Authority management method and device, electronic equipment and computer readable storage medium

Abstract

The invention provides an authority management method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of computers. The authority management method comprises the following steps: receiving an authority application request sent by a user, and determining a role template based on the authority application request; determining the service management authority of the user based on the role template, and granting the service management authority to the user; wherein the service management authority is the authority of the user management service; determining the machine management authority of the user based on the role template, and authorizing the machine management authority to the user; wherein the machine management authority is the authority of a machine on which the user manages the service. According to the method, the service management authority and the machine management authority are packaged through the role template, the user authority application operation is simplified, and the authority management cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a permission management method, device, electronic device and computer-readable storage medium. Background Art

[0002] In the Internet field, the realization of business functions requires the support of background services, and as the business scale continues to expand, the required online services also increase dramatically. Therefore, in order to ensure the iteration efficiency and online stability of services, service management is crucial. Among them, service management refers to the centralized information management of various software service resources involved in the system operation and maintenance process and the hardware equipment they rely on.

[0003] In the related art, user authorization management is mainly performed in the following manner: based on user needs, corresponding roles are created for users on the permission management platform through manual addition, and certain permissions are set for the roles. However, in the above method, service permissions need to be manually added on the service permission management platform according to user needs, and machine permissions need to be applied for separately by users on the machine permission management platform. The cost of user application for permissions is high and the operation efficiency is low. In addition, when performing permissions, hundreds or thousands of corresponding permissions need to be modified, which is time-consuming and not flexible enough. Summary of the invention

[0004] In view of this, the embodiments of the present application propose a permission management method, device, electronic device and computer-readable storage medium to solve the problems in the related art that service permissions need to be manually authorized on the service permission management platform according to user needs, and machine permissions need to be applied for by users separately on the machine permission management platform, and the cost of user permission application is high and the operation efficiency is low. In addition, when performing permissions, hundreds or thousands of corresponding permissions need to be modified, which is time-consuming and inflexible.

[0005] According to a first aspect of the present disclosure, a permission management method is provided, comprising: receiving a permission application request sent by a user, and determining a role template based on the permission application request; determining the service management authority of the user based on the role template, and granting the service management authority to the user; wherein the service management authority is the authority of the user to manage the service; determining the machine management authority of the user based on the role template, and granting the machine management authority to the user; wherein the machine management authority is the authority of the user to manage the machine on which the service relies.

[0006] According to a second aspect of the present disclosure, a permission management device is provided, comprising: a receiving module, used to receive a permission application request sent by a user, and determine a role template based on the permission application request; an authorization module, used to determine the service management authority of the user based on the role template, and grant the service management authority to the user; wherein the service management authority is the authority of the user to manage the service; the authorization module is also used to determine the machine management authority of the user based on the role template, and authorize the machine management authority to the user; wherein the machine management authority is the authority of the user to manage the machine on which the service relies.

[0007] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory storing a program, wherein the program comprises instructions, and when the instructions are executed by the processor, the processor executes the above-mentioned permission management method.

[0008] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the above-mentioned permission management method.

[0009] The exemplary embodiments of the present disclosure may have some or all of the following beneficial effects:

[0010] In the permission management method provided in the example implementation of the present disclosure, a permission application request sent by a user is received, and a role template is determined based on the permission application request; the service management permission of the user is determined based on the role template, and the service management permission is granted to the user; wherein the service management permission is the permission of the user to manage the service; the machine management permission of the user is determined based on the role template, and the machine management permission is granted to the user; wherein the machine management permission is the permission of the machine on which the user manages the service. The embodiment of the present disclosure determines the role template based on the permission application request of the user, and determines the service management permission of the user based on the role template, and can uniformly manage the user permissions corresponding to the same role template, avoiding the management confusion caused by different permissions obtained by users of the same type. Moreover, when the permission is upgraded, only the permission corresponding to the role template is updated, and the permissions owned by the user will be updated accordingly, which is convenient and flexible to operate, and improves the efficiency of permission management. In addition, not only can the service management permission of the user be determined based on the role template, but the machine management permission can also be determined based on the role template, that is, the application entrances of the service management permission and the machine management permission are unified through the role template, which is convenient for user operation, improves user experience, and reduces the cost of permission application.

[0011] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Further details, features and advantages of the present disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0013] Figure 1 A flowchart of a method for managing rights according to an exemplary embodiment of the present disclosure is shown;

[0014] Figure 2 A flowchart of applying for temporary permissions and permanent permissions in a permission management method according to an exemplary embodiment of the present disclosure is shown;

[0015] Figure 3 A flowchart of permission recovery in a permission management method according to an exemplary embodiment of the present disclosure is shown;

[0016] Figure 4 A schematic block diagram of a rights management device according to an exemplary embodiment of the present disclosure is shown;

[0017] Figure 5 A structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0020] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0021] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0022] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0023] In the related art, the method for authorizing and managing users has the following problems:

[0024] (1) Manual operation and low efficiency: The above method manually creates roles on the permission management platform according to user needs, sets certain permissions for the roles, and adds users to the corresponding role list. Therefore, when a new service is launched or there are personnel adjustments, a large number of permission applications and deletions will be involved, which is complex and time-consuming.

[0025] (2) Chaotic authority management: In the above method, since there is no unified standard when creating roles, they are only manually created and authorized based on the user's needs for authority, so the corresponding authorities of the same type of roles may be different. In addition, when upgrading existing authorities, hundreds of online roles need to be modified, and authority management is chaotic and inflexible. Without relevant procedures for authority management, there will not only be the risk of excessive authority, but also a lot of dirty data will be generated.

[0026] (3) The operating platforms are scattered and the cost of permission management is high: Service permission management and machine permission management are on different platforms. After users apply for service permissions, they also need to apply for machine permissions. Permission management is fragmented and the cost of user permission application is high.

[0027] In order to solve the above problems, the embodiments of the present application provide a permission management method, device, electronic device and computer-readable storage medium. The following describes the solution of the present disclosure with reference to the accompanying drawings.

[0028] The present disclosure first provides a method for managing permissions. Figure 1 As shown, the permission management method specifically includes the following steps:

[0029] S110: receiving a permission application request sent by a user, and determining a role template based on the permission application request;

[0030] S120: Determine the service management authority of the user based on the role template, and grant the service management authority to the user; wherein the service management authority is the authority of the user to manage services;

[0031] S130: Determine the machine management authority of the user based on the role template, and authorize the machine management authority to the user; wherein the machine management authority is the authority of the machine on which the user management service relies.

[0032] In the permission management method provided in the embodiment of the present disclosure, a role template is determined based on the user's permission application request, and the user's service management permission is determined based on the role template. The user permissions corresponding to the same role template can be managed uniformly, avoiding the management confusion caused by different permissions obtained by users of the same type. Moreover, when the permissions are upgraded, only the permissions corresponding to the role template are updated, and the permissions owned by the user will be updated accordingly. The operation is convenient and flexible, and the efficiency of permission management is improved. In addition, not only can the user's service management permission be determined based on the role template, but the machine management permission can also be determined based on the role template, that is, the application entrances for service management permission and machine management permission are unified through the role template, which is convenient for user operation, improves user experience, and reduces the cost of permission application. Below, in another embodiment, the above steps are described in more detail.

[0033] In step S110, a permission application request sent by a user is received, and a role template is determined based on the permission application request.

[0034] The rights management method provided in the embodiment of the present application includes rights management for services and rights management for machines, wherein services refer to various software service resources involved in the system operation and maintenance process, and machines refer to the hardware devices on which the above software service resources rely.

[0035] In the embodiment of the present application, the management of the above services can be implemented based on a service tree. The service tree is a tree structure for managing services at three levels: product line, subsystem, and service. The above services are leaf nodes of the service tree.

[0036] In the embodiment of the present application, the above product line is used to represent independent products that can be presented to users. For example, the product line can be an independent product such as a map, a forum or a search engine that can be installed in an electronic device.

[0037] In the embodiment of the present application, the above subsystem is a set of applications divided for management needs under a certain product. Exemplarily, the subsystem can be a set of applications used to implement a certain function in the above product line.

[0038] In the embodiment of the present application, the above service is an application running in the background. The service application can usually provide some functions to the user locally through the network. For example, a client, a server application, a website (Web Server, web) server, and other server-based applications.

[0039] In the embodiment of the present application, the above-mentioned permission application request is a request for the user to request the permission to manage services and machines.

[0040] In an embodiment of the present application, the above permission application request may, for example, include the node for which permission is to be applied, the role template, the permission type, and the validity period of the permission.

[0041] In the embodiment of the present application, the nodes for which permissions are to be applied may be product line nodes, subsystem nodes, and service nodes, which correspond to the management permissions of product lines, subsystems, and services, respectively. For example, if a user obtains permissions for a subsystem, he or she can manage all services under the subsystem.

[0042] In the embodiment of the present application, the authority of the service tree corresponds to the node authority, and the user's acquisition of node authority means that the user can operate the authority of the corresponding node on the service tree. For example, after obtaining the node authority, the user can manage the service by adding, deleting, mounting, etc. the corresponding node on the service tree.

[0043] In the embodiment of the present application, the above-mentioned role template is a template obtained by abstracting permissions, and different role templates correspond to fixed permissions.

[0044] In the embodiment of the present application, the role is the link between the user and the authority. By creating a role, authorizing the role, and assigning the role to the user, the user can be authorized.

[0045] In the embodiment of the present application, the above role templates are abstract permission templates of different types, and different role templates correspond to fixed permissions. Exemplarily, the above role templates may include system read-only type, research and development (RD) type, operation and maintenance (OP) type, quality assurance (QA) type, etc.

[0046] In an embodiment of the present application, exemplarily, the above-mentioned system read-only type role template may include a system read-only template, and the permissions corresponding to the system read-only template are: no machine login permissions; can view node information, view monitoring, view online orders, etc.; the above-mentioned RD type role template includes a R&D front-line template, a R&D senior engineer template and a R&D manager template, among which the permissions corresponding to the R&D front-line template are added on the basis of system read-only: personal account machine permissions; create online orders, create online tasks, the permissions corresponding to the above-mentioned R&D senior engineer template are added on the basis of R&D front-line: no machine login permissions; can review online orders, the permissions corresponding to the above-mentioned R&D manager template are added on the basis of R&D senior engineer: no machine login permissions; increase service tree node R&D permission approval; the above-mentioned QA type role template includes a test front-line template, a test dashboard template and a test manager template, among which the test front-line template has The corresponding permissions are as follows: on the basis of system read-only, the following are added: personal account machine permissions; monitoring and dashboard configuration; the permissions corresponding to the above-mentioned test dashboard template are as follows: on the basis of system read-only, the following are added: no machine login permissions; dashboard configuration can be performed; the permissions corresponding to the above-mentioned test manager template are as follows: on the basis of the first-line test, the following are added: no machine login permissions; added service tree node test permission approval; the above-mentioned OP-type role templates include self-operation and maintenance templates, first-line operation and maintenance templates and operation and maintenance manager templates; among them, the permissions corresponding to the above-mentioned self-operation and maintenance templates are as follows: on the basis of R&D senior engineer, the following are added: machine work permissions, with node deployment, online monitoring configuration and other management permissions; the permissions corresponding to the above-mentioned first-line operation and maintenance templates are as follows: on the basis of self-operation and maintenance, the following are added: machine root permissions, and instances cannot be added or deleted; the permissions corresponding to the above-mentioned operation and maintenance manager templates are as follows: on the basis of the first-line operation and maintenance, the following are added: approval of new service tree node permissions.

[0047] In the embodiment of the present application, the above permission type refers to the type of service management permission and machine management permission applied for by the user. Exemplarily, the above permission type may include temporary permission and permanent permission.

[0048] In the embodiment of the present application, the validity period of the permission mentioned above refers to the duration of the permission requested by the user. Exemplarily, the duration of the permission can be determined by the user based on actual needs.

[0049] In the embodiment of the present application, the role template requested in the above permission application request, after receiving the permission application request sent by the user, the corresponding role template can be obtained from the permission application request.

[0050] In an embodiment of the present application, after receiving the permission application request from the user, the permission application request sent by the user can also be reviewed. Exemplarily, the process can be implemented as follows: determine the template type of the role template applied for by the user; review the permission application request based on the template type. Specifically, the review can be performed according to the following logic: RD-type roles are approved by the R&D manager; QA-type roles are approved by the testing manager; OP-type roles are approved by the operation and maintenance manager; when the product line does not have an R&D manager and a testing manager, it is approved by the operation and maintenance manager; when the product line does not have an operation and maintenance manager, it is approved by the default administrator.

[0051] In step S120, the service management authority of the user is determined based on the role template, and the service management authority is granted to the user; wherein the service management authority is the authority of the user to manage services.

[0052] In the embodiment of the present application, the above service management authority refers to the user's management authority over the service. For example, the user can add, delete and mount services by operating nodes in the service tree.

[0053] In the embodiment of the present application, the target role is a role created for the user based on the permission application request sent by the user. For example, if the user applies for system read-only permission, a system read-only role can be created based on the permission application request.

[0054] In an embodiment of the present application, the above-mentioned determination of the user's service management authority based on the role template and granting of service management authority to the user can be implemented as follows: determining the target service applied for by the user based on the role template, and creating a target role corresponding to the target service; granting service management authority to the user based on the target role. Specifically, in combination with the above-mentioned service tree structure, the process can be implemented as follows: determining the user's service management authority based on the role template; determining the target service applied for by the user based on the service management authority, and generating a target role corresponding to the target service; determining the target node corresponding to the target role in the service tree, and binding the target role to the target node; wherein the service tree is a tree structure composed of product lines, subsystems, and services, and is used for authority management; binding the user to the target role so that the user obtains service management authority based on the target node in the service tree.

[0055] In the embodiment of the present application, the above-mentioned creation of a target role corresponding to the target service may, exemplarily, further include the following steps: naming the target role according to a preset rule, and generating a role name of the target role.

[0056] In an embodiment of the present application, after generating a role name for the target role according to a preset rule, the above-mentioned granting of service management rights to the user based on the target role can be implemented as follows: judging whether the target role already exists based on the role name of the target role; if it is judged that the target role already exists, the role name of the target role is obtained, and the service management rights are granted to the user based on the role name. Specifically, judging whether the target role already exists based on the role name of the target role; if it is judged that the target role already exists, the role name of the target role is obtained; binding the user and the target role based on the role name, so that the user obtains the service management rights based on the target node in the service tree.

[0057] In a specific embodiment, the detailed process of authorizing the user to manage the service can be as follows: derive the target role based on the role template, authorize the generated target role, and bind the corresponding node of the service tree; bind the user to the generated target role, authorize the user, and after the authorization is completed, the user can operate the relevant nodes of the service tree. Exemplarily, the derivation principles can include the following principles:

[0058] (1) Product line permissions: The system read-only permission (product_read-only) only appears on the product line node and is bound when the product line is created;

[0059] (2) Subsystem permissions: Product connector parameter read-only permission (product_SUB_subsystem_read-only) is a subsystem-level permission. When a user applies for the first time, a role is created and bound to the subsystem node.

[0060] (3) Application permissions: Product application read-only permission (product_app_read-only) is a service-level permission. When a user applies for the first time, a role is created and bound to the service node.

[0061] In the above specific embodiment, after obtaining the relevant information in the user's permission application request, the permission type is determined (there are three types of permission: product line level, subsystem level, and service level. The services under the subsystem node will inherit the subsystem level permissions, and the services under the product line node will inherit the product line level permissions), and the actual role is derived according to the rules of product line_role template name, product line_SUB_subsystem_role template name, product line_service name_role template name, and the permission management platform is called to create the role and bind the corresponding service tree node. If the role already exists, the role ID is returned.

[0062] In step S130, the machine management authority of the user is determined based on the role template, and the machine management authority is authorized to the user; wherein the machine management authority is the authority of the machine on which the user management service relies.

[0063] In the embodiment of the present application, the above-mentioned machine management authority refers to the user's management authority over the machine on which the service relies.

[0064] In the embodiment of the present application, the above machine may be a server, for example. The server is a computer hardware device on which the application runs, which has much higher performance than an ordinary computer, and has high-speed central processing unit computing power, long-term reliable operation, and strong input and output data throughput.

[0065] In an embodiment of the present application, the machine management authority may be the authority to manage the server. Exemplarily, the machine management authority may include the following three authorities: personal user authority, work user authority, and root user authority. Under personal user authority, users can operate on files and other content created by themselves. Under the work user authority, users can obtain the authority required for the business being performed. Under root user authority, users can perform any operation on the machine.

[0066] In the embodiment of the present application, different role templates correspond to different machine management permissions. Therefore, after the role template is obtained based on the permission application request, the machine management permission of the user can be determined based on the role template, and the machine management permission can be authorized to the user.

[0067] In the embodiment of the present application, the above-mentioned determination of the user's machine management authority based on the role template and the authorization of the machine management authority to the user can be implemented as follows: apply for machine authority according to the role template selected by the user, the self-operation and maintenance authority corresponds to the machine work user authority, the operation and maintenance front-line authority corresponds to the machine root authority, and the rest are personal personal authority. Specifically, the correspondence between the role template and the machine authority can be as follows: system read-only, R&D deployment, R&D senior engineer, R&D manager, test manager: no machine login authority; R&D front-line, test front-line: corresponding to the machine personal user authority; self-operation and maintenance: corresponding to the machine work user authority; operation and maintenance front-line, operation and maintenance manager: corresponding to the machine root authority.

[0068] In another embodiment of the present application, after receiving the permission application request sent by the user, different processing can be performed for permanent permission applications and temporary permission applications. When applying for permanent permission, if the same temporary permission has been applied for before, the temporary permission will be upgraded; when applying for temporary permission, if the same temporary permission has been applied for before, the validity period of this permission is obtained, and it is determined whether the permission owned by the user is still within the validity period. If the permission is within the validity period, no processing is performed. If the permission has expired, the permission is extended and the permission expiration time is updated. If this is the first time to apply for temporary permission for this role, apply for temporary permission and save the relevant information of the temporary permission application. Specifically, if Figure 2 As shown, the following steps may be included:

[0069] S201: receiving a permission application request;

[0070] In the embodiment of the present application, the above permission application request is a request for a user to request permission to manage services and machines. Exemplarily, the permission application request may include the node to which permission is to be applied, the role template, the permission type, and the validity period of the permission.

[0071] S202: Determine whether it is a temporary permission request;

[0072] In the embodiment of the present application, it is determined based on the permission application request whether the user requests a permanent permission or a temporary permission. If the request is a temporary permission, S203 is continued to be executed; if the request is a permanent permission, S209 is continued to be executed;

[0073] S203: Determine whether temporary permission has been applied for.

[0074] In the embodiment of the present application, if it is determined that the user has applied for temporary permissions before, step S204 is continued to be executed; if it is determined that the user has not applied for temporary permissions before, step S207 is continued to be executed.

[0075] S204: Obtain the effective time of the temporary permission.

[0076] S205: Determine whether the temporary permission is still valid.

[0077] In the embodiment of the present application, if it is determined that the temporary permission applied for last time is no longer valid, step S206 is continued to be executed; if it is determined that the temporary permission applied for above is still valid, the process is terminated.

[0078] S206: Apply to extend the limited period of the temporary authority and update the status parameters of the authority.

[0079] In the embodiment of the present application, when it is determined that the temporary permission applied for last time is no longer valid, an application is made to extend the validity period of the temporary permission, and the value of the status parameter is updated to extend.

[0080] S207: Apply for temporary role authority and set status parameters of the temporary authority.

[0081] In the embodiment of the present application, it is determined that the user has not applied for temporary permission before, and the temporary permission is applied for for the first time, and the value of the status parameter is set to successful application (success).

[0082] S208: Save temporary permission application information.

[0083] S209: Determine whether temporary permission has been applied for.

[0084] In the embodiment of the present application, when it is determined that the user has applied for permanent permissions, it is further determined in this step whether the user has applied for temporary permissions before. If it is determined that the user has applied for temporary permissions, S210 is continued; if it is determined that the user has not applied for temporary permissions, the process ends.

[0085] S210: Upgrade the temporary permission to permanent permission and update the status parameters.

[0086] In an embodiment of the present application, when a user applies for permanent permission and has previously applied for temporary permission, the temporary permission is upgraded to permanent permission, and the value of the status parameter is updated to upgrade.

[0087] In another embodiment of the present application, the service management authority and cluster management authority can also be audited. Exemplarily, the authority audit process can be implemented as follows: monitor the service management authority and machine management authority of each user; when the service management authority or the machine management authority is in a preset state, adjust the service management authority or the machine management authority based on the preset state. The preset state can be an unreasonable state, for example, the authority exceeds the limited period, or a high-risk state.

[0088] In the embodiment of the present application, the above-mentioned adjustment of the service management authority or machine management authority based on the preset state can be implemented as follows: based on the preset state, the service management authority or machine management authority of the user is reclaimed. Specifically, the process can be implemented as follows: determine whether the service management authority or machine management authority is within the validity period of the authority; when it is determined that the service management authority or machine management authority is not within the validity period of the authority, reclaim the service management authority or machine management authority. That is, when the user applies for temporary authority, the validity period of the authority is recorded, and the expired authority is reclaimed regularly.

[0089] In the embodiment of the present application, specifically, the above-mentioned permission audit may include the following two aspects of permission audit:

[0090] (1) My permissions: Obtain the user's permission information for product lines, subsystems, and services from the permission platform. Users can unbind permissions as needed.

[0091] (2) Permission audit: Permission administrators regularly audit the permissions of users, and the product line manager role can delete the permissions of a certain user. The detailed plan is as follows: the permission data of all users is obtained on a daily basis and updated to the cache; the permission administrator can see all the permission data of users and support filtering by dimensions such as users, product lines, subsystems, and services; the permission administrator initiates the permission audit process within a certain range, and the system will prompt the current high-risk permissions (such as: the self-operated product line has root permissions, the outsourced account rd has op permissions, etc.); after the process is completed, the platform will record the relevant audit operations for future inquiries.

[0092] In another embodiment of the present application, the above-mentioned permission management method further includes: when it is detected that the permission of the above-mentioned role template is updated, the service management permission and machine management permission of the user corresponding to the role template are updated accordingly.

[0093] In an embodiment of the present application, when updating the service management permissions and machine management permissions of the user corresponding to the role template, the above-mentioned permission management method may further include: for each role template, pre-setting a whitelist corresponding to the role template; when a permission update of the above-mentioned role template is detected, determining whether each user is in the whitelist; if it is determined that the user is in the whitelist, updating the user's service management permissions and machine management permissions as the permissions of the role template change; if it is determined that the user is not in the whitelist, keeping the user's current service management permissions and machine management permissions unchanged.

[0094] Next, combine Figure 3 The process of reclaiming temporary permissions is described in detail, such as Figure 3 As shown, the above permission recovery includes the following steps:

[0095] S310: Obtain temporary permission application information.

[0096] S320: Obtain status parameters of temporary permissions.

[0097] In the embodiment of the present application, this step is used to obtain the value of the above-mentioned status parameter. Exemplarily, the value of the status parameter can be permission information of success or extend.

[0098] S330: Determine whether the temporary permission has expired according to the validity period of the temporary permission.

[0099] S340: Delete expired permissions and update status parameters.

[0100] In the embodiment of the present application, when it is determined that the temporary permission has expired, the expired permission is deleted and the status is updated to an expired recycling status (recycle).

[0101] Compared with the prior art, the above-mentioned permission management method provided in the embodiment of the present application has the following advantages:

[0102] (1) This embodiment of the application streamlines the permission application process. After the user submits the permission information to be applied for, the system calls the permission management platform to create a role according to the specific situation and adds the user to the role list. This not only leaves a trace, but also improves the efficiency of permission application and reduces operating costs.

[0103] (2) The embodiment of the present application abstracts permissions into role templates, and different role templates correspond to fixed permissions. According to the service tree node of the application, the actual role is derived and the user is authorized, thereby realizing refined management of permissions. When permissions are upgraded, only the permissions corresponding to the role template need to be updated, and the permissions owned by the user will be updated accordingly, which is convenient and flexible to operate. In addition, the embodiment of the present application also adds a permission audit process, regularly reviews the permissions owned by users, and reclaims expired or high-risk permissions, thereby reducing the risks brought by the expansion of permissions.

[0104] (3) The embodiment of the present application encapsulates the permission application of the service tree and the machine, determines whether it is necessary to apply for machine permissions based on the role template, and unifies the application entry, which greatly facilitates users and reduces the cost of permission application.

[0105] The above mainly introduces the solution provided by the embodiment of the present invention from the perspective of the method. In order to achieve the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0106] The embodiment of the present invention can divide the functional modules of the rights management device according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present invention is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0107] The present disclosure provides a rights management device. Figure 4 As shown, the rights management device 400 may include a receiving module 410 and an authorization module 420, wherein:

[0108] The receiving module 410 is used to receive a permission application request sent by a user and determine a role template based on the permission application request;

[0109] The authorization module 420 is used to determine the service management authority of the user based on the role template and grant the service management authority to the user; wherein the service management authority is the authority of the user to manage services;

[0110] The authorization module 420 is further used to determine the user's machine management authority based on the role template and authorize the user to have the machine management authority; wherein the machine management authority is the authority of the machine on which the user management service relies.

[0111] In an embodiment of the present application, the above-mentioned authorization target is specifically used to: determine the service management authority of the user based on the role template; determine the target service applied for by the user based on the service management authority, and generate a target role corresponding to the target service; determine the target node corresponding to the target role in the service tree, and bind the target role to the target node; wherein the service tree is a tree structure composed of product lines, subsystems and services, which is used for authority management; bind the user to the target role so that the user obtains service management authority based on the target node in the service tree.

[0112] In the embodiment of the present application, the above-mentioned authorization module is specifically used to: generate a target role corresponding to the target service; name the target role according to preset rules, and generate a role name of the target role.

[0113] In an embodiment of the present application, the above-mentioned authorization module is specifically used to: determine whether the target role already exists based on the role name of the target role; if it is determined that the target role already exists, obtain the role name of the target role; bind the user and the target role based on the role name, so that the user obtains service management permissions based on the target node in the service tree.

[0114] In an embodiment of the present application, the above-mentioned permission management device also includes a review module, which is specifically used to: determine the template type of the role template applied for by the user; and review the permission application request based on the template type.

[0115] In an embodiment of the present application, the above-mentioned permission management device also includes a permission audit module, which is specifically used to: periodically review the service management permissions and machine management permissions of each user; and correct the service management permissions and machine management permissions based on the review results.

[0116] In an embodiment of the present application, the above-mentioned permission audit module is specifically used to: determine whether the service management permission or machine management permission is within the validity period of the permission; when it is determined that the service management permission or machine management permission is not within the validity period of the permission, reclaim the service management permission or machine management permission.

[0117] In addition, the specific implementation details of the above-mentioned permission management device have been described in detail in the corresponding position of the permission management method, so they will not be repeated here.

[0118] Figure 5 Schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Figure 5 , which shows a structural schematic diagram of an electronic device 500 suitable for implementing the embodiments of the present disclosure. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0119] like Figure 5 As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 to a random access memory (RAM) 503 to implement the voice control method of the embodiment described in the present disclosure. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0120] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0121] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart, thereby implementing the voice control method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0122] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0123] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0124] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0125] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0126] Receive permission application requests from users and determine role templates based on the permission application requests;

[0127] Determine the user's service management authority based on the role template and grant the user the service management authority; the service management authority is the user's authority to manage services;

[0128] The user's machine management rights are determined based on the role template, and the machine management rights are authorized to the user; wherein the machine management rights are the rights of the machine on which the user management service relies.

[0129] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0130] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0131] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0132] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0133] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0134] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0135] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0136] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0137] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A rights management method, characterized in that: include: Receive a permission application request sent by a user, and determine a role template based on the permission application request; Determine the service management authority of the user based on the role template, and grant the service management authority to the user; wherein the service management authority is the authority of the user to manage services; The machine management authority of the user is determined based on the role template, and the machine management authority is authorized to the user; wherein the machine management authority is the authority of the user to manage the machine on which the service relies.

2. The rights management method according to claim 1, characterized in that: The determining the service management authority of the user based on the role template and granting the service management authority to the user includes: Determine the target service applied for by the user based on the role template, and create a target role corresponding to the target service; The service management authority is granted to the user based on the target role.

3. The rights management method according to claim 2, characterized in that: The creating of the target role corresponding to the target service also includes: The target role is named according to a preset rule to generate a role name of the target role.

4. The rights management method according to claim 3, characterized in that: The granting the service management authority to the user based on the target role includes: Determining whether the target role already exists based on the role name of the target role; If it is determined that the target role already exists, the role name of the target role is obtained, and the service management authority is granted to the user based on the role name.

5. The rights management method according to claim 1, characterized in that: After determining the role template based on the permission application request, the method further includes: Determine the template type of the role template applied for by the user; The permission application request is reviewed based on the template type.

6. The rights management method according to claim 1, characterized in that: The method further comprises: Monitoring the service management authority and the machine management authority of each of the users; When the service management authority or the machine management authority is in a preset state, the service management authority or the machine management authority is adjusted based on the preset state.

7. The rights management method according to claim 6, characterized in that: The adjusting the service management authority or the machine management authority based on the preset state includes: The service management authority or the machine management authority of the user is revoked based on the preset status.

8. A rights management device, characterized in that: include: A receiving module, used to receive a permission application request sent by a user, and determine a role template based on the permission application request; An authorization module, used to determine the service management authority of the user based on the role template, and grant the service management authority to the user; wherein the service management authority is the authority of the user to manage services; The authorization module is further used to determine the machine management authority of the user based on the role template, and authorize the machine management authority to the user; wherein the machine management authority is the authority of the user to manage the machine on which the service relies.

9. An electronic device, comprising: processor; as well as Memory for storing programs, The program includes instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-7.

Images