Independent full-granularity permission control system and method

Abstract

The invention discloses an independent full-granularity permission control system and method, and the system comprises a permission definition module which is the basis of the whole system and is responsible for the precise and comprehensive definition of permissions of various granularities; the authority distribution module undertakes an important task of accurately distributing the defined authority to the user or the user group; the method has the advantages that the problems that in the prior art, authority control granularity is rough, flexibility is insufficient, complex scene coping capacity is weak, and management efficiency is low are solved, and accurate, flexible and efficient authority management of various resources and operations in a large-scale cluster storage product is achieved; the authority control fineness can be obviously improved, and the authority is accurate to a specific field of a file or even a specific operation action; and the flexibility of permission configuration is enhanced, and business changes and personnel adjustment are quickly responded.

Description

Technical Field

[0001] The present invention belongs to the technical field of authority control, and in particular relates to an independent full-granularity authority control system and method. Background Art

[0002] In today's digital age, large-scale cluster storage products have become a key infrastructure for data storage and management. With the rapid development of information technology, the amount of data has exploded, data types have become increasingly diverse, and business application scenarios have become increasingly complex. Against this background, permission control, as an important means to ensure data security and stable system operation, has become increasingly important.

[0003] Technologies such as access control lists (ACLs) and role-based access control (RBAC) are common methods in the field of permission control. Access control lists achieve a certain degree of permission management by clearly listing the access rights of each user or group to specific resources. However, when faced with massive data and complex operations in large-scale cluster storage environments, the management and maintenance of ACLs becomes extremely cumbersome and inefficient. Role-based access control assigns users to different roles, each with a fixed set of permissions. This approach simplifies permission management to a certain extent, but because the permissions of roles are pre-defined and fixed, it is difficult to meet dynamically changing business needs and complex permission scenarios.

[0004] In terms of key technologies, permission control not only involves the identification and verification of user identities, but also includes the precise description of resources, accurate definition of operations, and flexible formulation and execution of permission policies; at the same time, how to achieve efficient permission verification and rapid permission decision-making in a large-scale distributed environment is also a technical problem that needs to be solved urgently.

[0005] In the prior art, the widely used role-based permission control model has obvious limitations in practical applications. Taking the file management system of a large enterprise as an example, the system assigns roles such as administrators and ordinary employees to employees in different departments. Administrators have full control over all files, including reading, writing, deleting, etc.; ordinary employees are only given the permission to read some files. Although this role-based permission allocation method ensures the basic security of the system to a certain extent, it cannot achieve fine control over specific files, specific fields, or even subtle operations. For example, the report files of the financial department may contain sensitive financial data, such as revenue, profit, etc. The prior art cannot allow only specific employees to view the revenue field and prohibit them from accessing the profit field. In addition, when the business process changes and it is necessary to temporarily adjust the operating permissions of an employee to a specific file, the prior art often requires cumbersome configuration and re-authorization, which seriously affects work efficiency.

[0006] Existing technologies are usually unable to refine permissions to specific files, fields, or operation levels, which means that even in some cases only limited access control is required for some data, users have to be granted broad permissions to the entire file or data set, increasing the risk of data leakage;

[0007] When an enterprise adjusts its business structure, personnel changes, or business processes change, existing technologies are difficult to quickly and flexibly adapt to these changes and reconfigure user permissions. This may result in permission management being unable to keep up with business needs during business transformation, affecting the normal development of work.

[0008] In a multi-tenant environment, different tenants may have completely different access requirements for the same resources. Existing technologies make it difficult to provide personalized and detailed permission control for each tenant while ensuring resource sharing, which can easily lead to permission conflicts between tenants and data security risks.

[0009] In large-scale cluster storage systems, as the number of users and resources increases, the workload of permission configuration and maintenance grows exponentially; existing technologies lack efficient management tools and automation mechanisms, resulting in high permission management costs and prone to human errors. Summary of the invention

[0010] The purpose of the present invention is to provide an independent full-granularity permission control system and method to solve the problems of coarse permission control granularity, insufficient flexibility, weak ability to cope with complex scenarios and low management efficiency in the prior art, and to achieve accurate, flexible and efficient permission management of various resources and operations in large-scale cluster storage products.

[0011] To achieve the above object, the present invention provides the following technical solution: an independent full-granularity authority control system, comprising

[0012] The permission definition module is the basis of the entire system and is responsible for accurately and comprehensively defining permissions of various granularities;

[0013] A rights allocation module, which is responsible for accurately allocating defined rights to users or user groups;

[0014] The permission verification module plays a key role when a user makes an operation request. It obtains the user's operation request information in real time and quickly and accurately compares and verifies it with the permission rules stored in the permission definition module to determine whether the user has the legal authority to perform the operation;

[0015] The permission audit module is used to record the usage of permissions throughout the process.

[0016] As a preferred technical solution of the present invention, the permission definition module adopts a tree structure to store permission definition information, the root node represents the highest level permission category; the branch nodes are gradually refined into specific permission types; and the leaf nodes correspond to the most specific permission instances.

[0017] As a preferred technical solution of the present invention, the root node represents the highest level of permission category, including file system permissions and database permissions; the branch nodes are gradually refined into specific permission types, including file reading permissions and field modification permissions; the leaf nodes correspond to the most specific permission instances, including reading permissions for a specific file and modifying permissions for a specific field in a database table.

[0018] As a preferred technical solution of the present invention, the permission allocation module is equipped with a user and user group management interface, through which the administrator can create, modify and delete users and user groups, and assign corresponding permissions to them; the permission allocation module supports batch allocation of permissions. When the same permissions need to be assigned to multiple users or user groups, the administrator only needs to perform one operation to complete the batch allocation; the permission allocation module has permission inheritance and permission exclusion.

[0019] As a preferred technical solution of the present invention, the permission verification module adopts a hash algorithm and a cache mechanism to achieve fast permission verification.

[0020] As a preferred technical solution of the present invention, the permission verification module adopts a hash algorithm and a cache mechanism to achieve fast permission verification, and the corresponding method is as follows: when a user initiates an operation request, the permission verification module first converts the user's identity information and the operation request into a unique hash value, and then searches the cache for whether there is a matching permission record; if so, the verification result is directly returned; if not, the corresponding permission rules are obtained from the permission definition module for comparison and verification, and the verification result is stored in the cache for quick query next time.

[0021] As a preferred technical solution of the present invention, the permission audit module adopts a distributed log storage architecture to store the relevant information of permission usage in the form of logs in a dispersed manner on multiple nodes.

[0022] The present invention also discloses an independent full-granularity authority control method, comprising the following steps:

[0023] Step 1: In the permission definition module, the administrator first needs to classify and describe the various resources in the system; then, for each type of resource, define its possible operation types; further refine the operation types to specific granularity; after completing the permission definition, store it in the database of the permission definition module for subsequent query and use;

[0024] Step 2: Through the permission allocation module, the administrator can create different users and user groups and assign corresponding permissions to them;

[0025] Step 3: The user initiates an operation request on the client, and the request information is transmitted to the server through the network;

[0026] Step 4: After receiving the user's operation request, the permission verification module first obtains the permission information of the user or user group from the permission allocation module, and then compares and verifies it with the permission rules in the permission definition module; in the verification process, efficient algorithms and data structures are used; if the verification passes, the verification result is notified to the server, and the server executes the user's operation request; if the verification fails, an error prompt message is returned to the user;

[0027] Step 5: After the user's operation is completed, whether it is successful or failed, the permission audit module will record the detailed information of the operation, and the audit information will be stored in the database in the form of logs; the permission audit module can also monitor and warn the audit information in real time according to preset rules and policies, and promptly detect abnormal permission usage behavior.

[0028] As a preferred technical solution of the present invention, in the step 1, in the process of defining permissions, the administrator can use predefined templates and rules or make customized settings according to actual business needs.

[0029] As a preferred technical solution of the present invention, in the step 2, when allocating permissions, direct allocation, inherited allocation and policy-based allocation can be adopted.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] Solve the problems of coarse permission control granularity, insufficient flexibility, weak ability to cope with complex scenarios and low management efficiency in existing technologies, and realize accurate, flexible and efficient permission management of various resources and operations in large-scale cluster storage products;

[0032] It can significantly improve the precision of permission control, and accurately define permissions to specific fields of files or even specific operations; enhance the flexibility of permission configuration, and quickly respond to business changes and personnel adjustments; effectively deal with complex permission scenarios such as multi-tenancy, and ensure the personalized needs and data security of different tenants; greatly improve the efficiency of permission management, and reduce management costs and the risk of human errors;

[0033] It can better adapt to future business development and technological updates, and provide strong guarantees for the safe and stable operation of large-scale cluster storage products. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is the system principle diagram of the present invention;

[0035] Figure 2 It is a flow chart of the control method of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] Example 1

[0038] See also Figure 1 , which is the first embodiment of the present invention, and provides an independent full-granularity permission control system, including a permission definition module, a permission allocation module, a permission verification module and a permission audit module, and these modules cooperate with each other to jointly achieve the goal of full-granularity permission control;

[0039] The permission definition module is the foundation of the entire system. It is responsible for accurately and comprehensively defining permissions of various granularities. It can not only define common file-level permissions, such as read, write, delete, etc., but also go deep into field-level permissions, such as query and modify permissions for specific fields in database tables, and even refine to operation-level permissions, such as copy, move, rename, etc.

[0040] The permission allocation module is responsible for accurately allocating defined permissions to users or user groups. It has powerful user and user group management functions and can flexibly customize personalized permission packages for various users or user groups according to different business needs and organizational structures.

[0041] The permission verification module plays a key role when a user makes an operation request. It obtains the user's operation request information in real time and quickly and accurately compares and verifies it with the permission rules stored in the permission definition module to determine whether the user has the legal authority to perform the operation.

[0042] The permission audit module is like a faithful recorder, recording the use of permissions throughout the process, including detailed information such as who performed what operation and when, and whether the operation was successful. This provides valuable data support for subsequent permission tracing, problem troubleshooting and compliance checks.

[0043] Permission definition module: It uses an advanced tree structure to store permission definition information. This structure is similar to a large tree with luxuriant branches and leaves, with clear hierarchy and logical relationships. The root node represents the highest level of permission categories, such as file system permissions, database permissions, etc. The branch nodes are gradually refined into specific permission types, such as file read permissions, field modification permissions, etc. The leaf nodes correspond to the most specific permission instances, such as the read permission of a specific file, the modification permission of a specific field in a database table, etc. This tree structure not only facilitates the hierarchical management of permissions, making the permission definition clearer and more organized, but also facilitates the rapid search and retrieval of specific permission information, improving the efficiency and accuracy of permission definition.

[0044] Permission allocation module: equipped with a powerful user and user group management interface, which is simple and intuitive and easy to operate. Through this interface, administrators can easily create, modify and delete users and user groups, and assign corresponding permissions to them. At the same time, the module also supports the function of batch allocation of permissions. When the same permissions need to be assigned to multiple users or user groups, the administrator only needs to perform one operation to complete the batch allocation, which greatly improves work efficiency. In addition, the permission allocation module also has the functions of permission inheritance and permission exclusion, that is, the child user group can inherit part or all of the permissions of the parent user group, and can also exclude certain specific permissions as needed to meet complex business needs.

[0045] Permission verification module: It uses an efficient hash algorithm and cache mechanism to achieve fast permission verification. When a user initiates an operation request, the permission verification module first converts the user's identity information and operation request into a unique hash value, and then searches the cache for a matching permission record. If it exists, the verification result is directly returned. If it does not exist, the corresponding permission rules are obtained from the permission definition module for comparison and verification, and the verification results are stored in the cache for quick query next time. This method greatly improves the speed of permission verification and ensures the system's responsiveness in high-concurrency scenarios.

[0046] Permission audit module: It adopts a distributed log storage architecture to store the relevant information of permission usage in the form of logs on multiple nodes. This architecture not only ensures the high reliability and high availability of log data, but also does not cause data loss even if some nodes fail. It also enables fast log retrieval and analysis. At the same time, the permission audit module also supports real-time monitoring and early warning functions. When abnormal permission usage behavior is found, it can issue an alarm in time to notify the administrator to handle it, effectively preventing potential security risks.

[0047] As the cornerstone of the entire permission management system, the permission definition module provides rich and accurate permission definition information for the permission allocation module. After receiving this information, the permission allocation module makes reasonable permission allocation according to the needs of users and user groups. After the allocation is completed, when the user initiates an operation request, the permission verification module obtains the permissions allocated to the user or user group in the permission allocation module in real time, and compares and verifies them with the permission rules in the permission definition module. If the verification is successful, the user's operation is executed, and the permission audit module records the relevant information of the operation. If the verification fails, the user's operation is rejected, and the permission audit module also records the failed operation attempt. In this process, the various modules work closely together to form an efficient and stable permission management closed loop.

[0048] The permission definition module is like a rich treasure house, providing a variety of precious permission resources; the permission allocation module is like a shrewd housekeeper, selecting appropriate permission resources from the treasure house for allocation according to user needs; the permission verification module is a strict guard, guarding the door of the treasure house to ensure that only legally authorized users can obtain and use permission resources; and the permission audit module is a careful recorder, recording the use of permission resources in the treasure house throughout the process; each module has its own responsibilities and is interrelated, jointly ensuring the security, accuracy and efficiency of permission management.

[0049] Working principle:

[0050] When a user initiates an operation request to the server through the client, the request information is first transmitted to the permission verification module. After receiving the request, the permission verification module immediately obtains the permission rules related to the request from the permission definition module. These rules describe in detail the permission conditions that the user needs to have in the current operation scenario.

[0051] Subsequently, the permission verification module compares and verifies the obtained permission rules with the actual permissions assigned to the user or user group in the permission allocation module; this process is similar to matching a key with a lock. The lock can only be opened when the key teeth are completely consistent with the lock core.

[0052] If the permissions the user has completely match the permissions required for the operation request, that is, the permissions are legal, the permission verification module will send an instruction to the server to allow the operation. The server executes the user's operation request and notifies the permission audit module to record the detailed information of the operation, including the time, user, operation object, operation type, etc.

[0053] On the contrary, if the user's permissions are insufficient to meet the operation request, that is, the permissions are illegal, the permission verification module will send an instruction to the server to reject the operation and return the corresponding error prompt information to the user; at the same time, the permission audit module will also record the failed operation attempt for subsequent analysis and tracing.

[0054] Example 2

[0055] See also Figure 1 , which is the second embodiment of the present invention, is based on the previous embodiment, except that:

[0056] Permission definition module: In addition to using a tree structure to store permission definition information, you can also consider using a relational database to store permission definition information; by designing complex table structures, such as permission tables, resource tables, operation tables, and user permission relationship tables, hierarchical management of permissions can be achieved;

[0057] Permission allocation module: In addition to directly allocating permissions to users or user groups, permissions can also be allocated based on policies. For example, user permissions can be dynamically calculated and allocated based on user attributes such as position, department, project role, and current business processes and environmental factors. This approach can more flexibly adapt to business changes.

[0058] Permission verification module: In addition to the hash algorithm and cache mechanism, a verification method based on a rule engine can also be used; the rule engine can infer and verify the user's permissions based on a pre-defined set of rules; this method has high flexibility and scalability;

[0059] Permission audit module: In addition to using a distributed log storage architecture, you can also use a centralized log storage architecture to store all permission audit logs in a central database. By optimizing the database design and query statements, you can achieve fast log retrieval and analysis. This method is relatively simple to deploy and manage.

[0060] Example 3

[0061] See also Figure 2 , which is the third embodiment of the present invention, and provides an independent full-granularity permission control method, comprising the following steps:

[0062] Step 1: In the permission definition module, the administrator first needs to classify and describe various resources in the system, including files, database tables, functional modules, etc. Then, for each type of resource, define its possible operation types, such as read, write, modify, delete, etc. Next, further refine the operation type to a specific granularity, such as file level, field level, operation level, etc. In the process of defining permissions, the administrator can use predefined templates and rules, or customize settings according to actual business needs; After completing the permission definition, it is stored in the database of the permission definition module for subsequent query and use;

[0063] Step 2: Through the permission allocation module, administrators can create different users and user groups and assign corresponding permissions to them. When allocating permissions, multiple methods can be used, such as direct allocation, inheritance allocation, and policy-based allocation. Direct allocation means that the administrator directly specifies specific permissions for users or user groups. Inheritance allocation means that a child user group can automatically inherit some or all permissions of the parent user group. Policy-based allocation means that the corresponding permissions are automatically assigned to users based on pre-set policies, such as the user's position, department, project role, etc. After the permission allocation is completed, the allocation results are stored in the database of the permission allocation module.

[0064] Step 3: The user initiates an operation request on the client, and the request information is transmitted to the server through the network;

[0065] Step 4: After receiving the user's operation request, the permission verification module first obtains the permission information of the user or user group from the permission allocation module, and then compares and verifies it with the permission rules in the permission definition module; during the verification process, efficient algorithms and data structures are used to ensure the speed and accuracy of the verification; if the verification passes, the verification result is notified to the server, and the server executes the user's operation request; if the verification fails, an error prompt message is returned to the user;

[0066] Step 5: After the user's operation is completed, whether it is successful or failed, the permission audit module will record the detailed information of the operation, including the time, user, operation object, operation type, operation result, etc.; these audit information are stored in the database in the form of logs for subsequent query, analysis and statistics; at the same time, the permission audit module can also monitor and warn the audit information in real time according to preset rules and policies, and promptly discover abnormal permission usage behavior.

[0067] Selection of various parameters:

[0068] Response time parameters for permission verification: In a large-scale cluster storage environment, users have extremely high requirements for the response time of permission verification. In order to ensure system performance and user experience, the response time of permission verification should be controlled at the millisecond level. Therefore, when selecting the response time parameters for permission verification, it is necessary to comprehensively consider factors such as the system's hardware configuration, network environment, complexity of permission rules, and number of concurrent users. Generally speaking, the response time can be shortened by optimizing algorithms, using caching technology, and reasonably allocating server resources. For example, for a system with 1,000 concurrent users and 100,000 permission rules, the average response time for permission verification should not exceed 50 milliseconds on a medium-configuration server.

[0069] Storage capacity parameters for permission auditing: Since the permission auditing module needs to record a large amount of operation log information, storage capacity is a key parameter. When determining the storage capacity for permission auditing, factors such as the system's operating time, the frequency of operations, and the retention period of logs need to be considered. Generally speaking, distributed storage architecture, data compression technology, and regular cleanup of expired logs can be used to meet storage requirements. For example, for a system that needs to retain operation logs for one year, an average of 10GB of log data is generated every day. At least 3.65TB of storage space needs to be configured, and data compression technology should be used to reduce the actual storage space to about 1.8TB.

[0070] Although the embodiments of the present invention have been shown and described, as detailed above, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An independent full-granularity permission control system, characterized by: include The permission definition module is the basis of the entire system and is responsible for accurately and comprehensively defining permissions of various granularities; A rights allocation module, which is responsible for accurately allocating defined rights to users or user groups; The permission verification module plays a key role when a user makes an operation request. It obtains the user's operation request information in real time and quickly and accurately compares and verifies it with the permission rules stored in the permission definition module to determine whether the user has the legal authority to perform the operation; The permission audit module is used to record the usage of permissions throughout the process.

2. An independent full-granularity authority control system according to claim 1, characterized in that: The permission definition module uses a tree structure to store permission definition information, where the root node represents the highest level permission category; the branch nodes are gradually refined into specific permission types; and the leaf nodes correspond to the most specific permission instances.

3. An independent full-granularity authority control system according to claim 2, characterized in that: The root node represents the highest level of permission category, including file system permissions and database permissions; branch nodes are gradually refined into specific permission types, including file read permissions and field modification permissions; leaf nodes correspond to the most specific permission instances, including read permissions for a specific file and modification permissions for a specific field in a database table.

4. The independent full-granularity permission control system according to claim 1 is characterized in that: The authority allocation module is equipped with a user and user group management interface, through which the administrator can create, modify and delete users and user groups, and assign corresponding permissions to them; The permission allocation module supports batch allocation of permissions. When the same permissions need to be assigned to multiple users or user groups, the administrator only needs to perform one operation to complete the batch allocation. The permission allocation module has permission inheritance and permission exclusion.

5. The independent full-granularity permission control system according to claim 1 is characterized in that: The permission verification module adopts a hash algorithm and a cache mechanism to achieve fast permission verification.

6. An independent full-granularity authority control system according to claim 5, characterized in that: The permission verification module adopts a hash algorithm and a cache mechanism to achieve fast permission verification. The corresponding method is as follows: when a user initiates an operation request, the permission verification module first converts the user's identity information and the operation request into a unique hash value, and then searches the cache for whether there is a matching permission record; if so, the verification result is directly returned; if not, the corresponding permission rules are obtained from the permission definition module for comparison and verification, and the verification result is stored in the cache for quick query next time.

7. The independent full-granularity permission control system according to claim 1 is characterized by: The permission audit module adopts a distributed log storage architecture to store the relevant information of permission usage in the form of logs in multiple nodes.

8. An independent full-granularity permission control method, characterized by: The steps include: Step 1: In the permission definition module, the administrator first needs to classify and describe the various resources in the system; then, for each type of resource, define its possible operation types; further refine the operation types to specific granularity; after completing the permission definition, store it in the database of the permission definition module for subsequent query and use; Step 2: Through the permission allocation module, the administrator can create different users and user groups and assign corresponding permissions to them; Step 3: The user initiates an operation request on the client, and the request information is transmitted to the server through the network; Step 4: After receiving the user's operation request, the permission verification module first obtains the permission information of the user or user group from the permission allocation module, and then compares and verifies it with the permission rules in the permission definition module; during the verification process, efficient algorithms and data structures are used; if the verification passes, the verification result is notified to the server, and the server executes the user's operation request; If the verification fails, an error message is returned to the user; Step 5: After the user's operation is completed, whether it is successful or failed, the permission audit module will record the detailed information of the operation, and the audit information will be stored in the database in the form of logs; The permission audit module can also monitor and warn audit information in real time according to preset rules and policies, and promptly detect abnormal permission usage behavior.

9. The independent full-granularity permission control method according to claim 8, characterized in that: In step 1, in the process of defining permissions, the administrator can use predefined templates and rules or customize settings according to actual business needs.

10. The independent full-granularity permission control method according to claim 8, characterized in that: In the step 2, when allocating permissions, direct allocation, inherited allocation, and policy-based allocation can be used.

Images