A user access control method, system, apparatus, device and storage medium

Abstract

Embodiments of the present application provide a user access control method, system, device, electronic equipment and storage medium, the method comprising: receiving an access request sent by a client; the access request comprising identification information of a user; obtaining mapping information according to the identification information of the user; the mapping information comprising identification information and permission information of a target user mapped by the user; and performing an access operation corresponding to the access request according to the identification information and permission information of the target user. Without setting a file access control list for each user, only a small number of target users need to be configured in the server, and the access control requirements of a large number of users can be met by mapping the user to the target user.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computers, and in particular to a user access control method, a user access control system, a user access control device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] With the rapid development of networks, in the current network file system protocol implementation, the network file system shared exported directory permission management supports the whole client level permission management, that is, specifying the client Internet communication protocol or network segment to perform unified permissions such as read-only, read-write, and prohibition. If you want to set permissions for users, you need to use file access control list permission control to achieve setting permissions for specified users for directories or files. If there are many users, you need to set file access control lists for each user.

[0003] Since the number of file access control list items allowed to be set for a single directory / file is not unlimited, it has an upper limit, so if the number of users exceeds the upper limit, the corresponding file access control list permissions cannot be set for the excess users. SUMMARY

[0004] In view of the above problems, the embodiments of the present application are proposed to provide a user access control method, a user access control system, an electronic device and a computer readable storage medium which overcome the above problems or at least partially solve the above problems.

[0005] In a first aspect, the embodiments of the present application disclose a user access control method applied to a server, the method comprising:

[0006] receiving an access request sent by a client; the access request comprising identification information of a user;

[0007] obtaining mapping information according to the identification information of the user; the mapping information comprising identification information and permission information of a target user mapped by the user;

[0008] executing an access operation corresponding to the access request according to the identification information and the permission information of the target user.

[0009] Optionally, the mapping information further comprises a validity period.

[0010] The executing an access operation corresponding to the access request according to the identification information and the permission information of the target user comprises:

[0011] judging whether the validity period has expired;

[0012] If the validity period is not expired, an access operation corresponding to the access request is executed according to the identification information and the permission information of the target user.

[0013] Optionally, the method further comprises:

[0014] If the validity period is expired, the permission information of the user is acquired.

[0015] An access operation corresponding to the access request is executed according to the identification information and the permission information of the user.

[0016] Optionally, the method further comprises:

[0017] After receiving an access request sent by a client, it is determined whether a mapping function is enabled for a user of the client.

[0018] The acquiring of the mapping information according to the identification information of the user comprises:

[0019] If the mapping function is enabled for the user of the client, the mapping information is acquired according to the identification information of the user.

[0020] Optionally, the method further comprises:

[0021] A mapping information configuration request sent by the client is received; the mapping information configuration request comprises identification information of the user and a configuration instruction;

[0022] The mapping information is configured for the user according to the identification information of the user and the configuration instruction.

[0023] Optionally, the configuring of the mapping information for the user according to the identification information of the user and the configuration instruction comprises:

[0024] When the configuration instruction is an adding instruction, it is determined whether there is corresponding mapping information according to the identification information of the user; if there is no mapping information corresponding to the identification information of the user, a target user and a validity period are allocated for the user; the identification information of the target user, the permission information and the validity period are taken as the mapping information of the user; and the identification information of the user and the mapping information are stored correspondingly.

[0025] When the configuration instruction is a deleting instruction, if there is mapping information corresponding to the identification information of the user, the mapping information corresponding to the identification information of the user is deleted.

[0026] When the configuration instruction is a modifying instruction, if there is mapping information corresponding to the identification information of the user, at least one of the identification information of the target user, the permission information and the validity period in the mapping information corresponding to the identification information of the user is modified.

[0027] Optionally, further comprising:

[0028] sending the mapping information of the user to the client;

[0029] after the service end is restarted, obtaining the mapping information of the user from the client.

[0030] In a second aspect, the embodiments of the present application disclose a user access control system, comprising a service end and a client;

[0031] The client is configured to send an access request to the service end, wherein the access request comprises identification information of a user.

[0032] The service end is configured to receive the access request sent by the client, obtain mapping information according to the identification information of the user, wherein the mapping information comprises identification information and permission information of a target user mapped by the user, and execute an access operation corresponding to the access request according to the identification information and the permission information of the target user.

[0033] Optionally, the mapping information further comprises a validity period.

[0034] The service end is configured to determine whether the validity period has expired, and if the validity period has not expired, execute the access operation corresponding to the access request according to the identification information and the permission information of the target user.

[0035] Optionally, the service end is further configured to, if the validity period has expired, obtain permission information of the user, and execute the access operation corresponding to the access request according to the identification information and the permission information of the user.

[0036] Optionally, the service end is further configured to, after receiving the access request sent by the client, determine whether the user of the client has enabled a mapping function, and if the user of the client has enabled the mapping function, obtain mapping information according to the identification information of the user.

[0037] Optionally, the service end is further configured to receive a mapping information configuration request sent by the client, wherein the mapping information configuration request comprises identification information of the user and a configuration instruction, and configure mapping information for the user according to the identification information of the user and the configuration instruction.

[0038] Optionally, the server is configured to: when the configuration instruction is an adding instruction, determine whether corresponding mapping information exists according to the identification information of the user; if the mapping information corresponding to the identification information of the user does not exist, allocate a target user and a valid period to the user; take the identification information of the target user, the permission information and the valid period as the mapping information of the user; store the identification information of the user and the mapping information correspondingly; when the configuration instruction is a deleting instruction, if the mapping information corresponding to the identification information of the user exists, delete the mapping information corresponding to the identification information of the user; when the configuration instruction is a modifying instruction, if the mapping information corresponding to the identification information of the user exists, modify at least one of the identification information of the target user, the permission information and the valid period in the mapping information corresponding to the identification information of the user.

[0039] Optionally, the server is further configured to: send the mapping information of the user to the client; after the server is restarted, acquire the mapping information of the user from the client.

[0040] In a third aspect, an embodiment of the present application discloses a user access control device, comprising:

[0041] a mapping information acquisition module configured to send an access request to the server; the access request comprises identification information of a user;

[0042] a first execution module configured to receive an access request sent by a client; acquire mapping information according to the identification information of the user; the mapping information comprises identification information of a target user mapped by the user and permission information;

[0043] a request operation module configured to execute an access operation corresponding to the access request according to the identification information of the target user and the permission information.

[0044] Optionally, the mapping information further comprises a valid period.

[0045] The request operation module comprises:

[0046] a request judgment submodule configured to judge whether the valid period has expired;

[0047] a request operation submodule configured to execute an access operation corresponding to the access request according to the identification information of the target user and the permission information if the valid period has not expired.

[0048] Optionally, the device further comprises:

[0049] a permission acquisition module configured to acquire permission information of the user if the valid period has expired.

[0050] The second execution module is configured to execute an access operation corresponding to the access request according to the identification information and the permission information of the user.

[0051] Optionally, the method further comprises:

[0052] The mapping starting module is configured to determine whether a user of the client has started a mapping function after receiving an access request sent by the client.

[0053] The mapping information obtaining module comprises:

[0054] The mapping obtaining sub-module is configured to obtain mapping information according to the identification information of the user if the user of the client has started the mapping function.

[0055] Optionally, the method further comprises:

[0056] The configuration receiving module is configured to receive a mapping information configuration request sent by the client; the mapping information configuration request comprises the identification information of the user and a configuration instruction.

[0057] The information configuration module is configured to configure mapping information for the user according to the identification information of the user and the configuration instruction.

[0058] Optionally, the information configuration module comprises:

[0059] The information adding sub-module is configured to determine whether there is corresponding mapping information according to the identification information of the user when the configuration instruction is an adding instruction; if there is no mapping information corresponding to the identification information of the user, the information adding sub-module is configured to allocate a target user and a valid period for the user; the identification information of the target user, permission information and the valid period are taken as the mapping information of the user; and the identification information of the user and the mapping information are stored correspondingly.

[0060] The information deleting sub-module is configured to delete mapping information corresponding to the identification information of the user if there is mapping information corresponding to the identification information of the user when the configuration instruction is a deleting instruction.

[0061] The information modifying sub-module is configured to modify at least one of the identification information of the target user, the permission information and the valid period in mapping information corresponding to the identification information of the user if there is mapping information corresponding to the identification information of the user when the configuration instruction is a modifying instruction.

[0062] Optionally, the method further comprises:

[0063] The information sending module is configured to send the mapping information of the user to the client; and obtain the mapping information of the user from the client after the server is restarted.

[0064] In a fourth aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the user access control method when executing the computer program.

[0065] In a fifth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program implements the steps of the user access control method when executed by a processor.

[0066] From the above technical solutions, the embodiments of the present application have the following advantages:

[0067] The present application provides a user mapping permission management optimization scheme based on a network file system protocol. In the scheme, a user specified by a client is converted into another user at a storage end through user conversion, so that the client has the permission of the converted user, and multiple users can be converted into one user, thereby solving the problem of the limitation of the number of file access control list entries of multiple users. The present application only needs to set the permission of a target user, and when other users need the same permission, the permission of the target user can be obtained through user mapping, without setting a file access control list for each user. Only a small number of target users need to be configured on the server, and the permission access control requirements of a large number of users can be met through the user mapping to the target user. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 is a step flow chart of a user access control method provided by the embodiments of the present application;

[0069] Figure 2 is a step flow chart of another user access control method provided by the embodiments of the present application;

[0070] Figure 3 is a structural block diagram of a user access control device provided by the embodiments of the present application;

[0071] Figure 4 is a structural block diagram of an electronic device provided by the embodiments of the present application;

[0072] Figure 5 is a structural block diagram of a computer readable storage medium provided by the embodiments of the present application. DETAILED DESCRIPTION

[0073] In order to make the above-mentioned objects, features and advantages of the present application more apparent and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0074] One of the core ideas of the embodiments of the present application is that the present application designates a certain user as a specific user, sets no permission for the user, and makes the user have the access permission of the existing designated user. The present application can set a valid period for the mapping, and the user mapping is no longer effective after the valid period is exceeded, and the user can be temporarily assigned a permission. The present application converts the user designated by the client into another user at the storage end through user conversion, makes the client have the permission of the converted user, allows multiple users to be converted into one user, solves the problem that the number of permission setting items of the user file access control list is limited, and solves the problem that too many items of the file access control list have an impact on performance.

[0075] Figure 1 is a step flowchart of a user access control method provided by the embodiments of the present application. The method comprises the following steps:

[0076] In step 101, an access request sent by a client is received. The access request comprises identification information of a user.

[0077] The embodiments of the present application can be applied to a system that needs to be managed based on the permission of a user. For example, a system based on the nfs (Network File System) protocol. In the system based on the nfs protocol, a remote client can be allowed to access through a network in the same way as accessing a local file system. The present application can be applied to various network protocols, and the embodiments of the present application do not limit this.

[0078] In the embodiments of the present application, the server and the client are connected. When the client needs to access the file of the server, the client can send an access request to the server. The server can receive the access request sent by the client, and the access request comprises identification information of a user. Exemplarily, the identification information of the user comprises a uid (User ID) and a gid (Group ID) of the user. In different systems, the identification information of the user can also be other identification.

[0079] In step 102, mapping information is obtained according to the identification information of the user. The mapping information comprises identification information and permission information of a target user mapped by the user.

[0080] The target user is a user pre-set in the server and can be used by multiple users. Different target users can have different permission information. The server can allocate a corresponding target user to the user according to the actual needs of the user. The server can allocate the same target user to the users of multiple clients.

[0081] The service end can store the user's identification information and the corresponding mapping information. For example, the user's identification information and the corresponding mapping information are stored by using a file access control list binary tree data structure.

[0082] After receiving the access request sent by the client, the service end can search for the corresponding mapping information according to the user's identification information.

[0083] In step 103, the access operation corresponding to the access request is executed according to the target user's identification information and the permission information.

[0084] In the process of executing the access operation corresponding to the access request, the user's identification information and the permission information need to be verified. In these processes, the target user's identification information and the permission information can be used for verification, and the access operation can be continued after the verification is passed.

[0085] In the present application, the client sends an access request to the service end, and the access request includes the user's identification information. The service end obtains mapping information according to the user's identification information. The mapping information includes the target user's identification information and the permission information mapped by the user. The service end executes the access operation corresponding to the access request according to the target user's identification information and the permission information. The present application does not need to set a file access control list for each user. Only a small number of target users need to be configured in the service end. By mapping the user to the target user, the permission access control requirement of a large number of users can be met.

[0086] Figure 2 is a step flow chart of another user access control method provided by the present application. The method includes:

[0087] In step 201, a mapping information configuration request sent by the client is received. The mapping information configuration request includes the user's identification information and a configuration instruction.

[0088] In the present application, by receiving the mapping information configuration request, the mapping information of the target user can be configured. When the client needs to configure the mapping information, the client sends the mapping information configuration request to the service end. The mapping information configuration request includes the user's identification information and the configuration instruction.

[0089] In step 202, the mapping information of the user is configured according to the user's identification information and the configuration instruction.

[0090] In the embodiment, the server can receive a mapping information configuration request sent by the client, the mapping information configuration request comprising identification information of a user and a configuration instruction. The server can configure mapping information of the user in response to the mapping information configuration request, thereby more flexibly meeting the demand of access control.

[0091] In some embodiments, the step 202 can comprise the following sub-steps:

[0092] In the sub-step S11, when the configuration instruction is an adding instruction, it is determined whether there is corresponding mapping information according to the identification information of the user. If there is no mapping information corresponding to the identification information of the user, a target user and a valid period are allocated to the user. The identification information of the target user, the permission information and the valid period are taken as the mapping information of the user. The identification information of the user and the mapping information are stored correspondingly.

[0093] If there is no mapping information corresponding to the identification information of the user, it indicates that no mapping information has been allocated to the user before. If there is mapping information corresponding to the identification information of the user, it indicates that mapping information has been allocated to the user before. In the case that the configuration instruction is an adding instruction and there is mapping information corresponding to the identification information of the user, the server can perform error processing to prompt the user of the client.

[0094] In the sub-step S12, when the configuration instruction is a deleting instruction, if there is mapping information corresponding to the identification information of the user, the mapping information corresponding to the identification information of the user is deleted.

[0095] In the case that the configuration instruction is a deleting instruction and there is no mapping information corresponding to the identification information of the user, the server can perform error processing to prompt the user of the client.

[0096] In the sub-step S13, when the configuration instruction is a modifying instruction, if there is mapping information corresponding to the identification information of the user, at least one of the identification information of the target user, the permission information and the valid period in the mapping information corresponding to the identification information of the user is modified.

[0097] In the case that the configuration instruction is a modifying instruction and there is no mapping information corresponding to the identification information of the user, the server can perform error processing to prompt the user of the client.

[0098] The adding, deleting and modifying of the mapping information can help ensure the integrity and consistency of data, dynamically adjust the data mapping relationship, thereby improving the flexibility and adaptability of access operation, can simplify the complex mapping information operation into a more intuitive form, so that the user can operate more easily.

[0099] In some embodiments, the method can further comprise: sending the mapping information of the user to the client; and obtaining the mapping information of the user from the client after the server is restarted.

[0100] In the implementation of the present application, when the server completes the access operation corresponding to the access request, the corresponding access result can be fed back to the client, and the accessed file result and the mapping information of the target user are sent to the client. The server also needs to adjust the configuration options in the file to select whether to restore the user mapping information to the original user information. By adjusting the related configuration options in the ‘ / etc / exports’ and ‘ / etc / idmapd.conf’ files, whether to restore the user mapping information to the original user information can be controlled. The ‘anonuid, anongid, all_squash’ options are removed or commented out, or the ‘no_root_squash’ option is added, and the ‘Domain’ option is removed or commented out to achieve this selection. To select to restore the user information, the mapping information of the target user needs to be converted to user information. When the server needs to perform an access operation after being restarted, the server will obtain the mapping information of the target user from the client and reassign the validity period to the user.

[0101] Specifically, in the present application, the server sends the mapping information of the user to the client after completing the access operation, and the server can obtain the mapping information of the user from the client to perform the access operation after the server is restarted. By obtaining the mapping information of the user from the client, the service can be quickly restored, the system downtime can be reduced, the risk of data loss can be reduced, and the integrity and consistency of the data can be ensured.

[0102] In the present application, the server adjusts the configuration options in the file to select whether to restore the user mapping information to the original user information. To select to restore the user information, the user mapping information needs to be converted to the original user information, and then fed back to the client together with the access result. To select not to restore the user information, the user mapping information and the access result are directly fed back to the client. In addition to being saved in the file access control list binary tree, the mapping information of the target user is also saved in the local configuration file in the client. After the server is restarted, the mapping information of the user is obtained from the client. The file access control list can provide fine-grained permission management, allowing different access permissions to be set for different users or user groups, and allowing read-only, read-write, or full control permissions to be set for specific users to ensure the security and privacy of the data. The mapping information is saved locally in the client, so that the user can still access and use the information even without network connection.

[0103] Step 203, receiving an access request sent by the client; the access request includes identification information of a user;

[0104] In step 204, mapping information is acquired according to the identification information of the user; the mapping information comprises identification information and permission information of a target user mapped by the user.

[0105] In some embodiments, the method can further comprise: determining whether the user of the client has enabled the mapping function after receiving the access request sent by the client.

[0106] The step 204 can comprise: acquiring mapping information according to the identification information of the user if the user of the client has enabled the mapping function.

[0107] In the embodiment, the server receives the access request sent by the client, needs to determine whether the user of the client has enabled the mapping function, and determines whether the user mapping function is enabled by checking the related configuration options in the related files. If the 'anonuid', 'anongid', 'root_squash', 'no_root_squash', 'all_squash' or 'Domain' options are contained in the files, it indicates that the user mapping function is enabled. If the user of the client has enabled the mapping function, the server acquires mapping information according to the identification information of the user.

[0108] ' anongid ','root_squash ','no_root_squash ','all_squash'or

[0109] ' Domain'options are contained in the files, it indicates that the user mapping function is enabled. If the user of the client has enabled the mapping function, the server acquires mapping information according to the identification information of the user.

[0110] Specifically, in the application, the server receives the access request sent by the client, and the access request comprises user permission information and target user mapping information. The server needs to parse the mapping information after receiving the request. The server determines whether the user mapping function is enabled by checking the related configuration options in the files. If the user of the client has enabled the mapping function, it is needed to query whether the user mapping information exists and to determine whether the mapping information is within a valid period. Then, the mapping information is acquired according to the identification information of the user. The server needs to determine whether the mapping function is enabled when performing an access operation, which can help the system to better manage and protect data, especially in the case of sensitive data, can provide stronger security protection, can more finely control the access permission of data, and ensures that only authorized users can access specific data.

[0111] In step 205, an access operation corresponding to the access request is performed according to the identification information and permission information of the target user.

[0112] In some embodiments, the mapping information further comprises a valid period; and the step 205 can comprise the following substep:

[0113] In substep S21, it is determined whether the valid period has expired.

[0114] In sub-step S22, if the validity period is not expired, the access operation corresponding to the access request is executed according to the identification information and the permission information of the target user.

[0115] In the embodiment, when the server executes the access operation corresponding to the access request, the server needs to determine whether the identification information and the permission information of the target user are expired. The server determines the range of the target user identifier and the range of the user mapping validity period. If the range of the user mapping validity period is exceeded, the validity period is expired. If the target user information is within the range of the validity period, the corresponding access operation is executed.

[0116] Specifically, in the application, the server executes the access operation corresponding to the access request according to the identification information and the permission information of the target user. Before executing the access request, the server needs to determine whether the validity period of the mapping information is expired, including determining the range of the user identifier and the group identifier and the range of the user mapping validity period. If the validity period is not expired, the server can execute the corresponding access operation according to the identification information and the permission information of the target user. By determining the validity period of the mapping information, the accuracy and reliability of the information can be improved, and the latest and most accurate data can be ensured.

[0117] In some embodiments, the method can further include: if the validity period is expired, obtaining the permission information of the user; and executing the access operation corresponding to the access request according to the identification information and the permission information of the user.

[0118] In the embodiment, if the server determines that the validity period is expired, the server needs to feed back to the client to obtain the identification information and the permission information of the user to execute the access operation corresponding to the access request.

[0119] Specifically, in the application, the server needs to determine whether the validity period of the set mapping information is expired, including determining the range of the target user identifier and the range of the user mapping validity period. If the validity period is expired, the permission information of the user is obtained. The server executes the access operation corresponding to the access request according to the obtained identification information and the permission information of the user. In some emergency situations, there may not be enough time to update the mapping information. The identification information and the permission information of the user can be used as an emergency measure to ensure the normal operation of the access operation.

[0120] It should be noted that, for the method embodiment, in order to simply describe, it is expressed as a series of action combinations, but those skilled in the art should know that the embodiment of the application is not limited by the described action sequence, because according to the embodiment of the application, some steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the involved actions are not necessarily the necessary of the embodiment of the application.

[0121] The embodiment of the present application provides a user access control system, comprising a server and a client;

[0122] The client is used for sending an access request to the server; the access request comprises identification information of a user;

[0123] The server is used for receiving the access request sent by the client; acquiring mapping information according to the identification information of the user; the mapping information comprises identification information and permission information of a target user mapped by the user; and performing an access operation corresponding to the access request according to the identification information and the permission information of the target user.

[0124] In the present application, the client sends an access request to the server, and the access request comprises identification information of a user; the server acquires mapping information according to the identification information of the user; the mapping information comprises identification information and permission information of a target user mapped by the user; and the server performs an access operation corresponding to the access request according to the identification information and the permission information of the target user. The embodiment of the present application does not need to set a file access control list for each user, and only needs to configure a small number of target users in the server, and the access control requirement of a large number of users can be met by mapping the user to the target user.

[0125] In some embodiments, the client sends an access request to the server, and the access request comprises identification information of a user; the server acquires mapping information according to the identification information of the user; the mapping information comprises identification information and permission information of a target user mapped by the user; and the server performs an access operation corresponding to the access request according to the identification information and the permission information of the target user.

[0126] The mapping information further comprises a valid period;

[0127] The server is used for judging whether the valid period has expired; if the valid period has not expired, the server is used for performing an access operation corresponding to the access request according to the identification information and the permission information of the target user.

[0128] In some embodiments, the server performs an access operation corresponding to the access request according to the identification information and the permission information of the target user, and before performing the access request, the server needs to judge whether the valid period of the mapping information has expired, including judging a user identifier and a group identifier range and a user mapping valid period range; if the valid period has not expired, the server can perform a corresponding access operation according to the identification information and the permission information of the target user.

[0129] The service end further acquires the permission information of the user if the validity period has expired, and performs an access operation corresponding to the access request according to the identity information and the permission information of the user.

[0130] In some embodiments, the service end needs to judge whether the set mapping information validity period has expired, including judging the identity range of the target user and the user mapping validity period range. If the validity period has expired, the permission information of the user is acquired. The service end performs an access operation corresponding to the access request according to the acquired identity information and the permission information of the user.

[0131] In some embodiments, the service end further determines whether the user of the client has started the mapping function after receiving the access request sent by the client. If the user of the client has started the mapping function, the service end acquires the mapping information according to the identity information of the user.

[0132] In some embodiments, the service end receives the access request sent by the client, and the access request contains user permission information and target user mapping information. The service end needs to parse the mapping information after receiving the request. The service end judges whether the user mapping function is started by checking the related configuration options in the file. If the user of the client has started the mapping function, it is needed to query whether the user mapping information exists and judge whether the mapping information is within the validity period. Then, the mapping information is acquired according to the identity information of the user.

[0133] In some embodiments, the service end further receives the mapping information configuration request sent by the client. The mapping information configuration request includes the identity information of the user and a configuration instruction. The mapping information is configured for the user according to the identity information of the user and the configuration instruction.

[0134] In some embodiments, the service end needs to receive the mapping information configuration request sent by the client. The mapping information configuration request includes the identity information of the user and a configuration instruction. The mapping information is configured for the user according to the identity information of the user and the configuration instruction. The client sends a configuration instruction to the service end to update or delete the target user mapping information. When the target user mapping information is updated or deleted, the service end further needs to judge whether the target user is consistent with the to-be-set. When the target user is consistent with the to-be-set, the target user can be updated or deleted. When the mapping information is inconsistent, it means that the original user has other mapping relationships, and an error is directly reported.

[0135] The service end is configured to determine whether corresponding mapping information exists according to the identification information of the user when the configuration instruction is an adding instruction; if the mapping information corresponding to the identification information of the user does not exist, the service end is configured to allocate a target user and a valid period to the user; the identification information of the target user, the permission information and the valid period are taken as the mapping information of the user; the identification information of the user and the mapping information are stored correspondingly; if the mapping information corresponding to the identification information of the user exists when the configuration instruction is a deleting instruction, the service end is configured to delete the mapping information corresponding to the identification information of the user; if the mapping information corresponding to the identification information of the user exists when the configuration instruction is a modifying instruction, the service end is configured to modify at least one of the identification information of the target user, the permission information and the valid period in the mapping information corresponding to the identification information of the user.

[0136] In some embodiments, the service end configures mapping information for the user according to the identification information of the user and a configuration instruction, and before this, the service end also needs to check whether the user contains an adding, deleting, modifying or inquiring identification in the user mapping data table. When the configuration instruction is an adding instruction, it is determined whether corresponding mapping information exists according to the identification information of the user, and if not, the target user and the valid period are allocated to the user; and the identification information of the user and the mapping information are stored correspondingly; when the configuration instruction is a deleting instruction, the service end can delete the mapping information corresponding to the identification information of the user; when the configuration instruction is a modifying instruction, at least one of the identification information of the target user, the permission information and the valid period in the mapping information corresponding to the identification information of the user is modified. If the user does not contain an identification action, error processing is performed, and error processing is also set for other cases.

[0137] In some embodiments, the service end is further configured to send the mapping information of the user to the client, and after the service end is restarted, the mapping information of the user is obtained from the client.

[0138] In this embodiment, the service end sends the mapping information of the user to the client after completing an access operation, and after the service end is restarted, the mapping information of the user can be obtained from the client to perform an access operation.

[0139] Reference Figure 3 , a structure block diagram of a user access control device provided by an embodiment of the application is shown, and the device can specifically include the following modules:

[0140] The mapping information obtaining module 301 is configured to send an access request to the service end, and the access request includes identification information of a user;

[0141] The first execution module 302 is configured to receive an access request sent by a client, acquire mapping information according to identification information of a user, and the mapping information comprises identification information and permission information of a target user mapped by the user.

[0142] The request operation module 303 is configured to perform an access operation corresponding to the access request according to the identification information and the permission information of the target user.

[0143] The mapping information further comprises a validity period.

[0144] The request operation module 303 comprises:

[0145] The request judgment submodule is configured to judge whether the validity period has expired.

[0146] The request operation submodule is configured to perform an access operation corresponding to the access request according to the identification information and the permission information of the target user if the validity period has not expired.

[0147] The application further comprises:

[0148] The permission acquisition module is configured to acquire the permission information of the user if the validity period has expired.

[0149] The second execution module is configured to perform an access operation corresponding to the access request according to the identification information and the permission information of the user.

[0150] The application further comprises:

[0151] The mapping start module is configured to determine whether a user of the client has started a mapping function after receiving an access request sent by the client.

[0152] The mapping information acquisition module 301 comprises:

[0153] The mapping acquisition submodule is configured to acquire mapping information according to the identification information of the user if the user of the client has started the mapping function.

[0154] The application further comprises:

[0155] The configuration receiving module is configured to receive a mapping information configuration request sent by the client, and the mapping information configuration request comprises identification information of the user and a configuration instruction.

[0156] The information configuration module is configured to configure mapping information for the user according to the identification information of the user and the configuration instruction.

[0157] The information configuration module comprises:

[0158] The information adding sub-module is configured to, when the configuration instruction is an adding instruction, determine whether corresponding mapping information exists according to the identification information of the user; if the mapping information corresponding to the identification information of the user does not exist, allocate a target user and a valid period for the user; take the identification information of the target user, the permission information and the valid period as the mapping information of the user; and store the identification information of the user and the mapping information correspondingly;

[0159] The information deleting sub-module is configured to, when the configuration instruction is a deleting instruction, delete the mapping information corresponding to the identification information of the user if the mapping information corresponding to the identification information of the user exists.

[0160] The information modifying sub-module is configured to, when the configuration instruction is a modifying instruction, modify at least one of the identification information of the target user, the permission information and the valid period in the mapping information corresponding to the identification information of the user if the mapping information corresponding to the identification information of the user exists.

[0161] In an embodiment of the present application, the method further comprises:

[0162] The information sending module is configured to send the mapping information of the user to the client and acquire the mapping information of the user from the client after the server is restarted.

[0163] In the embodiment, the information sending module sends the mapping information of the user to the client after completing the access operation, and can acquire the mapping information of the user from the client to perform the access operation after the server is restarted.

[0164] In the present application, the client sends an access request to the server, and the access request includes the identification information of the user; the server acquires mapping information according to the identification information of the user; the mapping information includes the identification information of a target user mapped by the user and permission information; and the server performs an access operation corresponding to the access request according to the identification information of the target user and the permission information. The embodiment of the present application does not need to set a file access control list for each user, and only needs to configure a small number of target users in the server, and can meet the permission access control requirement of a large number of users by mapping the user to the target user.

[0165] For the device embodiment, the description is relatively simple because it is basically similar to the method embodiment, and the related parts refer to the part of the description of the method embodiment.

[0166] As shown in Figure 3 , a structural block diagram of an electronic device is shown, which comprises:

[0167] The computer program comprises a processor, a memory, and a computer program stored on the memory and capable of running on the processor, which, when executed by the processor, implements each process of the above-mentioned user access control method embodiment and achieves the same technical effects. To avoid repetition, details are not described herein.

[0168] As Figure 4 The computer program comprises a processor, a memory, and a computer program stored on the memory and capable of running on the processor, which, when executed by the processor, implements each process of the above-mentioned user access control method embodiment and achieves the same technical effects. To avoid repetition, details are not described herein.

[0169] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between each embodiment can be referred to each other.

[0170] Those skilled in the art should understand that the embodiments of the present embodiment can be provided as a method, device, or computer program product. Therefore, the embodiments of the present embodiment can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present embodiment can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0171] The embodiments of the present embodiment are described with reference to the flowcharts and / or block diagrams of the method, terminal device (system), and computer program product according to the embodiments of the present embodiment. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device realize the functions specified in the flow Figure 1 The apparatus for performing the functions specified in one or more flows and / or blocks. Figure 1 The apparatus for performing the functions specified in one or more flows and / or blocks.

[0172] These computer program instructions can also be stored in a computer readable memory that can guide the computer or other programmable data processing terminal device to work in a specific way, so that the instructions stored in the computer readable memory produce a product comprising instruction apparatus, which implements the functions specified in the flow Figure 1 The apparatus for performing the functions specified in one or more flows and / or blocks. Figure 1 The apparatus for performing the functions specified in one or more flows and / or blocks.

[0173] These computer program instructions can also be loaded into computer or other programmable data processing terminal devices, so that a series of operational steps are performed on the computer or other programmable terminal devices to generate a computer-implemented process, thus the instructions executed on the computer or other programmable terminal devices provide a process for implementing the flowchart Figure 1 one flowchart or multiple flowcharts and / or blocks Figure 1 one block or multiple blocks.

[0174] Although the preferred embodiments of the present application have been described, those skilled in the art can make additional changes and modifications to these embodiments once they get the basic inventive concept. Therefore, the appended claims are intended to cover all the changes and modifications falling within the scope of the embodiments of the present application.

[0175] Finally, it should be noted that, in the present text, the relational terms such as first and second and the like are used merely to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations. Moreover, the terms "comprising", "containing" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a list of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or terminal device. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or terminal device including the said element.

[0176] The above provides a user access control method, a user access control system, a user access control device, an electronic device and a computer readable storage medium, the principle and implementation mode of the present application are described by applying specific examples in the present text, the above embodiment description is only used to help understand the method of the present application and its core idea; at the same time, for the general technical personnel in the art, according to the idea of the present application, the specific implementation mode and application range will have changes, and the above description should not be understood as the limitation of the present application.

Claims

1. A user access control method, characterized in that, Applied to the server side, the method includes: Receive an access request sent by a client; the access request includes the user's identification information; Based on the user's identification information, mapping information is obtained; the mapping information includes the identification information and permission information of the target user to which the user is mapped; Based on the target user's identification and permission information, execute the access operation corresponding to the access request; Receive a mapping information configuration request sent by the client; the mapping information configuration request includes the user's identification information and configuration instructions; Configure mapping information for the user based on the user's identification information and configuration instructions; The step of configuring mapping information for the user based on the user's identification information and configuration instructions includes: When the configuration instruction is an add instruction, it is determined whether there is corresponding mapping information based on the user's identification information; if there is no mapping information corresponding to the user's identification information, a target user and validity period are assigned to the user; the identification information, permission information, and validity period of the target user are used as the user's mapping information; the user's identification information and the mapping information are stored accordingly. When the configuration instruction is a deletion instruction, if there is mapping information corresponding to the user's identification information, then the mapping information corresponding to the user's identification information will be deleted. When the configuration instruction is a modification instruction, if there is mapping information corresponding to the user's identification information, then at least one of the target user's identification information, permission information, and validity period in the mapping information corresponding to the user's identification information is modified.

2. The method according to claim 1, characterized in that, The mapping information also includes a validity period; The step of executing the access operation corresponding to the access request based on the target user's identification information and permission information includes: Determine whether the validity period has expired; If the validity period has not expired, the access operation corresponding to the access request is executed according to the target user's identification information and permission information.

3. The method according to claim 2, characterized in that, Also includes: If the validity period has expired, then obtain the user's permission information; Based on the user's identification and permission information, execute the access operation corresponding to the access request.

4. The method according to claim 1, characterized in that, Also includes: After receiving the access request sent by the client, determine whether the user of the client has enabled the mapping function; The step of obtaining mapping information based on the user's identifier information includes: If the user of the client has enabled the mapping function, then the mapping information is obtained based on the user's identification information.

5. The method according to claim 1, characterized in that, Also includes: Send the user's mapping information to the client; After the server restarts, the user's mapping information is obtained from the client.

6. A user access control system, characterized in that, include: Server and client; The client is used to send an access request to the server; the access request includes the user's identification information; The server is used to receive access requests sent by clients; obtain mapping information based on the user's identification information; the mapping information includes the identification information and permission information of the target user mapped by the user; Based on the target user's identification and permission information, execute the access operation corresponding to the access request; receive the mapping information configuration request sent by the client; The mapping information configuration request includes the user's identification information and configuration instructions; mapping information is configured for the user based on the user's identification information and configuration instructions; when the configuration instructions are add instructions, it is determined whether there is corresponding mapping information based on the user's identification information; if there is no mapping information corresponding to the user's identification information, a target user and validity period are assigned to the user. The target user's identification information, permission information, and validity period are used as the user's mapping information; the user's identification information and the mapping information are stored accordingly; when the configuration instruction is a delete instruction, if there is mapping information corresponding to the user's identification information, the mapping information corresponding to the user's identification information is deleted; when the configuration instruction is a modify instruction, if there is mapping information corresponding to the user's identification information, at least one of the target user's identification information, permission information, and validity period in the mapping information corresponding to the user's identification information is modified.

7. A user access control device, characterized in that, include: The request sending module is used to send an access request to the server; the access request includes the user's identification information. The mapping information acquisition module is used to receive access requests sent by clients; and to acquire mapping information based on the user's identification information; the mapping information includes the identification information and permission information of the target user mapped by the user. The first execution module is used to execute the access operation corresponding to the access request based on the identification information and permission information of the target user; A configuration receiving module is configured to receive mapping information configuration requests sent by the client; The mapping information configuration request includes the user's identification information and configuration instructions; The information configuration module is used to configure mapping information for the user based on the user's identification information and configuration instructions; The information configuration module includes: The information addition submodule is used to determine whether there is corresponding mapping information based on the user's identification information when the configuration instruction is an addition instruction; if there is no mapping information corresponding to the user's identification information, then a target user and validity period are assigned to the user; the identification information, permission information and validity period of the target user are used as the mapping information of the user; and the user's identification information and the mapping information are stored accordingly. The information deletion submodule is used to delete the mapping information corresponding to the user's identification information if the configuration instruction is a deletion instruction and the mapping information corresponding to the user's identification information exists. The information modification submodule is used to modify at least one of the target user's identification information, permission information, and validity period in the mapping information corresponding to the user's identification information when the configuration instruction is a modification instruction, if there is mapping information corresponding to the user's identification information.

8. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of the user access control method as described in any one of claims 1-5.

9. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of the user access control method as described in any one of claims 1-5.

Images