Access permission verification method and device, equipment and medium

Abstract

The invention discloses an access permission verification method and device, equipment and a medium. The method comprises the following steps: acquiring a pre-configured role table, a pre-configured permission table and a pre-configured permission role mapping table; counting the number of roles contained in the role table, and when it is judged that the number of the roles is smaller than a preset verification threshold value, calculating permission mark values of permissions in a permission table according to the role table and a permission role mapping table; and in response to an access operation of a target user, obtaining a target role matched with the access operation and a to-be-verified permission, and performing permission verification on the access operation according to a bit flag value of the target role and a permission flag value of the to-be-verified permission. Through the technical scheme of the invention, the verification of the user access authority can be realized, the storage pressure and the computing power demand caused by storing and reading various forms in the authority verification process are reduced, and the verification efficiency of the access authority is improved.

Description

Technical Field

[0001] The present invention relates to the field of security verification, and in particular to a method, device, equipment and medium for verifying access rights. Background Art

[0002] In today's information systems, role-based permission control modules are an important means of ensuring system security and data privacy. Usually, such permission control modules are composed of multiple parts such as role table, role permission table, menu table, user table and user role table.

[0003] The role table is used to define different role types, such as administrators, ordinary users, etc. The user table records the basic information of all users in the system. The menu table describes the various functions and operation options provided by the system. As key relationship tables, the user role table and the role permission table play a role of connection and coordination. The user role table clarifies the role of each user. Since a user may have multiple responsibilities in actual applications, he often has multiple roles. The role permission table specifies in detail the menu permissions that each role can access. A role may be granted numerous menu permissions due to its wide range of responsibilities.

[0004] However, as the system's functions continue to be enriched and expanded, this permission control architecture has gradually exposed some significant problems. For a complex permission system, the numerous tables have led to a sharp increase in the amount of data stored in the system. Each time a role is verified, in order to accurately determine the user's permissions, the system needs to read and analyze multiple related tables, which not only consumes a lot of computing resources, but also greatly reduces the efficiency of permission verification. Summary of the invention

[0005] The present invention provides a method, device, equipment and medium for verifying access rights, which can solve the problems of large storage space and computing power required by existing access rights verification methods and low verification efficiency.

[0006] In a first aspect, an embodiment of the present invention provides a method for verifying access rights, the method comprising:

[0007] Get the pre-configured role table, permission table, and permission-role mapping table;

[0008] Counting the number of roles included in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculating the permission mark value of each permission in the permission table according to the role table and the permission role mapping table;

[0009] In response to an access operation of a target user, a target role and a permission to be verified that match the access operation are obtained, and permission verification is performed on the access operation according to a bit mark value of the target role and a permission mark value of the permission to be verified.

[0010] In a second aspect, an embodiment of the present invention provides a device for verifying access rights, the device comprising:

[0011] An information acquisition module is used to obtain a pre-configured role table, permission table, and permission-role mapping table;

[0012] A tag value calculation module is used to count the number of roles included in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculate the permission tag value of each permission in the permission table according to the role table and the permission role mapping table;

[0013] The permission verification module is used to respond to the access operation of the target user, obtain the target role and the permission to be verified that match the access operation, and perform permission verification on the access operation according to the bit mark value of the target role and the permission mark value of the permission to be verified.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a method for verifying access rights described in any embodiment of the present invention.

[0018] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a method for verifying access rights described in any embodiment of the present invention when executing the computer instructions.

[0019] The technical solution of the embodiment of the present invention first obtains a pre-configured role table, permission table and permission role mapping table, then counts the number of roles contained in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculates the permission mark value of each permission in the permission table according to the role table and the permission role mapping table, and finally responds to the access operation of the target user, obtains the target role and the permission to be verified that match the access operation, and performs permission verification on the access operation according to the bit mark value of the target role and the permission mark value of the permission to be verified, thereby solving the problems of large storage space and computing power required by the existing access permission verification method and low verification efficiency, realizing verification of user access rights, reducing the storage pressure and computing power requirements caused by storing and reading various tables in the process of permission verification, and improving the verification efficiency of access rights.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flowchart of a method for verifying access rights according to Embodiment 1 of the present invention;

[0023] Figure 2 is a flow chart of a method for verifying access rights provided according to Embodiment 2 of the present invention;

[0024] Figure 3 is a schematic diagram of the structure of an access rights verification device provided according to Embodiment 3 of the present invention;

[0025] Figure 4 The present invention is a schematic diagram of the structure of an electronic device for implementing a method for verifying access rights according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, any variation of the terms "including" and "having" is intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1 A flowchart of a method for verifying access rights provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where access rights are to be verified. The method can be executed by a device for verifying access rights. The device for verifying access rights can be implemented in the form of hardware and / or software. The device for verifying access rights can be configured in a terminal or server with a function for verifying access rights.

[0030] like Figure 1 As shown, the method includes:

[0031] S110: Obtain a pre-configured role table, permission table, and permission-role mapping table.

[0032] The role table includes a role name of at least one role, the permission table includes a permission name of at least one permission, and the permission-role mapping table is used to store roles corresponding to each permission.

[0033] In this embodiment, it is first necessary to obtain the pre-configured role table, permission table and permission role mapping table; wherein, the role table refers to a table used to define and describe different types of roles; illustratively, in an enterprise management system, roles may include "senior administrator", "department manager", "ordinary employee", etc., and the role table will contain the role names of these roles; further, the permission table is a table used to list various specific operations or access permissions. For example, in a file management system, permissions may include "read file", "modify file", "delete file", etc., and the permission table contains the permission names of these permissions; further, the role mapping table is used to store role information corresponding to each specific permission. For example, the permission of "read file" may correspond to the two roles of "ordinary employee" and "department manager", then such a corresponding relationship will be recorded in the permission role mapping table. Through such a mapping table, the role scope to which each permission applies can be clearly defined.

[0034] S120, counting the number of roles included in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculating the permission mark value of each permission in the permission table according to the role table and the permission role mapping table.

[0035] Optionally, in this embodiment, after counting the number of roles included in the role table, the method further includes: if it is determined that the number of roles included in the role table is not less than a preset verification threshold, generating an error message and sending it to the user.

[0036] S130. In response to an access operation of the target user, obtain a target role and a permission to be verified that match the access operation, and perform permission verification on the access operation according to a bit mark value of the target role and a permission mark value of the permission to be verified.

[0037] Among them, a target role and a permission to be verified that match the access operation are obtained, and the access operation is verified according to the bit mark value of the target role and the permission mark value of the permission to be verified, including: searching the role table for a sample role whose role name matches the target role, and using the bit mark value of the sample role as the bit mark value of the target role; searching the permission table for a sample permission whose permission name matches the permission to be verified, and using the permission mark value of the sample permission as the permission mark value of the permission to be verified; calculating the difference between the bit mark value of the target role and the permission mark value of the permission to be verified as the target difference that matches the access operation; judging whether there are at least two verification mark values ​​in the permission table whose sum is equal to the target difference; if so, determining that the permission verification of the access operation has passed; if not, determining that the permission verification of the access operation has failed.

[0038] In this embodiment, illustratively, first, a sample role whose role name matches the target role is searched in the role table. For example, if the target role is "sales manager", then a sample role named "sales manager" is searched in the role table, and the bit mark value corresponding to this sample role is identified as the bit mark value of the target role. Secondly, a sample permission whose permission name is consistent with the permission to be verified is searched in the permission table. Assuming that the permission to be verified is "view sales data", a sample permission named "view sales data" is searched in the permission table, and then the permission mark value of this sample permission is used as the permission mark value of the permission to be verified. Next, the difference between the bit mark value of the target role and the permission mark value of the permission to be verified is calculated, and it is set as the target difference value that matches this access operation. After that, it is determined whether there are at least two verification mark values ​​in the permission table whose sum is equal to the above target difference value. For example, if the target difference value is 10, then it is checked whether there are at least two verification mark values ​​in the permission table whose sum can be 10. If such a situation exists, it means that the permission verification of this access operation has passed; if not, it is determined that the permission verification of this access operation has not passed.

[0039] The technical solution of the embodiment of the present invention first obtains a pre-configured role table, a permission table and a permission role mapping table, then counts the number of roles contained in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculates the permission mark value of each permission in the permission table according to the role table and the permission role mapping table, and finally responds to the access operation of the target user, obtains the target role and the permission to be verified that match the access operation, and performs permission verification on the access operation according to the bit mark value of the target role and the permission mark value of the permission to be verified, thereby realizing verification of user access rights, reducing the storage pressure and computing power requirements caused by storing and reading various tables in the process of permission verification, and improving the verification efficiency of access rights.

[0040] Embodiment 2

[0041] Figure 2 A flowchart of a method for verifying access rights provided in Embodiment 2 of the present invention. This embodiment is refined based on the above-mentioned embodiment. In this embodiment, a method for calculating the permission tag value of each permission in a permission table based on a role table and a permission role mapping table is specifically refined.

[0042] like Figure 2 As shown, the method includes:

[0043] S210: Obtain a pre-configured role table, permission table, and permission-role mapping table.

[0044] S220: Count the number of roles included in the role table.

[0045] S230: When it is determined that the number of roles is less than a preset verification threshold, a bit mark value matching each role is generated according to the arrangement order of each role in the role table.

[0046] Specifically, generating a bit mark value that matches each role according to the arrangement order of each role in the role table includes: calculating the bit mark value of each role according to the arrangement order of each role in the role table and a preset bit mark value calculation formula; wherein the preset formula is: i=2 n-1 ; Wherein, i is the bit mark value, and n is the arrangement order of the roles in the role table.

[0047] When the number of roles is determined to be less than the preset verification threshold, it is necessary to generate bit mark values ​​that match each role according to the arrangement order of each role in the role table. Specifically, the bit mark values ​​that match each role are generated according to the arrangement order of each role in the role table. This process includes the following operations: according to the arrangement order of each role in the role table, and using the preset bit mark value calculation formula to calculate the bit mark value of each role. The preset formula here is: i = 2 n-1 , where "i" represents the bit mark value, and "n" represents the order of the role in the role table. For example, suppose the verification threshold is set to 10, and the current number of roles is 5, which is less than the verification threshold. In the role table, the first role has an order of 1. Substituting it into the formula, the calculated bit mark value is 0; the second role has an order of 2, and its bit mark value is 2, and so on, generating corresponding bit mark values ​​for each role. The bit mark values ​​generated in this way can accurately and orderly identify each role, providing a clear and definite basis and basis for subsequent operations such as permission verification.

[0048] S240: Calculate the permission mark value of each permission in the permission table according to the bit mark value of each role and the permission role mapping table.

[0049] Among them, according to the bit mark value of each role and the permission role mapping table, the permission mark value of each permission in the permission table is calculated, including: obtaining at least one role matching each permission according to the permission role mapping table; calculating the sum of the role mark values ​​of each role matching the permission as the permission mark value matching the permission and storing it.

[0050] Specifically, according to the bit mark value of each role and the permission role mapping table, the permission mark value of each permission in the permission table is calculated, which specifically includes the following steps: first, according to the permission role mapping table, at least one role matching each permission is obtained respectively. For example, for the permission of "viewing customer information", the roles matching it may be "sales manager" and "customer service supervisor" found through the permission role mapping table. Then, the sum of the role mark values ​​of each role matching the permission is calculated, and the sum is stored as the permission mark value matching the permission. For example, the role mark value of "sales manager" is 10, and the role mark value of "customer service supervisor" is 20, then the permission mark value of the permission of "viewing customer information" is 30, and 30 is stored in the position corresponding to "viewing customer information" in the permission table. Through this precise calculation and storage method, each permission can be clearly and clearly assigned a mark value that accurately reflects its degree of association with the relevant role, thereby providing strong data support for subsequent permission verification and management, ensuring that the permission control of the system is accurate, efficient and reliable.

[0051] S250. In response to an access operation of the target user, obtain a target role and a permission to be verified that match the access operation, and perform permission verification on the access operation according to a bit mark value of the target role and a permission mark value of the permission to be verified.

[0052] The technical solution of the embodiment of the present invention first obtains a pre-configured role table, permission table and permission role mapping table, then counts the number of roles contained in the role table, and when it is determined that the number of roles is less than a preset verification threshold, generates bit mark values ​​that match each role according to the arrangement order of each role in the role table, and calculates the permission mark value of each permission in the permission table according to the bit mark value of each role and the permission role mapping table, and finally responds to the access operation of the target user, obtains the target role and the permission to be verified that match the access operation, and performs permission verification on the access operation according to the bit mark value of the target role and the permission mark value of the permission to be verified, thereby realizing verification of user access rights, reducing the storage pressure and computing power requirements caused by storing and reading various tables in the process of permission verification, and improving the verification efficiency of access rights.

[0053] Embodiment 3

[0054] Figure 3 A schematic diagram of the structure of an access rights verification device provided in Embodiment 3 of the present invention.

[0055] like Figure 3 As shown, the device comprises:

[0056] The information acquisition module 310 is used to obtain a pre-configured role table, permission table, and permission-role mapping table;

[0057] The tag value calculation module 320 is used to count the number of roles included in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculate the permission tag value of each permission in the permission table according to the role table and the permission role mapping table;

[0058] The permission verification module 330 is used to respond to the access operation of the target user, obtain the target role and the permission to be verified that match the access operation, and perform permission verification on the access operation according to the bit mark value of the target role and the permission mark value of the permission to be verified.

[0059] The technical solution of the embodiment of the present invention first obtains a pre-configured role table, a permission table and a permission role mapping table, then counts the number of roles contained in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculates the permission mark value of each permission in the permission table according to the role table and the permission role mapping table, and finally responds to the access operation of the target user, obtains the target role and the permission to be verified that match the access operation, and performs permission verification on the access operation according to the bit mark value of the target role and the permission mark value of the permission to be verified, thereby realizing verification of user access rights, reducing the storage pressure and computing power requirements caused by storing and reading various tables in the process of permission verification, and improving the verification efficiency of access rights.

[0060] Based on the above embodiment, the tag value calculation module 320 includes:

[0061] A bit mark value generating unit, used for generating bit mark values ​​matching each role respectively according to the arrangement order of each role in the role table;

[0062] The permission mark value calculation unit is used to calculate the permission mark value of each permission in the permission table according to the bit mark value of each role and the permission role mapping table.

[0063] On the basis of the above embodiment, the bit mark value generating unit is specifically used to calculate the bit mark value of each role according to the arrangement order of each role in the role table and the preset bit mark value calculation formula; wherein the preset formula is: i=2 n-1 ; Wherein, i is the bit mark value, and n is the arrangement order of the roles in the role table.

[0064] Based on the above embodiment, the authority tag value calculation unit includes:

[0065] A role matching unit, used to obtain at least one role matching each permission according to the permission role mapping table;

[0066] and a calculation unit, configured to calculate the sum of the role tag values ​​of the roles matching the permission, as the permission tag value matching the permission and store the sum.

[0067] Based on the above embodiment, the authority verification module 330 includes:

[0068] A sample role matching unit, used to search the role table for a sample role whose role name matches the target role, and use the bit mark value of the sample role as the bit mark value of the target role;

[0069] A sample permission matching unit, used to search the permission table for a sample permission whose permission name matches the permission to be verified, and use the permission tag value of the sample permission as the permission tag value of the permission to be verified;

[0070] a target difference calculation unit, used to calculate a difference between a bit mark value of the target role and a permission mark value of the permission to be verified as a target difference value matching the access operation;

[0071] and a judging unit, configured to judge whether there are at least two verification tag values ​​in the permission table whose sum is equal to the target difference;

[0072] A first determination unit, configured to determine, if present, that the permission verification of the access operation has passed;

[0073] The second determination unit is configured to determine that the permission verification of the access operation fails if the access operation does not exist.

[0074] Based on the above embodiment, the tag value calculation module 320 is further used to: after counting the number of roles included in the role table, if it is determined that the number of roles included in the role table is not less than a preset verification threshold, generate an error message and send it to the user.

[0075] An access authority verification device provided by an embodiment of the present invention can execute an access authority verification method provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0076] Embodiment 4

[0077] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0078] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, ROM 12 and RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0079] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0080] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for verifying access rights.

[0081] Accordingly, the method comprises:

[0082] Get the pre-configured role table, permission table, and permission-role mapping table;

[0083] Counting the number of roles included in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculating the permission mark value of each permission in the permission table according to the role table and the permission role mapping table;

[0084] In response to an access operation of a target user, a target role and a permission to be verified that match the access operation are obtained, and permission verification is performed on the access operation according to a bit mark value of the target role and a permission mark value of the permission to be verified.

[0085] In some embodiments, a method for verifying access rights may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for verifying access rights described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform a method for verifying access rights in any other appropriate manner (e.g., by means of firmware).

[0086] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0087] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0088] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0089] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0090] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0091] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0092] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

Claims

1. A method for verifying access rights, characterized in that: include: Get the pre-configured role table, permission table, and permission-role mapping table; Counting the number of roles included in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculating the permission mark value of each permission in the permission table according to the role table and the permission role mapping table; In response to an access operation of a target user, a target role and a permission to be verified that match the access operation are obtained, and permission verification is performed on the access operation according to a bit mark value of the target role and a permission mark value of the permission to be verified.

2. The method according to claim 1, characterized in that The role table includes a role name of at least one role, the permission table includes a permission name of at least one permission, and the permission-role mapping table is used to store roles corresponding to each permission.

3. The method according to claim 1, characterized in that The permission tag value of each permission in the permission table is calculated based on the role table and the permission role mapping table, including: Generate bit mark values ​​that match each role respectively according to the arrangement order of each role in the role table; According to the bit mark value of each role and the permission role mapping table, the permission mark value of each permission in the permission table is calculated.

4. The method according to claim 3, characterized in that: According to the arrangement order of each role in the role table, a bit mark value matching each role is generated, including: The bit mark value of each role is calculated according to the arrangement order of each role in the role table and the preset bit mark value calculation formula; Wherein, the preset formula is: i=2 n-1 ; Among them, i is the bit mark value, and n is the arrangement order of the role in the role table.

5. The method according to claim 3, characterized in that: According to the bit mark value of each role and the permission role mapping table, the permission mark value of each permission in the permission table is calculated, including: Obtain at least one role matching each permission according to the permission role mapping table; The sum of the role tag values ​​of the roles matching the permission is calculated and stored as the permission tag value matching the permission.

6. The method according to claim 1, characterized in that Acquiring a target role and a permission to be verified that match the access operation, and performing permission verification on the access operation according to the bit mark value of the target role and the permission mark value of the permission to be verified, including: Searching the role table for a sample role whose role name matches the target role, and using the bit mark value of the sample role as the bit mark value of the target role; Searching the permission table for a sample permission whose permission name matches the permission to be verified, and using the permission tag value of the sample permission as the permission tag value of the permission to be verified; Calculate the difference between the bit mark value of the target role and the permission mark value of the permission to be verified as a target difference value matching the access operation; Determine whether there are at least two verification tag values ​​in the permission table whose sum is equal to the target difference; If so, it is determined that the permission verification of the access operation is passed; If it does not exist, it is determined that the permission verification of the access operation fails.

7. The method according to claim 1, characterized in that After counting the number of roles included in the role table, it also includes: If it is determined that the number of roles included in the role table is not less than a preset verification threshold, an error message is generated and sent to the user.

8. A device for verifying access rights, characterized in that: include: An information acquisition module is used to obtain a pre-configured role table, permission table, and permission-role mapping table; A tag value calculation module is used to count the number of roles included in the role table, and when it is determined that the number of roles is less than a preset verification threshold, calculate the permission tag value of each permission in the permission table according to the role table and the permission role mapping table; The permission verification module is used to respond to the access operation of the target user, obtain the target role and the permission to be verified that match the access operation, and perform permission verification on the access operation according to the bit mark value of the target role and the permission mark value of the permission to be verified.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a method for verifying access rights according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a method for verifying access rights according to any one of claims 1 to 7 when the instructions are executed.

Images