Cross-system permission control method

Abstract

The invention provides a cross-system permission control method. The method comprises the following steps: acquiring and storing first target permission information of various resources in a plurality of systems; the first target permission information is used for indicating whether each resource in each system allows other systems to perform cross-system authorization; receiving second target permission information of a target user set by the first system for each resource in the second system; the second target permission information is the permission information of the target user for each resource in the second system, wherein the target user is set by the first system on the basis of the first target permission information and across systems; sending second target permission information, set by the first system, of the target user to each resource in the second system to the second system; the second target permission information of each resource is used for the second system to determine the permission of the target user in the first system to each resource in the second system under the condition that the target user accesses each resource in the second system. According to the method provided by the embodiment of the invention, centralized management of cross-system authorization is efficiently realized.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a cross-system authority control method. Background Art

[0002] In the process of system security control, the RBAC model is currently widely used for information system authority control. Data between different information systems are isolated. The information system sets roles for its own use only to perform authorization and authentication management.

[0003] In related technologies, users need to use different information systems to complete corresponding businesses. Business information systems often require associated authorization. The usual solution is to pre-set the corresponding role permissions in the middle-office service system and perform associated authorization. However, this method requires logging into different information systems, which cannot be centrally managed and is inefficient. Summary of the invention

[0004] The present invention provides a cross-system permission control method to solve the defects in the prior art that different information systems need to be logged in during the associated authorization process, centralized management cannot be performed, and the efficiency is low, thereby efficiently realizing the centralized management of cross-system authorization.

[0005] The present invention provides a cross-system authority control method, which is applied to an authority service system and includes the following steps.

[0006] Acquire and store first target permission information of various resources in multiple systems; the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization; Receive second target permission information of a target user set by a first system for various resources in a second system; the first system and the second system are different systems among the multiple systems; the second target permission information is permission information of the target user set across systems by the first system for various resources in the second system based on the first target permission information; Sending to the second system the second target permission information of the target user set by the first system for each resource in the second system; the second target permission information of each resource is used by the second system to determine the permission of the target user in the first system for each resource in the second system when the target user accesses the various resources in the second system.

[0007] According to a cross-system permission control method provided by the present invention, the obtaining and storing of first target permission information of various resources in multiple systems includes: Receive first target permission information of various resources sent by each system in the multiple systems; the first target permission information includes at least one of the following: The first permission is used to indicate that the permission of the resources in the system allows cross-system authorization without review; The second permission is used to indicate that the permission of the resources in the system is to allow cross-system authorization but it needs to be reviewed; The third permission: The third permission is used to indicate that the permission of resources in the system is to prohibit cross-system authorization.

[0008] According to a cross-system permission control method provided by the present invention, before sending the second target permission information of the target user set by the first system to various resources in the second system to the second system, the method further includes: Receive request information sent by the second system; the request information is used to request to obtain the permission information of the target user set by the first system for various resources in the second system; the request information is sent by the second system after receiving the identity information of the target user and the system information where the target user is located.

[0009] The present invention provides a cross-system authority control method, which is applied to a first system and includes the following steps.

[0010] According to the first target permission information of various resources in the second system stored in the permission service system, the second target permission information of the target user in the first system for various resources in the second system is set; the first target permission information is used to indicate whether various resources in the second system allow other systems to perform cross-system authorization; the second target permission information is used to indicate the permission of the target user in the first system for various resources in the second system; Send the second target permission information of the target user to the resources in the second system to the permission service system; the second target permission information is used by the second system to determine the permission of the target user in the first system to the resources in the second system when the target user accesses the resources in the second system.

[0011] According to a cross-system permission control method provided by the present invention, the method also includes: sending first target permission information of various resources in the first system to the permission service system; the first target permission information is used to indicate whether various resources in the first system allow other systems to perform cross-system authorization.

[0012] The present invention provides a cross-system authority control method, which is applied to a second system and includes the following steps.

[0013] Sending first target permission information of various resources in the second system to the permission service system; the first target permission information is used to indicate whether various resources in the second system allow other systems to perform cross-system authorization; When the target user accesses various resources in the second system, the second target permission information of the target user set by the first system for various resources in the second system is obtained from the permission service system; the second target permission information of various resources is used by the second system to determine the permission of the target user in the first system for various resources in the second system.

[0014] According to a cross-system permission control method provided by the present invention, before obtaining the second target permission information of the target user set by the first system to various resources in the second system from the permission service system, the method further includes: Send a request message to the permission service system; the request message is used to request to obtain the permission information of the target user set by the first system for various resources in the second system; the request message is sent by the second system after receiving the identity information of the target user and the system information where the target user is located.

[0015] The present invention also provides a cross-system permission control, including the following modules: An acquisition module, used to acquire and store first target permission information of various resources in multiple systems; the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization; A receiving module, configured to receive second target permission information of a target user set by a first system for various resources in a second system; the first system and the second system are different systems among the multiple systems; the second target permission information is permission information of the target user set by the first system across systems for various resources in the second system based on the first target permission information; A sending module is used to send to the second system the second target permission information of the target user set by the first system for each resource in the second system; the second target permission information of each resource is used by the second system to determine the permission of the target user in the first system for each resource in the second system when the target user accesses the various resources in the second system.

[0016] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the cross-system permission control method as described above is implemented.

[0017] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the cross-system permission control method as described in any one of the above is implemented.

[0018] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the cross-system permission control method as described above is implemented.

[0019] The cross-system permission control method provided by the present invention stores information in the permission service system on whether various resources provided by various systems allow other systems to perform cross-system authorization, so that each system can freely perform authorization according to its own demands based on the information in the service system, and efficiently realizes the centralized management of cross-system authorization, and effectively solves the problem in the prior art that it is difficult for each system to freely provide customized role permissions for other related business information systems and cannot perform free authorization according to the demands of the business information systems, and avoids the problem in the prior art that when performing related authorization operations, it is necessary to log in to different information systems, and it is impossible to centrally manage and the efficiency is low. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 This is one of the flow charts of the cross-system permission control method provided by the present invention.

[0022] Figure 2 This is the second flow chart of the cross-system permission control method provided by the present invention.

[0023] Figure 3 This is the third flow chart of the cross-system permission control method provided by the present invention.

[0024] Figure 4 This is the fourth flow chart of the cross-system permission control method provided by the present invention.

[0025] Figure 5 It is a structural diagram of the cross-system authority control device provided by the present invention.

[0026] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] Combine the following Figure 1-Figure 6 The cross-system permission control method of the present invention is described.

[0029] Figure 1 This is one of the flow charts of the cross-system permission control method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 101: Acquire and store first target permission information of various resources in multiple systems; the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization.

[0030] Specifically, in the prior art, users need to use different information systems to complete corresponding businesses, and business information systems often have the need for associated authorization. The usual solution is to pre-set the corresponding role permissions in the middle-office service system and perform associated authorization. However, this method requires logging into different information systems, which cannot be centrally managed and is inefficient.

[0031] In order to solve the above problems, the permission service system in the embodiment of the present application first obtains and stores the first target permission information of various resources in multiple systems; wherein, the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization. That is, the permission service system stores information on whether various resources provided by each system allow other systems to perform cross-system authorization. Through the permission service system, customized dynamic role permissions can be provided for other related business information systems, so that each system can freely perform authorization according to its own demands based on the information in the permission service system, and efficiently realizes the centralized management of cross-system authorization.

[0032] Step 102, receiving the second target permission information of the target user set by the first system for each resource in the second system; the first system and the second system are different systems among multiple systems; the second target permission information is the permission information of the target user set across systems by the first system for each resource in the second system based on the first target permission information.

[0033] Specifically, after the permission service system obtains and stores the first target permission information of various resources in multiple systems, the first system can also obtain relevant information on whether various resources in the second system allow the first system to perform cross-system authorization based on the information in the permission service system; optionally, when the first system determines that resource A in the second system allows cross-system authorization based on the information in the permission service system, the first system can set the second target permission information of the user for resource A in the second system and send it to the permission service system, so that the permission service system can also receive the second target permission information of the target user set by the first system for resource A in the second system. Optionally, the first system and the second system are different systems among the multiple systems; the second target permission information is the permission information of the target user set by the first system across systems for various resources in the second system based on the first target permission information.

[0034] Step 103: Send the second target permission information of the target user set in the first system to the resources in the second system to the second system; the second target permission information of the resources is used by the second system to determine the permission of the target user in the first system to the resources in the second system when the target user accesses the resources in the second system.

[0035] Specifically, in the embodiment of the present application, after the permission service system receives the second target permission information of the target user set by the first system for resource A in the second system, the permission service system sends the second target permission information of the target user set by the first system for resource A in the second system to the second system. Then, when the target user accesses resource A in the second system, the second system can determine the target user's permission to resource A and perform access control based on the information sent by the permission service system, thereby realizing refined authorization management based on the resource dimension in the second system.

[0036] In the method of the above embodiment, the permission service system stores information on whether the various resources provided by each system allow other systems to perform cross-system authorization, so that each system can freely authorize according to its own demands based on the information in the service system, and efficiently realizes the centralized management of cross-system authorization. It effectively solves the problem in the prior art that it is difficult for each system to freely provide customized role permissions for other related business information systems and cannot freely authorize according to the demands of the business information system. It avoids the problem in the prior art that when performing related authorization operations, it is necessary to log in to different information systems, which cannot be centrally managed and has low efficiency.

[0037] In one embodiment, obtaining and storing first target permission information of various resources in multiple systems includes: Receive first target permission information of various resources sent by each system in the plurality of systems; the first target permission information includes at least one of the following: First permission: The first permission is used to indicate that the permission of resources in the system allows cross-system authorization without review; Second permission: The second permission is used to indicate that the permission of resources in the system is to allow cross-system authorization but it needs to be reviewed; The third permission: The third permission is used to indicate that the permission of resources in the system is to prohibit cross-system authorization.

[0038] Specifically, in the embodiment of the present application, the permission service system receives the first target permission information of each resource sent by each system, thereby obtaining and storing the first target permission information of each resource in multiple systems. Optionally, the first target permission information includes the first permission, the second permission and the third permission; wherein the first permission is used to indicate that the permission of the resources in the system is to allow cross-system authorization without review; the second permission is used to indicate that the permission of the resources in the system is to allow cross-system authorization but requires review; the third permission is used to indicate that the permission of the resources in the system is to prohibit cross-system authorization. That is, each system can set three types of permissions for its own resources and send them to the permission service system. For example, if resource A in the first system corresponds to the first permission, then after the second system obtains the information through the permission service system and authorizes user X to access resource A in the first system, user X can also access resource A in the first system. Optionally, each system in the embodiment of the present application sets three types of permissions for its own resources and sends them to the permission service system, thereby enabling each system to implement hierarchical permission management for its own resources, and can freely provide custom role permissions for other related business information systems, so that other systems can freely authorize according to their respective demands.

[0039] In the method of the above embodiment, each system sets three types of permissions for its own resources and sends them to the permission service system, so that each system can achieve hierarchical permission management for its own resources, and can freely provide customized role permissions for other related business information systems, so that other systems can freely authorize according to their respective demands.

[0040] In one embodiment, before sending the second target permission information of the target user set by the first system to the resources in the second system to the second system, the method further includes: Receive the request information sent by the second system; the request information is used to request to obtain the permission information of the target user set by the first system for various resources in the second system; the request information is sent by the second system after receiving the identity information of the target user and the system information where the target user is located.

[0041] Specifically, after the second system receives the identity information of the target user and the system information where the target user is located, that is, when the second system learns that the target user requests to access the resources in the second system, the second system can send a request message to the permission service system to request the permission service system to provide it with the permission information of the target user set by the first system for various resources in the second system, so as to comprehensively understand the permission information of the target user set by the first system for various resources in the second system and the information of whether the various resources provided by the second system itself to the permission service system allow other systems to perform cross-system authorization, so as to accurately and efficiently determine whether to authorize the target user and access the resources in the second system. That is, the centralized management of cross-system authorization is efficiently realized through the permission service system, which solves the problem that when performing related authorization operations in the prior art, it is necessary to log in to different information systems, which cannot be centrally managed and has low efficiency.

[0042] According to the method of the above embodiment, after the permission service system receives the request information sent by the second system, it can send the permission information of the target user set by the first system to the various resources in the second system to the second system, and then the second system combines the permission information of the target user set by the first system to the various resources in the second system and the information whether the various resources provided by the second system itself to the permission service system allow other systems to perform cross-system authorization, so as to accurately and efficiently determine whether to authorize the target user and access the resources in the second system, accurately and efficiently realize the centralized management of cross-system authorization, and solve the problem in the prior art that when performing related authorization operations, it is necessary to log in to different information systems, cannot be centrally managed, and has low efficiency.

[0043] For example, Figure 2 As shown, an embodiment of the present application also provides a cross-system permission control method, which is applied to the first system and includes: Step 201: according to the first target permission information of various resources in the second system stored in the permission service system, set the second target permission information of the target user in the first system to various resources in the second system; the first target permission information is used to indicate whether various resources in the second system allow other systems to perform cross-system authorization; the second target permission information is used to indicate the permission of the target user in the first system to various resources in the second system; Step 202: Send the second target permission information of the target user to various resources in the second system to the permission service system; the second target permission information is used by the second system to determine the permission of the target user in the first system to various resources in the second system when the target user accesses various resources in the second system.

[0044] Specifically, in the embodiment of the present application, the first target permission information of various resources in multiple systems is stored in the permission service system. When the target user in the first system needs to access the resources of the second system, the first system can obtain the first target permission information of various resources in the second system from the permission service system, and set the second target permission information of the target user for various resources in the second system and send it to the permission service system. Then, after the permission service system receives the second target permission information of the target user set by the first system for the resources in the second system, the permission service system can also send the second target permission information of the target user set by the first system for the resources in the second system to the second system, so that when the target user accesses the resources in the second system, the second system can determine the target user's permission to resource A and perform access control based on the information sent by the permission service system. Among them, the first target permission information is used to indicate whether the various resources in the second system allow other systems to perform cross-system authorization; the second target permission information is used to indicate the permission of the target user in the first system to various resources in the second system.

[0045] In the method of the above embodiment, the permission service system stores information on whether the various resources provided by each system allow other systems to perform cross-system authorization, so that each system can freely authorize according to its own demands based on the information in the service system, and efficiently realizes the centralized management of cross-system authorization. It effectively solves the problem in the prior art that it is difficult to freely provide customized role permissions for other related business information systems and it is impossible to freely authorize according to the demands of the business information system. It avoids the problem in the prior art that when performing related authorization operations, it is necessary to log in to different information systems, which cannot be centrally managed and has low efficiency.

[0046] In one embodiment, the method further comprises: The first target permission information of each resource in the first system is sent to the permission service system; the first target permission information is used to indicate whether each resource in the first system allows other systems to perform cross-system authorization.

[0047] Specifically, in an embodiment of the present application, the first system sends first target permission information of various resources in the first system to the permission service system; wherein, the first target permission information is used to indicate whether various resources in the first system allow other systems to perform cross-system authorization, so that the permission service system stores information on whether various resources provided by various systems including the first system allow other systems to perform cross-system authorization. Furthermore, through the permission service system, customized dynamic role permissions can be provided for other related business information systems, efficiently realizing centralized management of cross-system authorization, and avoiding the problem of needing to log in to different information systems when performing related authorization operations in the prior art, which makes centralized management impossible and leads to low efficiency.

[0048] In the method of the above embodiment, the first system sends the first target permission information of various resources in the first system to the permission service system, so that the permission service system stores information on whether various resources provided by various systems including the first system allow other systems to perform cross-system authorization. Furthermore, the permission service system can provide customized dynamic role permissions for other related business information systems, thereby efficiently realizing centralized management of cross-system authorization.

[0049] For example, Figure 3 The embodiment of the present application also provides a cross-system permission control method, which is applied to the second system and includes: Step 301: Send first target permission information of various resources in the second system to the permission service system; the first target permission information is used to indicate whether various resources in the second system allow other systems to perform cross-system authorization; Step 302: When the target user accesses various resources in the second system, the second target permission information of the target user set by the first system for various resources in the second system is obtained from the permission service system; the second target permission information of various resources is used by the second system to determine the permission of the target user in the first system for various resources in the second system.

[0050] Specifically, in the embodiment of the present application, the second system sends the first target permission information of various resources in the second system to the permission service system; wherein, the first target permission information is used to indicate whether various resources in the second system allow other systems to perform cross-system authorization, thereby making the permission service system store information on whether various resources provided by various systems including the second system allow other systems to perform cross-system authorization. Furthermore, through the permission service system, customized dynamic role permissions can be provided for other related business information systems, thereby efficiently realizing centralized management of cross-system authorization.

[0051] Optionally, when the target user accesses various resources in the second system, that is, after the second system receives the identity information of the target user and the system information where the target user is located, the second system can send request information to the permission service system to request the permission service system to provide it with the permission information of the target user set by the first system for various resources in the second system, so as to facilitate the comprehensive permission information of the target user set by the first system for various resources in the second system and the information on whether the various resources provided by the second system itself to the permission service system allow other systems to perform cross-system authorization, thereby accurately and efficiently determining whether to authorize the target user and access the resources in the second system, efficiently realizing centralized management of cross-system authorization, and solving the problem in the prior art that when performing related authorization operations, it is necessary to log in to different information systems, cannot be centrally managed, and has low efficiency.

[0052] In the method of the above embodiment, the second system sends the first target permission information of each resource in the second system to the permission service system, so that the permission service system stores information on whether each resource provided by each system including the second system allows other systems to perform cross-system authorization, and then the permission service system can provide customized dynamic role permissions for other related business information systems, and efficiently realize the centralized management of cross-system authorization. Moreover, when the target user accesses various resources in the second system, the second system can request the permission service system to provide it with the permission information of the target user set by the first system for each resource in the second system, so as to comprehensively integrate the permission information of the target user set by the first system for each resource in the second system and the information on whether each resource provided by the second system itself to the permission service system allows other systems to perform cross-system authorization, so as to accurately and efficiently determine whether to authorize the target user and access the resources in the second system, and efficiently realize the centralized management of cross-system authorization, and solve the problem that when performing related authorization operations in the prior art, it is necessary to log in to different information systems, which cannot be centrally managed and has low efficiency.

[0053] In one embodiment, before obtaining the second target permission information of the target user set by the first system for each resource in the second system from the permission service system, the method further includes: Send a request message to the authority service system; the request message is used to request to obtain the authority information of the target user set by the first system for various resources in the second system; the request message is sent by the second system after receiving the identity information of the target user and the system information where the target user is located.

[0054] Specifically, in the embodiment of the present application, the second system requests the permission service system to provide it with the permission information of the target user set by the first system for various resources in the second system. Therefore, it is convenient to accurately and efficiently determine whether to authorize the target user and access the resources in the second system based on the permission information of the target user set by the first system for various resources in the second system and the information on whether the various resources provided by the second system itself to the permission service system allow other systems to perform cross-system authorization. This efficiently realizes the centralized management of cross-system authorization and solves the problem in the prior art that when performing related authorization operations, it is necessary to log in to different information systems, cannot be centrally managed, and has low efficiency.

[0055] In the method of the above embodiment, the second system requests the permission service system to provide it with the permission information of the target user set by the first system for various resources in the second system. Therefore, it is convenient to accurately and efficiently determine whether to authorize the target user and access the resources in the second system based on the permission information of the target user set by the first system for various resources in the second system and the information whether the various resources provided by the second system itself to the permission service system allow other systems to perform cross-system authorization. This accurately and efficiently realizes the centralized management of cross-system authorization, and solves the problem in the prior art that when performing related authorization operations, it is necessary to log in to different information systems, cannot be centrally managed, and has low efficiency.

[0056] For example, Figure 4 As shown, this application provides a cross-system permission control method, the specific process is as follows: 1. Business information system APP1 marks its own resources and allows roles in other systems to authorize corresponding resources. Optionally, for middle-office services, their resources are specially identified. Other business information systems are allowed to authorize them. The special identification is divided into three categories: 1. Allow other information systems to authorize freely. 2. Allow other business information systems to authorize after review. 3. Special resources, other business information systems are not allowed to authorize.

[0057] 2. Business information system APP2 marks its own resources and allows roles in other systems to authorize corresponding resources. This means that the permission service system stores information about whether the resources provided by each system allow other systems to authorize across systems. The permission service system can provide customized dynamic role permissions for other related business information systems, so that each system can freely authorize according to its own demands based on the information in the permission service system, and efficiently realize the centralized management of cross-system authorization.

[0058] 3. Business information system APP1 grants the role of business information system APP2 resources and permissions according to its own needs. That is, business information system APP1 can freely authorize according to its own demands based on the information in the service system, and efficiently realize the centralized management of cross-system authorization, effectively solving the problem that each system in the prior art is difficult to freely provide customized role permissions for other related business information systems, and cannot freely authorize according to the demands of business information systems, and avoids the problem that when performing related authorization operations in the prior art, it is necessary to log in to different information systems, which cannot be centrally managed and has low efficiency.

[0059] 4. When the user jumps to the business information system APP2, he / she passes his / her own user information and the corresponding business system information. APP2 identifies the user and source and obtains the corresponding permissions from the permission center to control the user's access to resources. Among them, the permission center records which users APP1 has granted access to which resources in APP2.

[0060] 5. Complete access authentication control in subsequent business operations.

[0061] That is, for enterprise users, users use different information systems to complete corresponding business. Different permissions are granted in each information system. Business information systems often have the need for associated authorization. For example, the person in charge configured in general information system management is the super administrator or administrator for a specific information system. For the services provided by other middle platforms used by their systems, corresponding permissions are required.

[0062] In the embodiment of the present application, cross-system centralized authorization is implemented through the permission service system, permissions and resource data are centrally stored, and authorization is uniformly managed, which can effectively solve the problems of cross-system authorization and authentication, facilitate the centralized management of cross-system permissions, and effectively solve the problem that each system in the prior art is difficult to freely provide customized role permissions for other related business information systems, and cannot freely authorize according to the requirements of the business information system. It avoids the problem that when performing related authorization operations in the prior art, it is necessary to log in to different information systems, cannot be centrally managed, and has low efficiency.

[0063] The cross-system permission control device provided by the present invention is described below. The cross-system permission control device described below and the cross-system permission control method described above can be referred to each other. Figure 5 As shown, including: The acquisition module 510 is used to acquire and store first target permission information of various resources in multiple systems; the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization; The receiving module 520 is used to receive second target permission information of the target user set by the first system for various resources in the second system; the first system and the second system are different systems in the multiple systems; the second target permission information is permission information of the target user set by the first system across systems for various resources in the second system based on the first target permission information; The sending module 530 is used to send the second target permission information of the target user set in the first system to the various resources in the second system to the second system; the second target permission information of the various resources is used by the second system to determine the permission of the target user in the first system to the various resources in the second system when the target user accesses the various resources in the second system.

[0064] Optionally, the acquisition module 510 is specifically configured to receive first target permission information of various resources sent by each system in the plurality of systems; the first target permission information includes at least one of the following: First permission: The first permission is used to indicate that the permission of resources in the system allows cross-system authorization without review; Second permission: The second permission is used to indicate that the permission of resources in the system is to allow cross-system authorization but it needs to be reviewed; The third permission: The third permission is used to indicate that the permission of resources in the system is to prohibit cross-system authorization.

[0065] Optionally, the sending module 530 is also used to receive request information sent by the second system; the request information is used to request to obtain the permission information of the target user set by the first system for various resources in the second system; the request information is sent by the second system after receiving the identity information of the target user and the system information where the target user is located.

[0066] Figure 6An example physical structure diagram of an electronic device is shown, which may include: a processor 610, a communications interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call the logic instructions in the memory 630 to execute a cross-system permission control method, which includes: obtaining and storing first target permission information of various resources in multiple systems; the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization; receiving second target permission information of the target user set by the first system for various resources in the second system; the first system and the second system are different systems among the multiple systems; the second target permission information is the permission information of the target user set by the first system across systems for various resources in the second system based on the first target permission information; sending the second target permission information of the target user set by the first system for various resources in the second system to the second system; the second target permission information of various resources is used by the second system to determine the permission of the target user in the first system for various resources in the second system when the target user accesses the various resources in the second system.

[0067] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0068] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the cross-system permission control method provided by the above methods, which includes: obtaining and storing first target permission information of various resources in multiple systems; the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization; receiving second target permission information of a target user set by the first system for various resources in a second system; the first system and the second system are different systems among multiple systems; the second target permission information is the permission information of the target user set by the first system across systems for various resources in the second system based on the first target permission information; sending the second target permission information of the target user set by the first system for various resources in the second system to the second system; the second target permission information of various resources is used by the second system to determine the permission of the target user in the first system for various resources in the second system when the target user accesses various resources in the second system.

[0069] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the cross-system permission control method provided by the above-mentioned methods, the method comprising: obtaining and storing first target permission information of various resources in multiple systems; the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization; receiving second target permission information of a target user set by the first system for various resources in a second system; the first system and the second system are different systems among multiple systems; the second target permission information is permission information of the target user set by the first system across systems for various resources in the second system based on the first target permission information; sending the second target permission information of the target user set by the first system for various resources in the second system to the second system; the second target permission information of various resources is used by the second system to determine the permission of the target user in the first system for various resources in the second system when the target user accesses various resources in the second system.

[0070] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0071] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cross-system permission control method, characterized in that: Applied to the permission service system, including: Acquire and store first target permission information of various resources in multiple systems; the first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization; Receive second target permission information of a target user set by a first system for various resources in a second system; the first system and the second system are different systems among the multiple systems; the second target permission information is permission information of the target user set across systems by the first system for various resources in the second system based on the first target permission information; Sending to the second system the second target permission information of the target user set by the first system for each resource in the second system; the second target permission information of each resource is used by the second system to determine the permission of the target user in the first system for each resource in the second system when the target user accesses the various resources in the second system.

2. The cross-system permission control method according to claim 1, characterized in that: The obtaining and storing first target permission information of various resources in multiple systems includes: Receive first target permission information of various resources sent by each system in the multiple systems; the first target permission information includes at least one of the following: The first permission is used to indicate that the permission of the resources in the system allows cross-system authorization without review; The second permission is used to indicate that the permission of the resources in the system is to allow cross-system authorization but it needs to be reviewed; The third permission: The third permission is used to indicate that the permission of resources in the system is to prohibit cross-system authorization.

3. The cross-system permission control method according to claim 1, characterized in that: Before sending the second target permission information of the target user set by the first system to the resources in the second system to the second system, the method further includes: Receive request information sent by the second system; the request information is used to request to obtain the permission information of the target user set by the first system for various resources in the second system; the request information is sent by the second system after receiving the identity information of the target user and the system information where the target user is located.

4. A cross-system permission control method, characterized in that: Applied to the first system, including: According to the first target permission information of various resources in the second system stored in the permission service system, the second target permission information of the target user in the first system for various resources in the second system is set; the first target permission information is used to indicate whether various resources in the second system allow other systems to perform cross-system authorization; the second target permission information is used to indicate the permission of the target user in the first system for various resources in the second system; Send the second target permission information of the target user to the resources in the second system to the permission service system; the second target permission information is used by the second system to determine the permission of the target user in the first system to the resources in the second system when the target user accesses the resources in the second system.

5. The cross-system permission control method according to claim 4, characterized in that: The method further comprises: The first target permission information of each resource in the first system is sent to the permission service system; the first target permission information is used to indicate whether each resource in the first system allows other systems to perform cross-system authorization.

6. A cross-system permission control method, characterized in that: Applicable to the second system, including: Sending first target permission information of various resources in the second system to the permission service system; the first target permission information is used to indicate whether various resources in the second system allow other systems to perform cross-system authorization; When the target user accesses various resources in the second system, the second target permission information of the target user set by the first system for various resources in the second system is obtained from the permission service system; the second target permission information of various resources is used by the second system to determine the permission of the target user in the first system for various resources in the second system.

7. The cross-system permission control method according to claim 6, characterized in that: Before obtaining the second target permission information of the target user set by the first system for various resources in the second system from the permission service system, the method further includes: Send a request message to the permission service system; the request message is used to request to obtain the permission information of the target user set by the first system for various resources in the second system; the request message is sent by the second system after receiving the identity information of the target user and the system information where the target user is located.

8. A cross-system permission control device, characterized in that: include: An acquisition module, used to acquire and store first target permission information of various resources in multiple systems; The first target permission information is used to indicate whether various resources in each system allow other systems to perform cross-system authorization; A receiving module, configured to receive second target permission information of a target user set by a first system for various resources in a second system; the first system and the second system are different systems among the multiple systems; the second target permission information is permission information of the target user set by the first system across systems for various resources in the second system based on the first target permission information; A sending module, used for sending second target permission information of the target user set by the first system to various resources in the second system to the second system; The second target permission information of each resource is used by the second system to determine the permission of the target user in the first system to each resource in the second system when the target user accesses each resource in the second system.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the cross-system permission control method as described in any one of claims 1 to 3, or the cross-system permission control method as described in any one of claims 4-5, or the cross-system permission control method as described in any one of claims 6-7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the cross-system permission control method as described in any one of claims 1 to 3, or the cross-system permission control method as described in any one of claims 4-5, or the cross-system permission control method as described in any one of claims 6-7.

Images