Authentication method and device

Abstract

The embodiment of the present invention provides an authentication method and device, which allocates permissions to a target object through a device tree to obtain permission information, wherein the permission information is used to indicate whether the target object has permissions to each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels; creates a permission table according to the device tree and the permission information, wherein the permission table records the node type of each node in the device tree; determines whether the target object has permissions to the target device according to the node type, solves the problem of consuming more storage resources due to the large amount of permission device data in the related technology, and thus achieves the effect of reducing the storage resources required for storage device permissions and saving resources.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of Internet of Things device management, and in particular, to an authentication method and device. Background Art

[0002] For IoT device management platforms, such as video surveillance platforms, there are not only a large number of devices, but also a large number of users. Different users have different permissions to view which devices, which results in a huge amount of data on device permissions. For example, with 5 million devices and 5,000 roles, the maximum amount of data on device permissions can reach 25 billion. Faced with tens of billions of data, once the device and permission configuration changes, a large amount of device permission data will change. In this scenario of large data volume and large changes, it is difficult for a database like MySQL to meet the requirements.

[0003] There is currently no effective solution to the above problems. Summary of the invention

[0004] The embodiment of the present invention provides an authentication method and device to at least solve the problem in the related art that a large amount of storage resources are consumed due to a large amount of data in an authority device.

[0005] According to one embodiment of the present invention, there is provided an authentication method, comprising: assigning permissions to a target object through a device tree to obtain permission information, wherein the permission information is used to indicate whether the target object has permissions to each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels; creating a permission table according to the device tree and the permission information, wherein the permission table records the node type of each node in the device tree; and determining whether the target object has permissions to the target device according to the node type.

[0006] In an exemplary embodiment, creating a permission table according to the device tree and the permission information includes: determining a node type of a node on the device tree according to the permission information; and recording the node type in a field corresponding to the node in the permission table.

[0007] In an exemplary embodiment, determining the node type of a node on the device tree based on the permission information includes: when the target node is the directory in the device tree, determining the node type of the directory based on the permission information includes one of the following: a directory with no point permissions, a fully selected directory, a half-selected directory, and a removed directory; when the target node is the device, determining the node type of the device based on the permission information includes one of the following: a fully selected channel device, a half-selected channel device, all channel devices removed, and some channel devices removed; when the target node is the channel, determining the node type of the channel based on the permission information includes one of the following: adding a channel and removing a channel.

[0008] In an exemplary embodiment, permissions are assigned to the target object based on the device tree, including: determining a node selected as a first identifier on the device tree as a node to which the target object has permissions; determining a node selected as a second identifier on the device tree as a node to which the target object does not have permissions; and determining an unselected node on the device tree as a node to which permissions are not assigned to the target object, wherein the target object does not have permissions for the unselected nodes.

[0009] In an exemplary embodiment, when the target node is the directory in the device tree, determining the node type of the directory according to the permission information includes: determining that the first directory is a directory without point permissions when the following conditions are met: all directories are mounted under the first directory; or, directories and devices are mounted under the first directory, and all devices mounted under the first directory are not selected; determining that the second directory is a fully selected directory when the following conditions are met: all devices and directories mounted under the second directory are selected as the first identifier, and channels under the devices mounted under the second directory are selected as the first identifier; determining that the third directory is a semi-selected directory when the following conditions are met: all devices and directories mounted under the third directory are selected as the first identifier, and there are unselected channels among the channels under the devices mounted under the third directory; or, there are unselected devices among the devices mounted under the third directory; determining that the fourth directory is a removed directory when the following conditions are met: all devices and directories mounted under the fourth directory are selected, and all channels under the devices mounted under the fourth directory are selected, and there are devices or channels selected as the second identifier among the devices mounted under the fourth directory.

[0010] In an exemplary embodiment, when the target node is the device, determining the node type of the device according to the permission information includes: determining that the first device is the fully selected channel device when the following conditions are met: the first device is selected as the first identifier, and all the channels mounted under the first device are selected as the first identifier; determining that the second device is the half-selected channel device when the following conditions are met: the second device is selected as the first identifier, and there are unselected channels among the channels mounted under the second device; determining that the third device is the all-channel-removed device when the following conditions are met: the third device is selected as the second identifier, and all the channels mounted under the third device are identified as the second identifier; determining that the fourth device is the partial-channel-removed device when the following conditions are met: the fourth device is selected as the first identifier, and all the channels mounted under the fourth device are selected, and there are channels selected as the second identifier among the channels mounted under the fourth device.

[0011] In an exemplary embodiment, when the target node is the channel, determining the node type of the channel according to the permission information includes: determining that the first channel is the added channel when the following conditions are met: the channel selected as the first identification; and determining that the second channel is the removed channel when the following conditions are met: the channel selected as the second identification.

[0012] In an exemplary embodiment, determining whether the target object has permission for the target device is based on the node type in the permission table, including: determining the directory mounted on the target device through the device tree to obtain the target directory; searching for the parent directory of the target directory in the directory table, wherein the directory table records the encoding of the parent directory of each directory in the device tree; determining whether the target object has permission for the target device through the node type of the target directory in the permission table, and / or the node type of the parent directory of the target directory.

[0013] In an exemplary embodiment, before searching the directory table for the parent directory of the target directory, the method further comprises: recording the encoding of each directory in the device tree and the parent directory of the directory in the directory table.

[0014] According to another embodiment of the present invention, an authentication device is provided, including: an allocation module, used to allocate permissions to a target object through a device tree to obtain permission information; wherein the permission information is used to indicate whether the target object has permissions to each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels; a creation module, used to create a permission table based on the device tree and the permission information; wherein the permission table records the node type of each node in the device tree; and a determination module, used to determine whether the target object has permissions to the target device based on the node type.

[0015] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein the computer program implements the steps of any of the above methods when executed by a processor.

[0016] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0017] According to yet another embodiment of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0018] According to yet another embodiment of the present invention, a computer program product is provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, the steps of any of the above methods are implemented.

[0019] Through the present invention, by allocating permissions to the target object through the device tree, permission information is obtained, wherein the permission information is used to indicate whether the target object has permissions for each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels; a permission table is created according to the device tree and the permission information, wherein the permission table records the node type of each node in the device tree; and whether the target object has permissions for the target device is determined according to the node type. Therefore, the problem of consuming more storage resources due to the large amount of permission device data in the related technology can be solved, and the storage resources required for storage device permissions can be reduced, thereby saving resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a hardware structure block diagram of a mobile terminal of an authentication method according to an embodiment of the present invention;

[0021] Figure 2is a flow chart of an authentication method according to an embodiment of the present invention;

[0022] Figure 3 is a schematic diagram of directory information according to an embodiment of the present invention;

[0023] Figure 4 is a schematic diagram of device information according to an embodiment of the present invention;

[0024] Figure 5 is a schematic diagram of channel information according to an embodiment of the present invention;

[0025] Figure 6 is a schematic diagram of a storage structure of a permission table according to an embodiment of the present invention;

[0026] Figure 7 is a diagram showing the meaning of the combination of NODE_TYPE and NODE_CHECK fields according to an embodiment of the present invention;

[0027] Figure 8 is a schematic diagram of authentication according to an embodiment of the present invention;

[0028] Fig. 9 is a schematic diagram of storage permission data according to an embodiment of the present invention;

[0029] Fig.10 is a flowchart of an authentication method according to an embodiment of the present invention;

[0030] Fig.11 is a schematic diagram of a device tree for scenario 1 according to an embodiment of the present invention;

[0031] Fig.12 is a schematic diagram of storing permission data in scenario 1 according to an embodiment of the present invention;

[0032] Fig.13 is a schematic diagram of a device tree for scenario 2 according to an embodiment of the present invention;

[0033] Fig.14 is a schematic diagram of storing permission data in scenario 2 according to an embodiment of the present invention;

[0034] Fig.15 is a schematic diagram of a device tree for scenario 3 according to an embodiment of the present invention;

[0035] Fig.16 is a schematic diagram of storing permission data in scenario 3 according to an embodiment of the present invention;

[0036] Fig.17 is a schematic diagram of a device tree for scenario 4 according to an embodiment of the present invention;

[0037] Fig.18 is a schematic diagram of storing permission data in scenario 4 according to an embodiment of the present invention;

[0038] Fig.19 is a schematic diagram of a device tree for scenario 5 according to an embodiment of the present invention;

[0039] Fig. 20 is a schematic diagram of permission data storage in scenario 5 according to an embodiment of the present invention;

[0040] Fig.21 is a schematic diagram of a device tree for scenario 6 according to an embodiment of the present invention;

[0041] Fig. 22 is a schematic diagram of storing permission data in scenario 6 according to an embodiment of the present invention;

[0042] Fig.23 is a schematic diagram of a device tree for scenario 7 according to an embodiment of the present invention;

[0043] Fig.24 is a schematic diagram of storing permission data in scenario 7 according to an embodiment of the present invention;

[0044] Fig.25 is a schematic diagram of a device tree for scenario 8 according to an embodiment of the present invention;

[0045] Fig.26 is a schematic diagram of storing permission data in scenario 8 according to an embodiment of the present invention;

[0046] Fig. 27 is a schematic diagram of a device tree for scenario 9 according to an embodiment of the present invention;

[0047] Fig.28 is a schematic diagram of storing permission data in scenario 9 according to an embodiment of the present invention;

[0048] Fig.29 is a schematic diagram of a device tree for scenario 10 according to an embodiment of the present invention;

[0049] Fig.30 is a schematic diagram of storing permission data in scenario 10 according to an embodiment of the present invention;

[0050] Fig.31 is a schematic diagram of a device tree for scenario 11 according to an embodiment of the present invention;

[0051] Fig.32 is a schematic diagram of storing permission data in scenario 11 according to an embodiment of the present invention;

[0052] Fig.33 is a schematic diagram of a device tree for scenario 12 according to an embodiment of the present invention;

[0053] Fig.34 is a schematic diagram of storing permission data in scenario 12 according to an embodiment of the present invention;

[0054] Fig.35is a schematic diagram of a device tree for scenario 13 according to an embodiment of the present invention;

[0055] Fig.36 is a schematic diagram of storing permission data in scenario 13 according to an embodiment of the present invention;

[0056] Fig.37 is a structural block diagram of an authentication device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0057] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0058] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0059] The authentication method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure diagram of a mobile terminal of an authentication method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0060] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the authentication method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0061] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0062] In this embodiment, a method running on the above mobile terminal or network architecture is provided. Figure 2 is a flow chart of an authentication method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0063] Step S202, assigning permissions to the target object through the device tree to obtain permission information, wherein the permission information is used to indicate whether the target object has permissions for each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels;

[0064] The device tree is a tree structure formed by devices. The root node of the device tree is a directory, which is used to manage devices in groups. In this embodiment, an XPATH field is designed based on the basic information of the directory, which is used to quickly find all parent directory codes according to the directory code. Figure 3 is a schematic diagram of directory information according to an embodiment of the present invention. Figure 3 For example, to query all parent directory codes of the directory code "6283211249813696", the XPATH field information is taken, and all parent directory codes that can be obtained are "1851646242949184" and "5287501778389184".

[0065] Mount devices and channels under the above directories. Figure 4 is a schematic diagram of device information according to an embodiment of the present invention, including directory codes, device codes, etc. Figure 5 It is a schematic diagram of channel information according to an embodiment of the present invention, including directory coding, channel coding and other contents.

[0066] The target object is the user who uses the device. The permission refers to the authorization of the user to obtain the device. By granting or revoking the permission, the user can limit or expand the scope of use of the device. The permission information is whether the target object has the device and channel permissions of the device tree. For example, a checked device or channel means that it has permission, and an unchecked device or channel means that it does not have permission.

[0067] Specifically, assigning permissions includes: determining a node selected as a first identifier on the device tree as a node to which the target object has permissions; determining a node selected as a second identifier on the device tree as a node to which the target object does not have permissions; and determining an unselected node on the device tree as a node to which permissions are not assigned to the target object, wherein the target object does not have permissions for the unselected nodes.

[0068] The first mark is "√", which means that the target object is assigned the permission of the node and has the permission. The second mark is "×", which means that the target is assigned the permission of the node but has no permission. The node without the first mark or the second mark in the device tree indicates that the target object is not assigned the permission, that is, the target object does not have the permission to the node.

[0069] Step S204, creating a permission table according to the device tree and the permission information, wherein the permission table records the node type of each node in the device tree;

[0070] Specifically, creating the permission table includes determining the node type of the node on the device tree according to the permission information; and recording the node type in a field corresponding to the node in the permission table.

[0071] Figure 6 is a schematic diagram of the storage structure of the permission table according to an embodiment of the present invention, such as Figure 6 As shown, based on the basic information of permissions, the NODE_TYPE and NODE_CHECK fields are designed to reduce the storage of device permission data. Among them, NODE_CHECK stores the type of user permissions for the device, including: select all / half select / eliminate all / eliminate some / no permissions.

[0072] Specifically, determining the node type of the node on the device tree according to the permission information includes: when the target node is the directory in the device tree, determining the node type of the directory according to the permission information includes one of the following: a directory with no point permissions, a fully selected directory, a half-selected directory, and a removed directory; when the target node is the device, determining the node type of the device according to the permission information includes one of the following: a fully selected channel device, a half-selected channel device, all channel devices removed, and some channel devices removed; when the target node is the channel, determining the node type of the channel according to the permission information includes one of the following: adding a channel and removing a channel.

[0073] Figure 7 is a diagram showing the meaning of the NODE_TYPE and NODE_CHECK field combinations according to an embodiment of the present invention, such as Figure 7 As shown, the types of directories include directories without point permissions, fully selected directories, partially selected directories, and excluded directories; the types of devices include fully selected channel devices, partially selected channel devices, and excluded all channel devices; and the types of channels include added channels and excluded channels.

[0074] Please note that the following ordinal numbers such as first, second, third, and fourth do not represent the order but are only used to distinguish.

[0075] Specifically, the first directory is determined to be a directory without point permissions if the following conditions are met: all directories are mounted under the first directory; or, directories and devices are mounted under the first directory, and all devices mounted under the first directory are not selected; the second directory is determined to be a fully selected directory if the following conditions are met: all devices and directories mounted under the second directory are selected as the first identifier, and the channels under the devices mounted under the second directory are selected as the first identifier; the third directory is determined to be a semi-selected directory if the following conditions are met: all devices and directories mounted under the third directory are selected as the first identifier, and there are unselected channels among the channels under the devices mounted under the third directory; or, there are unselected devices among the devices mounted under the third directory; the fourth directory is determined to be a removed directory if the following conditions are met: all devices and directories mounted under the fourth directory are selected, and all channels under the devices mounted under the fourth directory are selected, and there are devices or channels selected as the second identifier among the devices mounted under the fourth directory.

[0076] For example, if all directories are mounted under the first directory, or directories and devices are mounted under the first directory, but none of the devices are marked with "√" or "×", then the first directory is a directory without point permissions; if the devices and directories mounted under the second directory, as well as the channels mounted under the devices, are all marked with "√", then the second directory is a fully selected directory; if the directories and devices mounted under the third directory are all marked with "√", but there are channels mounted under the devices that are not marked with "√" or "×", or there are devices mounted under the third directory that are not marked with "√" or "×", then the third directory is a semi-selected directory; if the directories and devices mounted under the fourth directory, as well as the channels mounted under the devices, are all marked with "√" or "×", and there are devices or channels mounted under the fourth directory that are marked with "×", then the fourth directory is a removed directory.

[0077] Specifically, the first device is determined to be the fully selected channel device when the following conditions are met: the first device is selected as the first identifier, and all the channels mounted under the first device are selected as the first identifier; the second device is determined to be the half-selected channel device when the following conditions are met: the second device is selected as the first identifier, and there are unselected channels among the channels mounted under the second device; the third device is determined to be the all-channel-removed device when the following conditions are met: the third device is selected as the second identifier, and all the channels mounted under the third device are identified as the second identifier; the fourth device is determined to be the partial-channel-removed device when the following conditions are met: the fourth device is selected as the first identifier, and all the channels mounted under the fourth device are selected, and there are channels selected as the second identifier among the channels mounted under the fourth device.

[0078] For example, if the first device and the channels mounted under the device are both marked with “√”, then the first device is a fully selected channel device; if the second device is marked with “√”, but there are channels mounted under the second device that are not marked with “√” or “×”, then the second device is a half-selected channel device; if the third device and the channels mounted under the device are both marked with “×”, then the third device is a device with all channels removed; if the fourth device is marked with “√”, the channels mounted under the device are all marked with “√” or “×”, and there are channels marked with “×”, then the fourth device is a device with some channels removed.

[0079] Specifically, when the following conditions are met, it is determined that the first channel is the added channel: the channel selected as the first identification; when the following conditions are met, it is determined that the second channel is the removed channel: the channel selected as the second identification.

[0080] For example, the first channel is a channel marked with “√”, and the second channel is a channel marked with “×”.

[0081] Step S206: determining whether the target object has the authority of the target device according to the node type.

[0082] Specifically, the codes of each directory in the device tree and the parent directory of the directory are recorded in the directory table. The directory mounted by the target device is determined through the device tree to obtain the target directory; the parent directory of the target directory is searched in the directory table, wherein the directory table records the codes of the parent directories of each directory in the device tree; and whether the target object has the permission of the target device is determined through the node type of the target directory in the permission table and / or the node type of the parent directory of the target directory.

[0083] The above determination of whether the target object has the authority of the target device is to authenticate the user's device. Figure 3 The XPATH field design in the directory information and the NODE_TYPE and NODE_CHECK field design in the device permission information can quickly perform device authentication. For example, Figure 8 Schematic diagram of authentication according to an embodiment of the present invention. Figure 8 As shown in the figure, the permission allocation method is: assign all device and channel permissions under recursive directory 2, but exclude the permissions of device 3 and channel 13. Directory 6: The checked part indicates the assigned permissions. Fig. 9 Schematic diagram of storage permission data according to an embodiment of the present invention. Fig. 9 As shown, storage permission information only needs to store some directory information, and does not need to store device and channel information. Figure 8 Device 7 is authenticated. First, the directory information of device 7 is queried to obtain directory 6. According to the XPATH of directory 6, the parent directories are directory 1, directory 2, and directory 4. Then the permission table is queried, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4, directory 6). It is found that the type of directory 6 is a removed directory. Then the permission table is queried to determine whether device 7 is a removed device. Select * from permission table where NODE_CODE in (device 7). It is found that device 7 is a device that removes some channels. This means that device 7 has permission, but some channels under device 7 do not have permission.

[0084] Fig.10 is a flow chart of an authentication method according to an embodiment of the present invention. Fig.10 As shown, the process includes the following steps:

[0085] S1001: Create a directory for grouping and managing devices;

[0086] S1002: Create a device tree and mount devices and channels to the directory;

[0087] S1003: Assign device permissions, establish user roles, and configure device permissions for user roles. For example, devices and channels that are checked have permissions, and devices and channels that are not checked have no permissions;

[0088] S1004: Storing device permissions: a device permission storage model is designed to support users' flexible configuration of device permissions and reduce the storage volume of device permission data;

[0089] S1005: User device authentication: When a user obtains a device, the user is authenticated. Figure 3 The XPATH field design in the directory information and the NODE_TYPE and NODE_CHECK field design in the device permission information can quickly perform device authentication.

[0090] The device permission storage model provided in this embodiment can meet various user permission allocation scenarios, and various scenarios are traversed below for illustration.

[0091] Device permission allocation scenario 1:

[0092] 1. Permission allocation method: Allocate permissions to all devices and channels under the recursive directory. Fig.11 is a schematic diagram of a device tree for scenario 1 according to an embodiment of the present invention, such as Fig.11 As shown in the figure, the checked part indicates the assigned permissions.

[0093] 2. Permission data storage: Fig.12 is a schematic diagram of storing permission data in scenario 1 according to an embodiment of the present invention. Fig.12 As shown, only part of the directory information needs to be stored, and the device and channel information does not need to be stored. By storing Directory 1 (directory without point permission), Directory 2 (directory without point permission) and Directory 4 (all selected directory), the permission information of all directories, devices and channels can be obtained.

[0094] For example, if you want to query Fig.11 To obtain the permission information of device 4, first query the directory information of device 4 to obtain directory 4. According to the XPATH of directory 4, the parent directories are directory 2 and directory 1. Then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4). If directory 4 is the fully selected directory, it means that all devices under directory 4 are marked with "√", and the target object has the permission to device 4.

[0095] Device permission allocation scenario 2:

[0096] 1. Permission allocation method: Assign permissions to all devices and channels under the recursive directory, but exclude permissions for some devices. Fig.13 is a schematic diagram of a device tree for scenario 2 according to an embodiment of the present invention, such as Fig.13 As shown in the figure, the checked part indicates the assigned permissions, and the crossed part indicates the permissions to be excluded.

[0097] 2. Permission data storage: only some directory information and some device information need to be stored. Fig.14 Schematic diagram of storing permission data in scenario 2 according to an embodiment of the present invention. Fig.14 As shown, by storing the permission information of directory 1 (directory without point permissions), directory 2 (select all directories), directory 4 (eliminate directories), and device 3 (eliminate all channel devices), the permission information of all directories, devices, and channels can be obtained.

[0098] For example, if you want to query Fig.13 , then query the directory information of device 3 first, get directory 4, and get the parent directories of directory 4 according to XPATH, then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4), and find that directory 4 is a removed directory, which means that the directories and devices mounted under directory 4, as well as the channels mounted under the devices are marked with "√" or "×", and there are channels or devices mounted under directory 4 marked with "×". Then query the permission table to determine whether device 3 is a removed device, select * from permission table where NODE_CODE in (device 3), and find that device 3 is a removed device, then the target object does not have permission to device 3.

[0099] Device permission allocation scenario 3:

[0100] 1. Permission allocation method: Allocate permissions to all devices and channels under the recursive directory, but exclude permissions for some channels. Fig.15 is a schematic diagram of a device tree for scenario 3 according to an embodiment of the present invention, such as Fig.15 As shown in the figure, the checked part indicates the assigned permissions, and the crossed part indicates the permissions to be excluded.

[0101] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig.16 Schematic diagram of storing permission data in scenario 3 according to an embodiment of the present invention. Fig.16As shown, by storing the permission information of directory 1 (directory without point permission), directory 2 (select all directories), directory 4 (exclude directories), device 3 (exclude some channel devices), and channel 5 (exclude channels), the permission information of all directories, devices, and channels can be obtained.

[0102] For example, if you want to query Fig.15 , then query the device information of channel 5 to get device 3, then query the directory information of device 3 to get directory 4, and get the parent directories of directory 4 according to the XPATH of directory 4, including directory 2 and directory 1, and then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4), and find that directory 4 is a removed directory, which means that the directories and devices mounted under directory 4, as well as the channels mounted under the devices are all marked with "√" or "×", and there are channels or channels mounted under directory 4 marked with "×", then query the permission table to determine whether device 3 is a removed device, select * from permission table where NODE_CODE in (device 3), and find that device 3 is a device that removes some channels, indicating that device 3 is marked with "√", the channels mounted under the device are all marked with "√" or "×", and there are channels marked with "×", then query whether channel 5 is a removed channel, select * from permission table where NODE_CODE in (Channel 5), it is found that channel 5 is a rejection channel, and the target object does not have permission to channel 5.

[0103] Device permission allocation scenario 4:

[0104] 1. Permission allocation method: Allocate permissions to all devices and channels under the recursive directory, but exclude permissions for some devices or channels in the recursive directory, that is, there is an exclusion directory under the selected directory, and there is an exclusion directory under the exclusion directory. Fig.17 4 is a schematic diagram of a device tree according to a scenario 4 of an embodiment of the present invention. Fig.17 As shown in the figure, the checked part indicates the assigned permissions, and the crossed part indicates the permissions to be excluded.

[0105] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig.18 4 is a schematic diagram of storing permission data according to scenario 4 of an embodiment of the present invention. Fig.18 As shown, you only need to store the permission information of directory 1 (directory without point permission), directory 2 (select all directories), directory 4 (eliminate directories), device 3 (eliminate all channel devices), directory 6 (eliminate directories), device 7 (eliminate some channel devices), and channel 13 (eliminate channels) to obtain the permission information of all directories, devices, and channels.

[0106] For example, if you want to query Fig.17 Query the permission information of channel 6 in the table, first query the device information of channel 6 to obtain device 3, then query the directory information of device 3 to obtain directory 4, and according to the XPATH of directory 4, obtain the parent directories of directory 2 and directory 1, and then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4), and find that directory 4 is a excluded directory, which means that the directories and devices mounted under directory 4, as well as the channels mounted under the devices are all marked with "√" or "×", and there are channels or channels mounted under directory 4 marked with "×", and then query the permission table to determine whether device 3 is an excluded device, select * from permission table where NODE_CODE in (device 3), and find that device 3 is a device that excludes all channels, indicating that device 3 and the channels mounted under device 3 are all marked with "×", so channel 6 is an excluded channel, and the target object has no permission for channel 6.

[0107] Device permission allocation scenario 5:

[0108] 1. Permission allocation method: allocate permissions to some devices under a directory. Fig.19 is a schematic diagram of a device tree for scenario 5 according to an embodiment of the present invention, such as Fig.19 As shown in the figure, the checked part indicates the assigned permissions.

[0109] 2. Permission data storage: only some directory information and some device information need to be stored. Fig. 20 is a schematic diagram of storing permission data in scenario 5 according to an embodiment of the present invention. Fig. 20 As shown, you only need to store the permission information of directory 1 (directory without point permission), directory 2 (directory without point permission), directory 4 (half-selected directory), and device 4 (fully selected channel device) to obtain the permission information of all directories, devices, and channels.

[0110] For example, if you want to query Fig.19To get the permission information of channel 6, first query the device information of channel 6 to get device 3, then query the directory information of device 3 to get directory 4, and according to the XPATH of directory 4, get the parent directories of directory 2 and directory 1, then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4), and find that directory 4 is a semi-selected directory, which means that the directories and devices mounted under directory 4 are marked with "√", but the channels mounted under the devices do not have "√" or "×", or the devices mounted under directory 4 do not have "√" or "×", and then query the permission table to determine the permission information of device 3, select * from permission table where NODE_CODE in (device 3), and find that there is no permission information of device 3 in the permission table, so device 3 is not marked with "√" or "×", so the target object does not have permission to channel 6.

[0111] Device permission allocation scenario 6:

[0112] 1. Permission allocation method: allocate partial channel permissions under a directory. Fig.21 is a schematic diagram of a device tree for scenario 6 according to an embodiment of the present invention, such as Fig.21 As shown in the figure, the checked part indicates the assigned permissions.

[0113] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig. 22 is a schematic diagram of storing permission data in scenario 6 according to an embodiment of the present invention. Fig. 22 As shown, you only need to store the permission information of directory 1 (directory without point permissions), directory 2 (directory without point permissions), directory 4 (semi-selected directory), device 4 (semi-selected channel device), and channel 8 (add channel) to obtain the permission information of all directories, devices, and channels.

[0114] For example, if you want to query Fig.21To get the permission information of channel 8, first query the device information of channel 8 to get device 4, then query the directory information of device 4 to get directory 4, and according to the XPATH of directory 4, get the parent directories of directory 2 and directory 1, then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4), and find that directory 4 is a semi-selected directory, which means that the directories and devices mounted under directory 4 are marked with "√", but the channels mounted under the devices are not marked with "√" or "×", or the devices mounted under directory 4 are not marked with "√" or "×", then query the permission table to determine the permission information of device 4, select * from permission table where NODE_CODE in (device 4), and find that device 4 is a semi-selected channel device, then query the permission table to determine the permission information of channel 8, select * from permission table where NODE_CODE in (channel 8), and find that channel 8 is an added channel, so the target object has permission to channel 8.

[0115] Device permission allocation scenario 7:

[0116] 1. Permission allocation method: allocate some channel permissions under a directory, and allocate some device permissions under recursive descendant directories, that is, there are semi-selected directories under semi-selected organizations, and there are semi-selected directories under semi-selected directories. Fig.23 is a schematic diagram of a device tree for scenario 7 according to an embodiment of the present invention, such as Fig.23 As shown in the figure, the checked part indicates the assigned permissions.

[0117] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig.24 Schematic diagram of storing permission data in scenario 7 according to an embodiment of the present invention. Fig.24 As shown, you only need to store the permission information of Directory 1 (directory without point authority), Directory 2 (half-selected directory), Device 1 (half-selected channel device), Channel 1 (add channel), Directory 4 (half-selected directory), Device 4 (half-selected channel device), Channel 8 (add channel), Directory 6 (half-selected directory), Device 7 (half-selected channel device), and Channel 13 (add channel) to get the permission information of all directories, devices, and channels.

[0118] For example, if you want to query Fig.23To get the permission information of channel 13, first query the device information of channel 13 to get device 7, then query the directory information of device 7 to get directory 6, and according to the XPATH of directory 6, get the parent directories of directory 4, directory 2, and directory 1, then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4, directory 6), and find that directory 6 is a semi-selected directory, which means that the directories and devices mounted under directory 6 are marked with "√", but the channels mounted under the devices are not marked with "√" or "×", or the devices mounted under directory 6 are not marked with "√" or "×", then query the permission table to determine the permission information of device 7, select * from permission table whereNODE_CODE in (device 7), and find that device 7 is a semi-selected channel device, then query the permission table to determine the permission information of channel 13, select * from permission table where NODE_CODE in (channel 13), and find that channel 13 is an added channel, so the target object has permission to channel 8.

[0119] Device permission allocation scenario 8:

[0120] 1. Permission allocation method: allocate partial channel permissions under a directory, and allocate all device permissions under recursive descendant directories, that is, there is a fully selected directory under a semi-selected directory. Fig.25 8 is a schematic diagram of a device tree according to an embodiment of the present invention. Fig.25 As shown in the figure, the checked part indicates the assigned permissions.

[0121] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig.26 8 is a schematic diagram of storing permission data according to scenario 8 of an embodiment of the present invention. Fig.26 As shown, you only need to store the permission information of directory 1 (directory without point permissions), directory 2 (half-selected directory), device 1 (half-selected channel device), channel 1 (add channel), and directory 4 (full-selected directory) to obtain the permission information of all directories, devices, and channels.

[0122] For example, if you want to query Fig.25To obtain the permission information of channel 14, first query the device information of channel 14 to obtain device 7, then query the directory information of device 7 to obtain directory 6. According to the XPATH of directory 6, the parent directories are directory 4, directory 2, and directory 1. Then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4, directory 6), and find that directory 6 is the fully selected directory. The devices and directories mounted under directory 6 and the channels mounted under the devices are all marked "√", so the target object has permission to channel 14.

[0123] Device permission allocation scenario 9:

[0124] 1. Permission allocation method: allocate partial channel permissions under a directory, and allocate all device permissions under recursive descendant directories, but exclude some channel permissions, that is, there are fully selected directories under the semi-selected directories, and there are excluded directories under the fully selected directories. Fig. 27 is a schematic diagram of a device tree for scenario 9 according to an embodiment of the present invention, such as Fig. 27 As shown in the figure, the checked part indicates the assigned permissions, and the crossed part indicates the permissions to be excluded.

[0125] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig.28 is a schematic diagram of storing permission data in scenario 9 according to an embodiment of the present invention. Fig.28 As shown, you only need to store the permission information of directory 1 (directory without point permission), directory 2 (half-selected directory), device 1 (half-selected channel device), channel 1 (add channel), directory 4 (full-selected directory), directory 6 (removed directory), device 7 (removed some channel devices), and channel 13 (removed channel) to obtain the permission information of all directories, devices, and channels.

[0126] For example, if you want to query Fig. 27For the permission information of channel 13, first query the device information of channel 13 to obtain device 7, then query the directory information of device 7 to obtain directory 6, and according to the XPATH of directory 6, the parent directories are directory 4, directory 2, and directory 1. Then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4, directory 6), and find that directory 6 is a removed directory. Then the directories and devices mounted under directory 6, as well as the channels mounted under the devices are marked with "√" or "×", and the devices or channels mounted under directory 6 are marked with "×". Then query the permission table to determine the permission information of device 7, select * from permission table where NODE_CODE in (device 7), and find that device 7 is a device that removes some channels. Then query the permission table to determine the permission information of channel 13, select * from permission table whereNODE_CODE in (channel 13), and find that channel 13 is a removed channel, so the target object has no permission to channel 13.

[0127] Device permission allocation scenario 10:

[0128] 1. Permission allocation method: allocate some channel permissions under a directory, and allocate all device permissions under recursive descendant directories, but exclude some channel permissions under recursive descendant directories, that is, there are excluded directories under semi-selected directories, and there are excluded directories under excluded directories. Fig.29 10 is a schematic diagram of a device tree according to an embodiment of the present invention. Fig.29 As shown in the figure, the checked part indicates the assigned permissions, and the crossed part indicates the permissions to be excluded.

[0129] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig.30 10 is a schematic diagram of storing permission data according to an embodiment of the present invention. Fig.30 As shown, you only need to store the permission information of directory 1 (directory without point authority), directory 2 (half-selected directory), device 1 (half-selected channel device), channel 1 (add channel), directory 4 (remove directory), device 3 (remove all channel devices), directory 6 (remove directory), device 7 (remove some channel devices), and channel 13 (remove channel) to obtain the permission information of all directories, devices, and channels.

[0130] For example, if you want to query Fig.29To get the permission information of channel 6, first query the device information of channel 6 to get device 3, then query the directory information of device 3 to get directory 4, and according to the XPATH of directory 4, get the parent directories of directory 2 and directory 1, then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4), and find that directory 4 is a excluded directory. Then the directories and devices mounted under directory 4, as well as the channels mounted under the devices are marked with "√" or "×", and the devices or channels mounted under directory 4 are marked with "×". Then query the permission table to determine the permission information of device 3, select * from permission table where NODE_CODE in (device 3), and find that device 3 is a device that excludes all channels, so the target object does not have permission for channel 6.

[0131] Device permission allocation scenario 11:

[0132] 1. Permission allocation method: Assign permissions to all devices except the troubleshooting devices under one directory. Fig.31 is a schematic diagram of a device tree for scenario 11 according to an embodiment of the present invention, such as Fig.31 As shown in the figure, the checked part indicates the assigned permissions, and the crossed part indicates the permissions to be excluded.

[0133] 2. Permission data storage: only some directory information and some device information need to be stored. Fig.32 is a schematic diagram of storing permission data in scenario 11 according to an embodiment of the present invention, such as Fig.32 As shown, you only need to store the permission information of directory 1 (directory without point permission), directory 2 (directory without point permission), directory 4 (eliminated directory), and device 3 (eliminated all channel devices) to obtain the permission information of all directories, devices, and channels.

[0134] For example, if you want to query Fig.31 To get the permission information of channel 5, first query the device information of channel 5 to get device 3, then query the directory information of device 3 to get directory 4, and according to the XPATH of directory 4, get the parent directories of directory 2 and directory 1, then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4), and find that directory 4 is a excluded directory. Then the directories and devices mounted under directory 4, as well as the channels mounted under the devices are marked with "√" or "×", and the devices or channels mounted under directory 4 are marked with "×". Then query the permission table to determine the permission information of device 3, select * from permission table where NODE_CODE in (device 3), and find that device 3 is a device that excludes all channels, so the target object does not have permission for channel 5.

[0135] Device permission allocation scenario 12:

[0136] 1. Permission allocation method: Allocate permissions to all devices except the troubleshooting channel under one directory. Fig.33 is a schematic diagram of a device tree for scenario 12 according to an embodiment of the present invention, such as Fig.33 As shown in the figure, the checked part indicates the assigned permissions, and the crossed part indicates the permissions to be excluded.

[0137] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig.34 is a schematic diagram of storing permission data in scenario 12 according to an embodiment of the present invention. Fig.34 As shown, you only need to store the permission information of directory 1 (directory without point permission), directory 2 (directory without point permission), directory 4 (eliminated directory), device 3 (eliminated some channel devices), and channel 5 (eliminated channel) to obtain the permission information of all directories, devices, and channels.

[0138] For example, if you want to query Fig.33 To get the permission information of channel 5, first query the device information of channel 5 to get device 3, then query the directory information of device 3 to get directory 4, and according to the XPATH of directory 4, get the parent directories of directory 2 and directory 1, then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2, directory 4), and find that directory 4 is a removed directory. Then the directories and devices mounted under directory 4, as well as the channels mounted under the devices are marked with "√" or "×", and the devices or channels mounted under directory 4 are marked with "×". Then query the permission table to determine the permission information of device 3, select * from permission table where NODE_CODE in (device 3), and find that device 3 is a device that removes some channels. Then query the permission table to determine the permission information of channel 5, select * from permission table where NODE_CODE in (channel 5), and find that channel 5 is a removed channel, so the target object has no permission to channel 5.

[0139] Device permission allocation scenario 13:

[0140] 1. Permission allocation method: Allocate all device permissions except the troubleshooting channel under a directory, and exclude device permissions under the descendant directories, that is, there are exclusion directories under the exclusion directories, and there are exclusion directories under the exclusion directories. Fig.35 is a schematic diagram of a device tree for scenario 13 according to an embodiment of the present invention, such as Fig.35 As shown in the figure, the checked part indicates the assigned permissions, and the crossed part indicates the permissions to be excluded.

[0141] 2. Permission data storage: only part of the directory information, part of the device information and part of the channel information need to be stored. Fig.36 13 is a schematic diagram of storing permission data according to an embodiment of the present invention. Fig.36 As shown, you only need to store the permission information of directory 1 (directory without point authority), directory 2 (removed directory), device 1 (removed some channel devices), channel 1 (removed channel), directory 4 (removed directory), device 3 (removed some channel devices), channel 5 (removed channel), directory 6 (removed directory), device 7 (removed some channel devices), and channel 13 (removed channel) to obtain the permission information of all directories, devices, and channels.

[0142] For example, if you want to query Fig.35 For the permission information of channel 1, first query the device information of channel 1 to obtain device 1, then query the directory information of device 1 to obtain directory 2, and according to the XPATH of directory 4, obtain that the parent directory has directory 1, and then query the permission table, select * from permission table where NODE_CODE in (directory 1, directory 2), and find that directory 2 is a removed directory. Then the directories and devices mounted under directory 2, as well as the channels mounted under the devices are marked with "√" or "×", and the devices or channels mounted under directory 2 are marked with "×". Then query the permission table to determine the permission information of device 1, select * from permission table where NODE_CODE in (device 1), and find that device 1 is a device that removes some channels. Then query the permission table to determine the permission information of channel 1, select * from permission table where NODE_CODE in (channel 1), and find that channel 1 is a removed channel, so the target object has no permission to channel 1.

[0143] Optionally, the executor of the above steps may be a background processor, or other devices with similar processing capabilities, or a machine that integrates at least an image acquisition device and a data processing device, wherein the image acquisition device may include a graphics acquisition module such as a camera, and the data processing device may include a computer, a mobile phone or other terminal, but is not limited thereto.

[0144] Through the above steps, the target object is assigned permissions through the device tree to obtain permission information, wherein the permission information is used to indicate whether the target object has permissions for each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels; a permission table is created according to the device tree and the permission information, wherein the permission table records the node type of each node in the device tree; and whether the target object has permissions for the target device is determined according to the node type. The problem of consuming more storage resources due to the large amount of permission device data in the related art is solved, and the amount of permission device data is reduced.

[0145] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0146] In the present embodiment, an authentication device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0147] Fig.37 is a structural block diagram of an authentication device according to an embodiment of the present invention. Fig.37 As shown, the device includes an allocation module 3702, which is used to allocate permissions to the target object through a device tree to obtain permission information; wherein the permission information is used to indicate whether the target object has permissions to each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels; a creation module 3704, which is used to create a permission table based on the device tree and the permission information; wherein the permission table records the node type of each node in the device tree; a determination module 3706, which is used to determine whether the target object has permissions to the target device based on the node type.

[0148] In an exemplary embodiment, the apparatus is further configured to determine a node type of a node on the device tree according to the permission information; and record the node type in a field corresponding to the node in the permission table.

[0149] In an exemplary embodiment, the above-mentioned apparatus is also used to, when the target node is the directory in the device tree, determine according to the permission information that the node type of the directory includes one of the following: a directory with no point permissions, a fully selected directory, a half-selected directory, and a removed directory; when the target node is the device, determine according to the permission information that the node type of the device includes one of the following: a fully selected channel device, a half-selected channel device, all channel devices removed, and some channel devices removed; when the target node is the channel, determine according to the permission information that the node type of the channel includes one of the following: adding a channel and removing a channel.

[0150] In an exemplary embodiment, the above-mentioned device is also used to determine the node selected as the first identifier on the device tree as a node to which the target object has authority; determine the node selected as the second identifier on the device tree as a node to which the target object does not have authority; and determine the unselected node on the device tree as a node to which the target object is not assigned authority, wherein the target object does not have authority over the unselected node.

[0151] In an exemplary embodiment, the above-mentioned device is also used to determine that the first directory is a directory without point permissions when the following conditions are met: all directories are mounted under the first directory; or, directories and devices are mounted under the first directory, and all devices mounted under the first directory are not selected; determine that the second directory is a fully selected directory when the following conditions are met: all devices and directories mounted under the second directory are selected as the first identifier, and the channels under the devices mounted under the second directory are selected as the first identifier; determine that the third directory is a semi-selected directory when the following conditions are met: all devices and directories mounted under the third directory are selected as the first identifier, and there are unselected channels among the channels under the devices mounted under the third directory; or, there are unselected devices among the devices mounted under the third directory; determine that the fourth directory is a removed directory when the following conditions are met: all devices and directories mounted under the fourth directory are selected, and all channels under the devices mounted under the fourth directory are selected, and there are devices or channels selected as the second identifier among the devices mounted under the fourth directory.

[0152] In an exemplary embodiment, the above-mentioned device is also used to determine that the first device is the fully selected channel device under the following conditions: the first device is selected as the first identifier, and all the channels mounted under the first device are selected as the first identifier; determine that the second device is the half-selected channel device under the following conditions: the second device is selected as the first identifier, and there are unselected channels among the channels mounted under the second device; determine that the third device is the all-channel-removed device under the following conditions: the third device is selected as the second identifier, and all the channels mounted under the third device are identified as the second identifier; determine that the fourth device is the partial channel-removed device under the following conditions: the fourth device is selected as the first identifier, and all the channels mounted under the fourth device are selected, and there are channels selected as the second identifier among the channels mounted under the fourth device.

[0153] In an exemplary embodiment, the above-mentioned device is also used to determine that the first channel is the adding channel when the following conditions are met: the channel selected as the first identification; and determine that the second channel is the removing channel when the following conditions are met: the channel selected as the second identification.

[0154] In an exemplary embodiment, the above-mentioned device is also used to determine the directory mounted on the target device through the device tree to obtain the target directory; search for the parent directory of the target directory in the directory table, wherein the directory table records the encoding of the parent directory of each directory in the device tree; determine whether the target object has the permission of the target device through the node type of the target directory in the permission table, and / or the node type of the parent directory of the target directory.

[0155] In an exemplary embodiment, the apparatus is further configured to record the encoding of each directory in the device tree and the parent directory of the directory in the directory table.

[0156] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0157] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0158] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0159] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0160] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0161] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0162] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the steps of the method described in each embodiment of the present application when executed by a processor.

[0163] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0164] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An authentication method, characterized in that: include: Assigning permissions to the target object through the device tree to obtain permission information, wherein the permission information is used to indicate whether the target object has permissions for each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels; Determine a node type of a node on the device tree according to the permission information; record the node type in a field corresponding to the node in a permission table; It is determined whether the target object has the authority of the target device according to the node type.

2. The method according to claim 1, characterized in that: Determining the node type of the node on the device tree according to the permission information includes: In the case where the target node is the directory in the device tree, determining the node type of the directory according to the permission information includes one of the following: a directory without point permissions, a fully selected directory, a partially selected directory, and a discarded directory; In the case where the target node is the device, determining the node type of the device according to the permission information includes one of the following: fully selected channel device, half selected channel device, excluding all channel devices, and excluding some channel devices; In the case that the target node is the channel, determining the node type of the channel according to the permission information includes one of the following: adding a channel and removing a channel.

3. The method according to claim 2, characterized in that Allocating permissions to the target object according to the device tree includes: Determine the node selected as the first identifier on the device tree as a node to which the target object has authority; Determine the node selected as the second identifier on the device tree as a node for which the target object does not have permission; An unselected node on the device tree is determined as a node to which permissions are not assigned to the target object, wherein the target object does not have permissions of the unselected node.

4. The method according to claim 3, characterized in that: In a case where the target node is the directory in the device tree, determining the node type of the directory according to the permission information includes: Determining that the first directory is a directory without point permissions when the following conditions are met: all directories are mounted under the first directory; or directories and devices are mounted under the first directory, and all devices mounted under the first directory are not selected; Determining that the second directory is a fully selected directory when the following conditions are met: all devices and directories mounted under the second directory are selected as the first identifier, and a channel under the device mounted under the second directory is selected as the first identifier; The third directory is determined to be a semi-selected directory when the following conditions are met: all devices and directories mounted under the third directory are selected as the first identifier, and there are unselected channels among the channels under the devices mounted under the third directory; or there are unselected devices among the devices mounted under the third directory; The fourth directory is determined to be a discarded directory when the following conditions are met: all devices and directories mounted under the fourth directory are selected, and all channels under the devices mounted under the fourth directory are selected, and there is a device or channel selected as the second identifier among the devices mounted under the fourth directory.

5. The method according to claim 3, characterized in that: In a case where the target node is the device, determining the node type of the device according to the authority information includes: Determining that the first device is the all-selected channel device when the following conditions are met: the first device is selected as the first identifier, and all the channels mounted under the first device are selected as the first identifier; Determining that the second device is the semi-selected channel device when the following conditions are met: the second device is selected as the first identifier, and there is an unselected channel among the channels mounted under the second device; Determining that the third device is the device for removing all channels when the following conditions are met: the third device is selected as the second identifier, and all channels mounted under the third device are identified as the second identifier; The fourth device is determined to be the device for excluding some channels when the following conditions are met: the fourth device is selected as the first identifier, all channels mounted on the fourth device are selected, and among the channels mounted on the fourth device, there is a channel selected as the second identifier.

6. The method according to claim 3, characterized in that: In the case where the target node is the channel, determining the node type of the channel according to the authority information includes: In the case where the following conditions are met, determining that the first channel is the added channel: the channel selected as the first identification; The second channel is determined to be the rejection channel when the following condition is met: the channel selected as the second identification.

7. The method according to claim 1, characterized in that Determining whether the target object has the permission of the target device according to the node type in the permission table includes: Determine the directory mounted on the target device through the device tree to obtain the target directory; Searching for a parent directory of the target directory in a directory table, wherein the directory table records the encoding of the parent directory of each directory in the device tree; Whether the target object has the permission of the target device is determined by the node type of the target directory in the permission table and / or the node type of the parent directory of the target directory.

8. The method according to claim 7, characterized in that Before searching the directory table for the parent directory of the target directory, the method further includes: The codes of each directory in the device tree and the parent directory of the directory are recorded in the directory table.

9. An authentication device, characterized in that: include: The allocation module is used to allocate permissions to the target object through the device tree and obtain permission information; The permission information is used to indicate whether the target object has the permission for each device and each channel on the device tree, and the device tree is used to represent the mounting relationship between directories, devices and channels; A creation module, used to create a permission table according to the device tree and the permission information; Wherein, the permission table records the node type of each node in the device tree; A determination module, used to determine whether the target object has the authority of the target device according to the node type; The creation module is further used to determine the node type of the node on the device tree according to the permission information; and record the node type in a field corresponding to the node in the permission table.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 8 when executed by a processor.

11. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 8 are implemented.

Images