. After the server is restarted, the user's mapping information is obtained from the client. The file access control list can provide fine-grained permission management, allowing different access rights to be set for different users or user groups. Read-only, read-write or full control permissions can be set for specific users to ensure data security and privacy. The mapping information is saved locally on the client, and users can still access and use this information even without a network connection.

[0103] Step 203: receiving an access request sent by the client; the access request includes user identification information;

[0104] Step 204: acquiring mapping information according to the identification information of the user; the mapping information includes the identification information and authority information of the target user mapped by the user;

[0105] In some embodiments, the method may further include: after receiving an access request sent by a client, determining whether a user of the client turns on a mapping function;

[0106] The step 204 may include: if the user of the client has enabled the mapping function, acquiring mapping information according to the identification information of the user.

[0107] In this embodiment, when the server receives an access request from the client, it needs to determine whether the client user has enabled the mapping function. This can be determined by checking the relevant configuration options in the relevant files. If these files contain 'anonuid',

[0108] 'anongid', 'root_squash', 'no_root_squash', 'all_squash' or

[0109] The 'Domain' option indicates that the user mapping function is enabled. If the client user has enabled the mapping function, the server obtains the mapping information based on the user's identification information.

[0110] Specifically, in the present invention, the server receives an access request sent by the client, and the access request includes user authority information and target user mapping information. After receiving the request, the server needs to parse the mapping information. The server determines whether to enable the user mapping function by checking the relevant configuration options in the file; if the user of the client has enabled the mapping function, it is necessary to query whether the user mapping information exists and determine whether the mapping information is within the validity period, and then obtain the mapping information according to the identification information of the user. The server needs to determine whether to enable the mapping function when performing an access operation, which can help the system better manage and protect data, especially in the case of sensitive data, can provide stronger security protection, can more finely control the access rights of data, and ensure that only authorized users can access specific data.

[0111] Step 205: Execute the access operation corresponding to the access request according to the identification information and permission information of the target user.

[0112] In some embodiments, the mapping information also includes a validity period; the step 205 may include the following sub-steps:

[0113] Sub-step S21, determining whether the validity period has expired;

[0114] Sub-step S22: If the validity period has not expired, executing the access operation corresponding to the access request according to the identification information and permission information of the target user.

[0115] In this embodiment, when the server executes the access operation corresponding to the access request, it needs to determine whether the identification information and permission information of the target user have expired. The server determines the range of the target user identification information and the validity period range of the target user mapping. If the range exceeds the validity period range, the validity period has expired. If the target user information is within the validity period range, the corresponding access operation is performed.

[0116] Specifically, in the present invention, the server performs the access operation corresponding to the access request according to the identification information and permission information of the target user. Before executing the access request, the server needs to determine whether the validity period of the mapping information has expired, including determining the range of the user identifier and group identifier and the user mapping validity period range. If the validity period has not expired, the server can perform the corresponding access operation according to the identification information and permission information of the target user. By determining the validity period of the mapping information, it can help improve the accuracy and reliability of the information, and ensure that the latest and most accurate data is used.

[0117] In some embodiments, the method may further include: if the validity period has expired, obtaining the permission information of the user; and performing the access operation corresponding to the access request according to the identification information and permission information of the user.

[0118] In this embodiment, if the server determines that the validity period has expired, it needs to feed back to the client to obtain the user's identification information and permission information to perform the access operation corresponding to the access request.

[0119] Specifically, in the present invention, the server needs to determine whether the set mapping information validity period has expired, including determining the target user's identification range and the user mapping validity period range. If the validity period has expired, the user's permission information is obtained, and the server performs the access operation corresponding to the access request based on the obtained user's identification information and permission information. In some emergency situations, there may not be enough time to update the mapping information. Using the user's identification information and permission information can be used as an emergency measure to ensure the normal operation of the access operation.

[0120] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0121] An embodiment of the present invention provides a user access control system, including: a server and a client;

[0122] The client is used to send an access request to the server; the access request includes user identification information;

[0123] The server is used to receive an access request sent by a client; obtain mapping information based on the user's identification information; the mapping information includes the identification information and permission information of the target user mapped by the user; and execute the access operation corresponding to the access request based on the identification information and permission information of the target user.

[0124] In the present invention, the client sends an access request to the server, and the access request includes the user's identification information; the server obtains mapping information according to the user's identification information; the mapping information includes the identification information and permission information of the target user mapped by the user; the server performs the access operation corresponding to the access request according to the identification information and permission information of the target user. The embodiment of the present invention does not need to set a file access control list for each user, and only a small number of target users need to be configured in the server. By mapping users to target users, the permission access control requirements of a large number of users can be met.

[0125] In some embodiments, a client sends an access request to a server, wherein the access request includes identification information of a user; the server obtains mapping information based on the identification information of the user; the mapping information includes identification information and permission information of a target user mapped by the user; the server performs an access operation corresponding to the access request based on the identification information and permission information of the target user obtained.

[0126] Wherein, the mapping information also includes a validity period;

[0127] The server is used to determine whether the validity period has expired; if the validity period has not expired, the server is used to perform the access operation corresponding to the access request according to the identification information and permission information of the target user.

[0128] In some embodiments, the server performs the access operation corresponding to the access request based on the identification information and permission information of the target user. Before executing the access request, the server needs to determine whether the validity period of the mapping information has expired, including determining the user identifier and group identifier range and the user mapping validity period range. If the validity period has not expired, the server can perform the corresponding access operation based on the identification information and permission information of the target user.

[0129] Wherein, the server is further used to obtain the permission information of the user if the validity period has expired; and execute the access operation corresponding to the access request according to the identification information and permission information of the user.

[0130] In some embodiments, the server needs to determine whether the set mapping information validity period has expired, including determining the identification range of the target user and the user mapping validity period range. If the validity period has expired, the user's permission information is obtained. The server executes the access operation corresponding to the access request based on the obtained user's identification information and permission information.

[0131] In some embodiments, the server is further used to determine whether the user of the client has turned on the mapping function after receiving an access request sent by the client; if the user of the client has turned on the mapping function, the server obtains the mapping information based on the identification information of the user.

[0132] In some embodiments, the server receives an access request sent by the client, and the access request includes user authority information and target user mapping information. After receiving the request, the server needs to parse the mapping information. The server determines whether to enable the user mapping function by checking the relevant configuration options in the file; if the user of the client has enabled the mapping function, it is necessary to query whether the user mapping information exists and determine whether the mapping information is within the validity period, and then obtain the mapping information based on the user's identification information.

[0133] In some embodiments, the server is further used to receive a mapping information configuration request sent by the client; the mapping information configuration request includes the user's identification information and configuration instructions; and configure mapping information for the user according to the user's identification information and configuration instructions.

[0134] In some embodiments, the server needs to receive a mapping information configuration request sent by the client, the mapping information configuration request includes the user's identification information and configuration instructions; and configures mapping information for the user according to the user's identification information and configuration instructions. The client sends a configuration instruction to the server to update or delete the target user mapping information. When updating or deleting the mapping information of the target user, the server also needs to determine whether the target user is consistent with the one to be set. If the target user is consistent with the one to be set, the mapping operation can be updated or deleted for the target user. If the mapping information settings are inconsistent, it means that the original user already has other mapping relationships, and an error is directly reported.

[0135] Among them, the server is used to determine whether there is corresponding mapping information based on the user's identification information when the configuration instruction is an add instruction; if there is no mapping information corresponding to the user's identification information, assign a target user and a validity period to the user; use the target user's identification information, permission information and the validity period as the user's mapping information; store the user's identification information and the mapping information in correspondence; when the configuration instruction is a delete instruction, if there is mapping information corresponding to the user's identification information, delete the mapping information corresponding to the user's identification information; when the configuration instruction is a modify instruction, if there is mapping information corresponding to the user's identification information, modify at least one of the target user's identification information, permission information and the validity period in the mapping information corresponding to the user's identification information.

[0136] In some embodiments, the server configures mapping information for the user according to the user's identification information and configuration instructions. Prior to this, the server also needs to check whether the user's add, delete, modify and query identifiers already exist in the user mapping data table. When the configuration instruction is an add instruction, determine whether the corresponding mapping information exists according to the user's identification information. If not, assign a target user and a validity period to the user; and store the user's identification information and the mapping information accordingly; when the configuration instruction is a delete instruction, the server may delete the mapping information corresponding to the user's identification information; when the configuration instruction is a modify instruction, modify at least one of the identification information, permission information and validity period of the target user in the mapping information corresponding to the user's identification information. If the user does not contain an identification action, an error is reported, and error reporting is also set for other situations.

[0137] In some embodiments, the server is further configured to send the mapping information of the user to the client; and obtain the mapping information of the user from the client after the server is restarted.

[0138] In this embodiment, the server sends the mapping information of the user to the client after completing the access operation. After the server is restarted, the mapping information of the user can be obtained from the client to perform the access operation.

[0139] Reference Figure 3 , shows a structural block diagram of a user access control device provided by an embodiment of the present invention, and the device may specifically include the following modules:

[0140] A mapping information acquisition module 301 is used to send an access request to the server; the access request includes user identification information;

[0141] The first execution module 302 is used to receive an access request sent by a client; obtain mapping information according to the identification information of the user; the mapping information includes the identification information and permission information of the target user mapped by the user;

[0142] The request operation module 303 is used to perform the access operation corresponding to the access request according to the identification information and permission information of the target user.

[0143] Wherein, the mapping information also includes a validity period;

[0144] The request operation module 303 includes:

[0145] A request determination submodule is used to determine whether the validity period has expired;

[0146] The request operation submodule is used to execute the access operation corresponding to the access request according to the identification information and permission information of the target user if the validity period has not expired.

[0147] Among them, it also includes:

[0148] A permission acquisition module, for acquiring permission information of the user if the validity period has expired;

[0149] The second execution module is used to execute the access operation corresponding to the access request according to the identification information and permission information of the user.

[0150] The embodiments disclosed in the present invention also include:

[0151] A mapping enabling module, used to determine whether the user of the client has enabled the mapping function after receiving an access request sent by the client;

[0152] The mapping information acquisition module 301 includes:

[0153] The mapping acquisition submodule is used to acquire mapping information according to the identification information of the user if the user of the client has turned on the mapping function.

[0154] In one embodiment of the present invention, it also includes:

[0155] A configuration receiving module, configured to receive a mapping information configuration request sent by the client; the mapping information configuration request includes the identification information of the user and a configuration instruction;

[0156] The information configuration module is used to configure mapping information for the user according to the identification information and configuration instructions of the user.

[0157] Wherein, the information configuration module includes:

[0158] An information adding submodule, for determining whether corresponding mapping information exists according to the identification information of the user when the configuration instruction is an adding instruction; if the mapping information corresponding to the identification information of the user does not exist, assigning a target user and a validity period to the user; using the identification information, permission information and the validity period of the target user as the mapping information of the user; and storing the identification information of the user and the mapping information in correspondence;

[0159] an information deletion submodule, for deleting the mapping information corresponding to the identification information of the user if the mapping information corresponding to the identification information of the user exists when the configuration instruction is a deletion instruction;

[0160] The information modification submodule is used to modify at least one of the identification information, permission information and validity period of the target user in the mapping information corresponding to the user's identification information if there is mapping information corresponding to the user's identification information when the configuration instruction is a modification instruction.

[0161] In an embodiment disclosed in the present invention, it also includes:

[0162] The information sending module is used to send the mapping information of the user to the client; after the server is restarted, the mapping information of the user is obtained from the client.

[0163] In this embodiment, the information sending module sends the mapping information of the user to the client after completing the access operation. After the server is restarted, the information sending module can obtain the mapping information of the user from the client to perform the access operation.

[0164] In the present invention, the client sends an access request to the server, and the access request includes the user's identification information; the server obtains mapping information according to the user's identification information; the mapping information includes the identification information and permission information of the target user mapped by the user; the server performs the access operation corresponding to the access request according to the identification information and permission information of the target user. The embodiment of the present invention does not need to set a file access control list for each user, and only a small number of target users need to be configured in the server. By mapping users to target users, the permission access control requirements of a large number of users can be met.

[0165] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0166] like Figure 3 , showing a structural block diagram of an electronic device provided in an embodiment of the present invention, including:

[0167] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned user access control method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0168] like Figure 4 , showing that an embodiment of the present invention also provides a structural block diagram of a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned user access control method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0169] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0170] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0171] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0172] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0173] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0174] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0175] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0176] The user access control method, the user access control system, the user access control device, the electronic device and the computer-readable storage medium provided by the present invention are introduced in detail above. The principle and implementation mode of the present invention are explained in detail using specific examples herein. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and the scope of application. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A user access control method, characterized in that: Applied to the server, the method includes: Receiving an access request sent by a client; the access request includes identification information of the user; According to the identification information of the user, mapping information is acquired; the mapping information includes identification information and permission information of the target user mapped by the user; An access operation corresponding to the access request is performed according to the identification information and permission information of the target user.

2. The method according to claim 1, characterized in that The mapping information also includes a validity period; The performing the access operation corresponding to the access request according to the identification information and permission information of the target user includes: Determining whether the validity period has expired; If the validity period has not expired, the access operation corresponding to the access request is performed according to the identification information and permission information of the target user.

3. The method according to claim 2, characterized in that Also includes: If the validity period has expired, obtaining the permission information of the user; An access operation corresponding to the access request is performed according to the identification information and permission information of the user.

4. The method according to claim 1, characterized in that: Also includes: After receiving the access request sent by the client, determining whether the user of the client turns on the mapping function; The acquiring mapping information according to the identification information of the user includes: If the user of the client has enabled the mapping function, the mapping information is obtained according to the identification information of the user.

5. The method according to claim 1, characterized in that Also includes: Receiving a mapping information configuration request sent by the client; The mapping information configuration request includes the identification information of the user and a configuration instruction; Mapping information is configured for the user according to the identification information and the configuration instruction of the user.

6. The method according to claim 5, characterized in that The configuring mapping information for the user according to the identification information and the configuration instruction of the user includes: When the configuration instruction is an add instruction, determining whether corresponding mapping information exists according to the identification information of the user; if mapping information corresponding to the identification information of the user does not exist, assigning a target user and a validity period to the user; using the identification information, permission information and the validity period of the target user as the mapping information of the user; and storing the identification information of the user and the mapping information in correspondence; When the configuration instruction is a deletion instruction, if mapping information corresponding to the identification information of the user exists, the mapping information corresponding to the identification information of the user is deleted; When the configuration instruction is a modification instruction, if mapping information corresponding to the user's identification information exists, at least one of the identification information, permission information and validity period of the target user in the mapping information corresponding to the user's identification information is modified.

7. The method according to claim 5, characterized in that Also includes: Sending the mapping information of the user to the client; After the server is restarted, the mapping information of the user is obtained from the client.

8. A user access control system, characterized in that: include: Server and client; The client is used to send an access request to the server; the access request includes user identification information; The server is used to receive an access request sent by a client; obtain mapping information based on the user's identification information; the mapping information includes the identification information and permission information of the target user mapped by the user; and execute the access operation corresponding to the access request based on the identification information and permission information of the target user.

9. A user access control device, characterized in that: include: A request sending module, used to send an access request to the server; the access request includes user identification information; A mapping information acquisition module, used to receive an access request sent by a client; obtain mapping information according to the identification information of the user; the mapping information includes the identification information and permission information of the target user mapped by the user; The first execution module is used to execute the access operation corresponding to the access request according to the identification information and permission information of the target user.

10. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the user access control method according to any one of claims 1 to 7 are implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the user access control method according to any one of claims 1 to 7 are implemented.

Images