Resource authority management method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a resource authority management method and device, a storage medium and electronic equipment. The method comprises the following steps: creating a resource permission table, wherein the resource permission table indicates a mapping relationship between each visitor and a corresponding authorized access resource set; searching an authorized access resource set corresponding to the target access personnel in the resource permission table according to an access request of the target access personnel to the resource database; judging whether at least one shared resource subset exists between a resource set requested by the access request in a resource database and an authorized access resource set or not; and when at least one shared resource subset exists in the requested resource set, determining the at least one shared resource subset as authorized resource data of the access request. In this way, resource authority management strategies for different users are constructed on the fine-grained authority management level of the data level.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a resource authority management method and device, storage medium and electronic device thereof. Background Art

[0002] Enterprise-level information management systems such as ERP (Enterprise Resource Planning) can optimize business processes and improve operational efficiency by integrating various resources within the enterprise. ERP systems usually include multiple modules such as financial management, human resource management, supply chain management, customer relationship management, production management, etc. Through the collaboration of various modules, real-time data sharing and process automation can be achieved.

[0003] In the permission configuration of the information management system, resource permission management aims to protect the security and stability of the information management system through strict permission allocation and access control. Permission management solutions such as resource permission isolation can ensure that each access person can only access data within their permission range, thereby preventing unauthorized access and data leakage.

[0004] The resource permission management scheme in the related art lacks fine-grained permission management of resource data. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a resource permission management method and its device, storage medium and electronic device to solve or alleviate the problem of lack of fine-grained permission management at the data level in related technologies.

[0006] According to a first aspect of an embodiment of the present application, a resource permission management method is provided, the method comprising: creating a resource permission table, the resource permission table indicating a mapping relationship between each access person and a corresponding authorized access resource set; searching the resource permission table for an authorized access resource set corresponding to the target access person according to an access request of the target access person to a resource database; determining whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set; and when at least one shared resource subset exists in the requested resource set, determining the at least one shared resource subset as the authorized resource data of the access request.

[0007] In some embodiments of the present application, the resource permission management method further includes: when at least one shared resource subset does not exist in the requested resource set, isolating the resource permissions of the target access personnel.

[0008] In some embodiments of the present application, creating a resource permission table includes: obtaining the registration information of each access person, and determining the business department to which the access person belongs based on the registration information of each access person; authorizing the authorized access resource set of the business role under the business department to which each access person belongs to the access person, and obtaining a mapping relationship between the access person and the corresponding authorized access resource set; determining the mapping relationship between each access person and the corresponding authorized access resource set as a resource permission table.

[0009] In some embodiments of the present application, the authorized access resource set of the business role under the business department to which each access personnel belongs is authorized to the access personnel, including: according to at least one business attribute, dividing the authorized access resource data of the business role under the business department to which each access personnel belongs into multiple access resource subsets, and aggregating the multiple access resource subsets into the authorized access resource set of the access personnel.

[0010] In some embodiments of the present application, determining whether a resource set requested by an access request in a resource database exists with at least one shared resource subset in an authorized access resource set includes: searching in the resource database whether there is an authorized access resource set that matches the target access person; if so, searching the resource database for at least one shared resource subset that satisfies the access request.

[0011] In some embodiments of the present application, searching a resource database for at least one shared resource subset that satisfies an access request includes: using a resource subset in a resource set of the access request to query the resource database; and determining the resource subset that hits the target access person as at least one shared resource subset.

[0012] In some embodiments of the present application, determining at least one shared resource subset as authorized resource data for an access request includes: displaying operation function items of the authorized resource data in a management page logged in by a target access person from a business system.

[0013] According to a second aspect of an embodiment of the present application, a resource permission management device is provided, which includes: a creation module, which is used to create a resource permission table, which indicates a mapping relationship between each access person and a corresponding authorized access resource set; a search module, which is used to search for an authorized access resource set corresponding to a target access person in the resource permission table according to an access request of the target access person to a resource database; a judgment module, which is used to judge whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set; and a determination module, which is used to determine at least one shared resource subset as the authorized resource data of the access request when there is at least one shared resource subset in the requested resource set.

[0014] According to the third aspect of the embodiments of the present application, there is provided an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the resource permission management method of any of the above embodiments.

[0015] According to a fourth aspect of the embodiments of the present application, a computer storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, a resource permission management method as described in any of the above embodiments is implemented.

[0016] According to the resource permission management method and its device, storage medium and electronic device provided in the embodiment of the present application, when a target access person issues an access request to a resource database for data access, the authorized access resource set corresponding to the target access person is searched in a pre-created resource permission table to determine whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set, and when there is at least one shared resource subset in the requested resource set, the at least one shared resource subset is determined as the authorized resource data of the access request, so that the target access person can legally access the authorized resource data, thereby constructing a resource permission management strategy for different users at the fine-grained permission management level at the data level. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0018] Figure 1 A schematic diagram of a resource authority management method according to an embodiment of the present application;

[0019] Figure 2 A schematic diagram of the structure of a resource authority management device according to an embodiment of the present application;

[0020] Figure 3 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0022] The specific implementation of the embodiments of the present application is further explained below in combination with the embodiments of the present application and the accompanying drawings.

[0023] Figure 1 FIG. 1 is a flow chart of a resource authority management method according to an embodiment of the present application. Figure 1 As shown, the method includes:

[0024] S11: Create a resource permission table, which indicates the mapping relationship between each access person and the corresponding authorized access resource set.

[0025] Specifically, in order to achieve the isolation and control of data permissions of different users, the scope of permissions that can be accessed is usually pre-set for each user, so that each user can only access resources within the scope of their corresponding permissions. In other words, before each accessor accesses the business platform, a mapping relationship between each accessor and the corresponding authorized resource set is pre-created so that each accessor can only access resources within their scope of permissions.

[0026] In some embodiments, creating a resource permission table includes: obtaining registration information of each access person, and determining the business department to which the access person belongs based on the registration information of each access person; authorizing the access person to obtain a mapping relationship between the access person and the corresponding authorization access resource set of the business role under the business department to which each access person belongs; and determining the mapping relationship between each access person and the corresponding authorization access resource set as a resource permission table.

[0027] The registration information of each visitor includes but is not limited to the visitor's account ID, account password, and business department. When each visitor accesses the business platform, the business department to which the visitor belongs is first determined. After determining the business department to which the visitor corresponds, the business role under the business department is authorized to the visitor, and the authorized access resource set of the business role is also authorized to the visitor accordingly, so that the mapping relationship between each visitor and the corresponding authorized access resource set is determined as a resource permission table.

[0028] Exemplarily, the business platform is ERP, i.e. Enterprise Resource Planning, which is an integrated enterprise management system. The business departments of the ERP system include: core operating departments such as finance department, human resources department, supply chain department, production management department, sales department and procurement department. The ERP system integrates the above business departments into a unified system and integrates them through a database (such as the resource database of this application) to achieve real-time sharing and updating of data. Among them, the functions of the financial management department include but are not limited to general ledger, accounts receivable, accounts payable, asset management, budget management, etc., to help enterprises achieve unified management and analysis of financial data; the functions of the human resources management department include but are not limited to personnel management, salary management, performance management, training management and other functions, to support the human resources planning and management of enterprises; the functions of the supply chain management department include but are not limited to procurement management, inventory management, supplier management, logistics management and other functions, to optimize the supply chain process of enterprises; the functions of the production management department include but are not limited to production planning, production execution, quality management, equipment maintenance and other functions, to improve production efficiency and product quality; the functions of the sales management department include but are not limited to sales order management, customer relationship management (CRM), marketing management and other functions, to enhance the sales and customer service capabilities of enterprises.

[0029] For example, the registration information of visitor A and B is obtained, and based on the registration information of each visitor, it is determined that A is a staff member of the finance department and B is a staff member of the human resources department. Further, the authorized access resource set A of the business role under the finance department to which A belongs is authorized to A, and the mapping relationship between visitor A and the corresponding authorized access resource set A is obtained, and the mapping relationship is written into the resource permission table, wherein the data in the access resource set A may include general ledger data, accounts receivable data, accounts payable data, asset management data, budget management data, etc., or may only include general ledger data, accounts receivable data, accounts payable data, etc., and this application is not limited here.

[0030] Similarly, the authorized access resource set B of the business role under the human resources department to which B belongs is authorized to A, and the mapping relationship between the access personnel B and the corresponding authorized access resource set B is obtained, and the mapping relationship is written into the resource permission table, wherein the data in the access resource set B may include personnel management data, salary management data, performance management data, training management data, etc., or may only include personnel management data, salary management data, etc., which is not limited in this application.

[0031] Furthermore, in some embodiments, the authorized access resource set of the business role under the business department to which each access personnel belongs is authorized to the access personnel, including: dividing the authorized access resource data of the business role under the business department to which each access personnel belongs into multiple access resource subsets based on at least one business attribute, and aggregating the multiple access resource subsets into the authorized access resource set of the access personnel.

[0032] That is to say, the authorized access resource data contains resource data of various business attributes. In order to more clearly divide the resource information accessible to each accessing personnel, the authorized access resource data is divided into multiple access resource subsets to obtain an authorized access resource set consisting of multiple access resource subsets.

[0033] Among them, the authorized access resource data under each business department is different. For example, the authorized access resource data of the finance department can be divided into general ledger data, accounts receivable data, accounts payable data, asset management data, budget management data, etc. according to business attributes. Therefore, the authorized access resource data of the business roles under the finance department are divided into multiple access resource subsets through the user data permission setting module, such as general ledger data subset, accounts receivable data subset, accounts payable data subset, asset management data subset, budget management data subset, etc.

[0034] In this way, access users belonging to the same business department will only have the authorized access resource set under the business department, while access users who do not belong to the business department will not be able to obtain the corresponding authorized access resource set, which can accurately isolate the data permissions of each access user.

[0035] S12: according to the target access personnel's access request to the resource database, searching the resource permission table for the authorized access resource set corresponding to the target access personnel;

[0036] S13: Determine whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set;

[0037] S14: When there is at least one shared resource subset in the requested resource set, determine the at least one shared resource subset as the authorized resource data of the access request.

[0038] It can be understood that when pre-setting the scope of accessible permissions, only the data elements are isolated and risk prevention is focused on, and other factors are ignored, resulting in poor security of permission isolation. Therefore, the present application processes the resource set indicated by the access request of the target access personnel and the authorized access resource set, and determines whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set, so as to isolate data permissions for the target access personnel according to the judgment result.

[0039] If the target access person A belongs to the finance department, when the target access person A accesses the resource database A, first search the resource permission table for the authorized access resource set A of the target access person A, and then search the resource database X of the ERP system to see whether there is at least one shared resource subset with the authorized access resource set A. If so, determine at least one shared resource subset as the authorized resource data of the access request so that the target access person can access the authorized resource data.

[0040] The resource database X of the ERP system can be set through the accessed data setting module, and the data in the resource database X includes but is not limited to the data of core operating departments such as the finance department, human resources department, supply chain department, sales department and procurement department.

[0041] Further, in some embodiments, determining whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set includes: searching the resource database for whether there is an authorized access resource set that matches the target access personnel; if so, searching the resource database for at least one shared resource subset that satisfies the access request.

[0042] Exemplarily, the target access person A belongs to the finance department. When the target access person A logs into the business platform, the authorized access resource set A of the target access person A is first searched from the resource permission table, and then the resource database X of the ERP system is searched to see whether there is an authorized access resource set A' that matches the authorized access resource set A. If so, the resource database X is searched for at least one shared resource subset that meets the access request, thereby facilitating the target access person to access the authorized resource data and ensuring the security of data access.

[0043] According to the resource permission management method of the present application, when a target access person issues an access request to a resource database for data access, the authorized access resource set corresponding to the target access person is searched in a pre-created resource permission table to determine whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set. When there is at least one shared resource subset in the requested resource set, the at least one shared resource subset is determined as the authorized resource data of the access request so that the target access person can legally access the authorized resource data, thereby constructing a resource permission management strategy for different users at the fine-grained permission management level at the data level.

[0044] In some embodiments, the resource permission management method further includes: when at least one shared resource subset does not exist in the requested resource set, isolating the resource permissions of the target access personnel.

[0045] For example, if the target access person C belongs to the project management department, when the target access person C accesses the resource database C, first search the resource permission table for the authorized access resource set C of the target access person C, and then search the resource database X of the ERP system to see whether there is at least one shared resource subset with the authorized access resource set C. If not, it is determined that the target access person C cannot access the data in the resource database X, and the target access person needs to be isolated from the resource permissions.

[0046] In this way, the target visitor's access to the resource database is securely isolated to ensure the security of data access.

[0047] In some embodiments, searching a resource database for at least one shared resource subset that satisfies an access request includes: querying a resource database using a resource subset in a resource set of an access request; and determining a resource subset that hits a target access person as at least one shared resource subset.

[0048] Exemplarily, the target access person A belongs to the finance department. When the target access person A logs into the business platform, the authorized access resource set A of the target access person A is first searched from the resource permission table, and then the resource database X of the ERP system is searched to see whether there is an authorized access resource set A' that matches the authorized access resource set A. If so, the resource subset of the authorized access resource set A' is calculated and matched with the resource subset of the authorized access resource set A. If the same resource subset exists in both the authorized access resource sets A and A', the resource subset is determined to be at least one shared resource subset, and it is determined that the target access person obtains authorization permission.

[0049] On the contrary, if the same resource subset does not exist in both the authorized access resource sets A and A', it is determined that the target access person has not obtained authorization. In this way, this application isolates data permissions for users in the system more comprehensively and accurately through the calculation and matching of data feature values. Compared with traditional data permission isolation strategies, it is safer and can isolate higher program risks.

[0050] In some embodiments, determining at least one shared resource subset as authorized resource data for an access request includes: displaying operation function items of the authorized resource data in a management page logged in by a target access person from a business system.

[0051] That is to say, after the target visitor obtains authorization, the operation function items of the authorized resource data can be displayed in the management page where the target visitor logs in from the business system. For example, if the target visitor A belongs to the finance department and the target visitor A obtains authorization, when the target visitor A logs in to the business system, the operation function items of the authorized resource data (such as general ledger data, accounts receivable data, accounts payable data, asset management data, and budget management data) are displayed to the target visitor A in the management page of the business system, so that the target visitor A can obtain various data in the business system and issue corresponding bills.

[0052] In summary, when the target access personnel issues an access request to the resource database for data access, the present application searches for the authorized access resource set corresponding to the target access personnel in a pre-created resource permission table to determine whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set, and when there is at least one shared resource subset in the requested resource set, the at least one shared resource subset is determined as the authorized resource data of the access request, so that the target access personnel can legally access the authorized resource data, thereby constructing a resource permission management strategy for different users at the fine-grained permission management level at the data level.

[0053] In addition, the technical solutions of the above-mentioned embodiments of the present application can be combined with each other and are not limited here.

[0054] The resource authority management method of this embodiment can be executed by any appropriate electronic device with data processing capability, including but not limited to: a server, a mobile terminal (such as a mobile phone, a PAD, etc.) and a PC, etc.

[0055] Figure 2 The figure is a schematic diagram of the structure of a resource authority management device according to an embodiment of the present application.

[0056] like Figure 2 As shown, the resource authority management device 200 can execute Figure 1The resource authority management method comprises a resource authority management device 200 including: a creation module 201, which is used to create a resource authority table, wherein the resource authority table indicates the mapping relationship between each access person and the corresponding authorized access resource set; a search module 202, which is used to search the authorized access resource set corresponding to the target access person in the resource authority table according to the access request of the target access person to the resource database; a judgment module 203, which is used to judge whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set; and a determination module 204, which is used to determine at least one shared resource subset as the authorized resource data of the access request when there is at least one shared resource subset in the requested resource set.

[0057] In some embodiments of the present application, the resource permission management device 200 further includes an isolation module (not shown in the figure), which is used to isolate resource permissions for the target access personnel when there is no at least one shared resource subset in the requested resource set.

[0058] In some embodiments of the present application, the creation module 201 is specifically used to: obtain the registration information of each access personnel, and determine the business department to which the access personnel belongs based on the registration information of each access personnel; authorize the authorized access resource set of the business role under the business department to which each access personnel belongs to the access personnel, and obtain the mapping relationship between the access personnel and the corresponding authorized access resource set; determine the mapping relationship between each access personnel and the corresponding authorized access resource set as a resource permission table.

[0059] In some embodiments of the present application, the creation module 201 is specifically used to: divide the authorized access resource data of the business role under the business department to which each access personnel belongs into multiple access resource subsets according to at least one business attribute, and aggregate the multiple access resource subsets into an authorized access resource set for the access personnel.

[0060] In some embodiments of the present application, the judgment module 203 is specifically used to: search in the resource database whether there is an authorized access resource set matching the target access person; if yes, search in the resource database for at least one shared resource subset that satisfies the access request.

[0061] In some embodiments of the present application, the search module 202 is specifically used to: use a resource subset in the resource set of the access request to query in the resource database; and determine the resource subset that hits the target access person as at least one shared resource subset.

[0062] In some embodiments of the present application, the determination module 204 is specifically used to: display the operation function items of the authorized resource data in the management page where the target access personnel logs in from the business system.

[0063] According to the resource permission management device of the embodiment of the present application, when a target access person issues an access request to a resource database for data access, the authorized access resource set corresponding to the target access person is searched in a pre-created resource permission table to determine whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set, and when at least one shared resource subset exists in the requested resource set, the at least one shared resource subset is determined as the authorized resource data of the access request, so that the target access person can legally access the authorized resource data, thereby constructing a resource permission management strategy for different users at the fine-grained permission management level at the data level.

[0064] The resource authority management device 200 of the present embodiment is used to implement the corresponding resource authority management method in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here. In addition, the functional implementation of each module in the resource authority management device 200 of the present embodiment can refer to the description of the corresponding part in the aforementioned method embodiments, which will not be repeated here.

[0065] Figure 3 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. The specific embodiment of the present application does not limit the specific implementation of the electronic device.

[0066] like Figure 3 As shown, the electronic device 300 may include: a processor 301, a memory 302, a communication interface 303 and a communication bus 304. The processor 601, the memory 302 and the communication interface 303 communicate with each other through the communication bus 304; the memory 302 is used to store at least one executable instruction, and the executable instruction enables the processor 301 to perform the operation corresponding to the resource permission management method of any of the above embodiments.

[0067] The processor 301 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0068] The memory 302 is used to store programs, and may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0069] According to the electronic device of the embodiment of the present application, when the target access personnel issues an access request to the resource database for data access, the authorized access resource set corresponding to the target access personnel is searched in a pre-created resource permission table to determine whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set, and when there is at least one shared resource subset in the requested resource set, the at least one shared resource subset is determined as the authorized resource data of the access request, so that the target access personnel can legally access the authorized resource data, thereby constructing a resource permission management strategy for different users at the fine-grained permission management level at the data level.

[0070] An embodiment of the present application also provides a computer storage medium on which a computer program is stored. When the program is executed by a processor, the resource permission management method of any of the above embodiments is implemented.

[0071] According to the computer storage medium of the embodiment of the present application, when the target access personnel issues an access request to the resource database for data access, the authorized access resource set corresponding to the target access personnel is searched in the pre-created resource permission table to determine whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set, and when there is at least one shared resource subset in the requested resource set, the at least one shared resource subset is determined as the authorized resource data of the access request, so that the target access personnel can legally access the authorized resource data, thereby constructing a resource permission management strategy for different users at the fine-grained permission management level at the data level.

[0072] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0073] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or be implemented as software or computer code that can be stored in a recording medium (such as CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or be implemented as a computer code that is originally stored in a remote recording medium or a non-temporary machine-readable medium and will be stored in a local recording medium downloaded through a network, so that the method described here can be stored in such software processing on a recording medium using a general-purpose computer, a special-purpose processor or programmable or special-purpose hardware (such as ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (for example, RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the resource authority management method described here is implemented. In addition, when a general-purpose computer accesses a code for implementing the resource authority management method shown here, the execution of the code converts the general-purpose computer into a special-purpose computer for executing the resource authority management method shown here.

[0074] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0075] The above implementation methods are only used to illustrate the embodiments of the present application, and are not intended to limit the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application, and the scope of patent protection of the embodiments of the present application should be defined by the claims. The systems, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions.

Claims

1. A resource authority management method, characterized in that: The method comprises: Creating a resource permission table, wherein the resource permission table indicates a mapping relationship between each access person and a corresponding set of authorized access resources; According to the access request of the target access person to the resource database, searching the resource permission table for the authorized access resource set corresponding to the target access person; Determine whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set; When the at least one shared resource subset exists in the requested resource set, the at least one shared resource subset is determined as the authorized resource data of the access request.

2. The resource authority management method according to claim 1, characterized in that: The method further comprises: When the at least one shared resource subset does not exist in the requested resource set, resource authority isolation is performed on the target access personnel.

3. The resource authority management method according to claim 1, characterized in that: Create a resource permission table, including: Obtain the registration information of each visitor, and determine the business department to which the visitor belongs based on the registration information of each visitor; Authorize the authorized access resource set of the business role under the business department to which each access personnel belongs to the access personnel, and obtain the mapping relationship between the access personnel and the corresponding authorized access resource set; The mapping relationship between each access person and the corresponding authorized access resource set is determined as the resource permission table.

4. The resource authority management method according to claim 3, characterized in that: Authorize the authorized access resource set of the business role under the business department to which each access person belongs to the access person, including: According to at least one business attribute, the authorized access resource data of the business role under the business department to which each access personnel belongs is divided into multiple access resource subsets, and the multiple access resource subsets are aggregated into the authorized access resource set of the access personnel.

5. The resource authority management method according to claim 3, characterized in that: Determining whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set, comprising: Searching in the resource database whether there is an authorized access resource set matching the target access person; If yes, then searching the resource database for at least one shared resource subset that satisfies the access request.

6. The resource authority management method according to claim 5, characterized in that: Searching the resource database for at least one shared resource subset that satisfies the access request comprises: Using a subset of resources in the resource set of the access request to query the resource database; The resource subset that hits the target visitor is determined as the at least one shared resource subset.

7. The resource authority management method according to claim 1, characterized in that: Determining the at least one shared resource subset as authorized resource data for the access request includes: In the management page where the target access personnel logs in from the business system, the operation function items of the authorized resource data are displayed.

8. A resource authority management device, characterized in that: include: A creation module, used to create a resource permission table, wherein the resource permission table indicates a mapping relationship between each access person and a corresponding set of authorized access resources; A search module, used for searching the resource permission table for a set of authorized access resources corresponding to the target access personnel according to the target access personnel's access request to the resource database; The judgment module is used to judge whether the resource set requested by the access request in the resource database has at least one shared resource subset with the authorized access resource set. The determination module is configured to determine the at least one shared resource subset as the authorized resource data of the access request when the at least one shared resource subset exists in the requested resource set.

9. An electronic device, comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to the resource permission management method according to any one of claims 1-7.

10. A computer storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the resource authority management method as claimed in any one of claims 1 to 7.

Images