Dynamic authority management method and device, electronic equipment and medium

Abstract

The invention provides a dynamic permission management method and device, electronic equipment and a medium. The method comprises the following steps: configuring a user permission information table; configuring a product information table; processing the user permission information table and the product information table, and determining target permission information of each user for the product under the product dimension by combining the user identifier and the product identifier in the user permission information table and the product identifier and the product role personnel information in the product information table; responding to a received permission query instruction, and based on a query condition in the permission query instruction, obtaining target permission information matched with the query condition; performing visualization processing on the target permission information matched with the query condition, generating a target permission view corresponding to the permission query instruction, and displaying the target permission view; therefore, the accuracy of authority management is improved based on the role-product-resource corresponding related authority management method.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a method, device, electronic device and medium for dynamic management of permissions. Background Art

[0002] With the continuous development of science and technology, all walks of life are gradually moving towards informatization, and the popularization of informatization has correspondingly brought about the growth of information products. While enterprises have a large number of information products, they also have a large number of users and resources. Different users have different job responsibilities and different operating behaviors in information products, and they need different types and levels of product permissions.

[0003] As the number of users and information products in an enterprise continues to grow, the difficulty of permission management is also increasing. The same user has different permissions in multiple different information products; the same product will also grant different permissions to different users when it is open to different users; the relationship between users and information products is complex, diverse, and intertwined, and a reliable management and control system is needed to sort out the correspondence between users and product permissions. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a method, device, electronic device and medium for dynamic permission management, which can improve the accuracy of permission management.

[0005] The present invention provides a method for dynamically managing permissions, comprising the following steps:

[0006] Configure a user permission information table; the user permission information table includes the user ID, user role, permission information corresponding to the user role, permission status and product ID of the user; the permission information corresponding to the user role of the user includes multiple types of permission information;

[0007] Configure a product information table; the product information table includes product identification, product type, product role, personnel information corresponding to the product role, and different types of resource information; the personnel information corresponding to the product role includes a user identification of at least one user;

[0008] Processing the user authority information table and the product information table, combining the user ID and product ID in the user authority information table and the product ID and product role personnel information in the product information table, to determine the target authority information of each user for the product under the product dimension;

[0009] In response to receiving the permission query instruction, based on the query condition in the permission query instruction, obtaining target permission information matching the query condition;

[0010] The target permission information matching the query condition is visualized, a target permission view corresponding to the permission query instruction is generated, and the target permission view is displayed.

[0011] In some embodiments, in the dynamic permission management method, the multiple types of permission information include database permission information, host permission information, and firewall permission information;

[0012] In response to receiving the permission query instruction, based on the query condition in the permission query instruction, obtaining target permission information matching the query condition includes:

[0013] In response to a permission query instruction for permission information of a target type, based on a query condition for permission information of a target type in a query condition in the permission query instruction, target permission information of the target type matching the query condition is acquired.

[0014] In some embodiments, the method for dynamic rights management further includes:

[0015] Configure exception verification rules based on permission exceptions; the permission exceptions include: the user has permissions that are not related to the product, the user has permissions that do not match the role, and there are unattributed resources under the product;

[0016] Based on the exception verification rule, determining whether there is exception information in the target permission information that meets the exception verification rule;

[0017] Based on the abnormal information, determining the permission status of the user permission information table;

[0018] When visualizing the target permission information matching the query condition, an exception identifier for the exception information is generated, and a target permission view corresponding to the permission query instruction is generated, wherein the target permission view includes the exception identifier for the exception information.

[0019] In some embodiments, the dynamic permission management method further includes: generating a permission modification work order for the abnormal information that meets the abnormality verification rule;

[0020] Based on the permission modification work order, the user permission information table and / or the product information table are modified.

[0021] In some embodiments, in the method for dynamic rights management, the configuration of the user rights information table includes:

[0022] Obtain each type of permission information from the business system associated with each type of permission information;

[0023] Based on each type of permission information obtained, a user permission information table is configured.

[0024] In some embodiments, the dynamic permission management method further comprises: generating a permission management work order in response to a permission management operation of a user;

[0025] In response to the permission management work order, the user permission information table is updated.

[0026] In some embodiments, the dynamic authority management method further includes: configuring a spare user authority information table and a spare product information table respectively for the user authority information table and the product information table;

[0027] Configuring a preset management timing strategy; the preset management timing strategy includes alternating first preset time periods and second preset time periods;

[0028] Performing authority management based on the user authority information table and the product information table within a first preset time period, and performing data synchronization between the standby user authority information table and the standby product information table;

[0029] Within a second preset time period, authority management is performed based on the spare user authority information table and the spare product information table, and data synchronization is performed between the user authority information table and the product information table.

[0030] In some embodiments, a device for dynamic rights management is also provided, the device comprising:

[0031] The first configuration module is used to configure a user permission information table; the user permission information table includes a user ID, a user role, permission information corresponding to the user role, a permission status, and a product ID; the permission information corresponding to the user role includes multiple types of permission information;

[0032] The second configuration module is used to configure a product information table; the product information table includes a product identifier, a product type, a product role, personnel information corresponding to the product role, and different types of resource information; the personnel information corresponding to the product role includes a user identifier of at least one user;

[0033] A processing module is used to process the user authority information table and the product information table, and determine the target authority information of each user for the product under the product dimension by combining the user ID and product ID in the user authority information table and the product ID and product role personnel information in the product information table;

[0034] An acquisition module, configured to, in response to receiving a permission query instruction, acquire target permission information matching the query condition based on a query condition in the permission query instruction;

[0035] A generation module is used to visualize the target permission information matching the query condition, generate a target permission view corresponding to the permission query instruction, and display the target permission view.

[0036] In some embodiments, an electronic device is also provided, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the dynamic permission management method are performed.

[0037] In some embodiments, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the dynamic permission management method are executed.

[0038] The present application provides a method, device, electronic device and medium for dynamic management of permissions, the method configuring a user permission information table; the user permission information table includes a user ID, a user role, permission information corresponding to the user role, permission status and product ID of the user; the permission information corresponding to the user role of the user includes multiple types of permission information; configuring a product information table; the product information table includes a product ID, a product type, product role personnel information, and different types of resource information; the product role personnel information includes a user ID of at least one user; processing the user permission information table and the product information table, combining the user ID in the user permission information table, the product ID in the product information table and the product ID and Product role personnel information, determine the target permission information of each user for the product under the product dimension; respond to receiving a permission query instruction, based on the query conditions in the permission query instruction, obtain the target permission information that matches the query conditions; visualize the target permission information that matches the query conditions, generate a target permission view corresponding to the permission query instruction, and display the target permission view; thereby determining the permission measurement standards and the permission range according to different product roles, linking user permissions with products, and the products contain role information and resource information, realizing the logical closed loop of permission management, and improving the accuracy of permission management based on the management method of corresponding relevant permissions of "role-product-resource". BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A method flow chart of the method for dynamic authority management described in an embodiment of the present application is shown;

[0041] Figure 2 A schematic diagram of the structure of the dynamic authority management system described in an embodiment of the present application is shown;

[0042] Figure 3 A flowchart of the method for dynamic management of permissions described in an embodiment of the present application is shown;

[0043] Figure 4 A flowchart of a method for automatic authorization of user rights according to an embodiment of the present application is shown;

[0044] Figure 5 A flowchart of multi-table data synchronization according to an embodiment of the present application is shown;

[0045] Figure 6 A schematic diagram showing the structure of the apparatus for dynamic management of permissions according to an embodiment of the present application is shown;

[0046] Figure 7 A schematic structural diagram of an electronic device described in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0047] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0048] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0049] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0050] With the continuous development of science and technology, all walks of life are gradually moving towards informatization, and the popularization of informatization has correspondingly brought about the growth of information products. While enterprises have a large number of information products, they also have a large number of users and resources. Different users have different job responsibilities and different operating behaviors in information products, and they need different types and levels of product permissions.

[0051] As the number of users and information products in an enterprise continues to grow, the difficulty of permission management is also increasing. The same user has different permissions in multiple different information products; the same product will also grant different permissions to different users when it is open to different users; the relationship between users and information products is complex, diverse, and intertwined, and a reliable management and control system is needed to sort out the correspondence between users and product permissions.

[0052] Based on this, an embodiment of the present application provides a method, device, electronic device and medium for dynamic permission management, the method configuring a user permission information table; the user permission information table includes the user identification, user role, permission information corresponding to the user role, permission status and product identification of the user; the permission information corresponding to the user role of the user includes multiple types of permission information; configuring a product information table; the product information table includes product identification, product type, product role personnel information, and different types of resource information; the product role personnel information includes the user identification of at least one user; processing the user permission information table and the product information table, combining the user identification in the user permission information table, the product identification and the product identification in the product information table The system uses the user identification and product role personnel information to determine the target permission information of each user for the product under the product dimension; in response to receiving the permission query instruction, based on the query conditions in the permission query instruction, obtain the target permission information that matches the query conditions; visualize the target permission information that matches the query conditions, generate a target permission view corresponding to the permission query instruction, and display the target permission view; thereby determining the permission measurement standards and the permission range according to different product roles, linking user permissions with products, which contain role information and resource information, to achieve a logical closed loop of permission management, and improve the accuracy of permission management based on the management method of relevant permissions corresponding to "role-product-resource".

[0053] Please refer to Figure 1 , Figure 1 A method flow chart of the method for dynamic authority management described in an embodiment of the present application is shown; Figure 1As shown, the dynamic permission management method includes the following steps S101-S105:

[0054] S101, configuring a user authority information table; the user authority information table includes a user ID, a user role, authority information corresponding to the user role, an authority status, and a product ID; the authority information corresponding to the user role includes multiple types of authority information;

[0055] S102, configure a product information table; the product information table includes a product identifier, a product type, a product role, personnel information corresponding to the product role, and different types of resource information; the personnel information corresponding to the product role includes a user identifier of at least one user;

[0056] S103: Process the user authority information table and the product information table, and determine the target authority information of each user for the product under the product dimension by combining the user ID and product ID in the user authority information table and the product ID and product role personnel information in the product information table;

[0057] S104, in response to receiving the permission query instruction, based on the query condition in the permission query instruction, obtaining target permission information matching the query condition;

[0058] S105: Visualize the target permission information matching the query condition, generate a target permission view corresponding to the permission query instruction, and display the target permission view.

[0059] Please refer to Figure 2 The dynamic permission management method is applied to a dynamic permission management system. The dynamic permission management system 200 includes a database permission management module 201, a production host permission management module 202, and a firewall permission management module 203, which are used to manage and display different types of permission information.

[0060] In the step S101, a user permission information table is configured; the user permission information table includes the user ID, user role, permission information corresponding to the user role, permission status and product ID of the user; the permission information corresponding to the user role of the user includes multiple types of permission information.

[0061] Here, the multiple types of permission information include database permission information, host permission information and firewall permission information.

[0062] The database permission information, host permission information and firewall permission information respectively correspond to the dynamic management system including a database permission management module, a production host permission management module and a firewall permission management module, and the addition, deletion, modification and query operations of the corresponding types of permission information are implemented based on the database permission management module, the production host permission management module and the firewall permission management module.

[0063] That is to say, in response to the permission query instruction received in S104, target permission information matching the query conditions is obtained based on the query conditions in the permission query instruction, including: in response to the permission query instruction for permission information of a target type, target permission information of the target type matching the query conditions is obtained based on the query conditions for permission information of the target type in the query conditions in the permission query instruction.

[0064] The user authority information table includes the user ID, user role, authority information corresponding to the user role, authority status and product ID of the user; the authority information corresponding to the user role of the user includes multiple types of authority information.

[0065] The user identification includes user name, work number, ID, etc.; the user identification is an identifier used to uniquely identify each user in the system.

[0066] The user role defines the user's identity and responsibilities in the system. Different roles have different authority levels and authority grades. The user roles include individual, person in charge, product manager, etc.

[0067] The permission information machine is the permission range corresponding to the user role.

[0068] In some embodiments, the permission information includes: database permissions: permissions to access, modify, and delete data in the database; production host permissions: permissions to perform specific operations on the production host (such as starting, stopping services, accessing specific files, etc.); firewall permissions: permissions to configure firewall rules, view firewall logs, etc.

[0069] The permission status indicates the current status of the user permission, such as whether it is enabled, expired, suspended, etc.

[0070] The product identification associates the user rights with a specific product. Because the role, permission information, etc. of the same user in different products may be different, the user rights are associated with a specific product based on the product identification.

[0071] In some embodiments, the permission status includes normal and abnormal, which indicates whether the user has permissions irrelevant to the product or whether the user has permissions that do not match the role. When the user has permissions irrelevant to the product or has permissions that do not match the role, the permission status is abnormal.

[0072] In the step S102, a product information table is configured; the product information table includes product identification, product type, product role, personnel information corresponding to the product role, and different types of resource information; the product role personnel information includes a user identification of at least one user.

[0073] The product is an information product, such as an email system, a business system, an app, etc.

[0074] The product identifier is used to uniquely identify each information product and may be a product ID, product name, etc.

[0075] The product roles include product testing, demand manager, deployment operation, development testing, etc.

[0076] The personnel information corresponding to the product role includes a user identification of at least one user, for example, product testing includes user 001, user 002, etc., thereby establishing an authority relationship between role-product-user.

[0077] After the user authority information table and the product information table are configured, the user authority information table and the product information table are stored in a rights management database.

[0078] In step S103, the user authority information table and the product information table are processed, and the target authority information of each user for the product under the product dimension is determined by combining the user ID and product ID in the user authority information table and the product ID and product role personnel information in the product information table.

[0079] The same user has different permissions in multiple different information products; the same product will also grant different permissions to different users when it is open to use. Based on the user permission information table and product information table, the relationship between users and information products can be quickly processed.

[0080] In the step S104, in response to receiving the permission query instruction, based on the query condition in the permission query instruction, target permission information matching the query condition is acquired.

[0081] The permission dynamic management system receives and parses permission query instructions from users or applications, wherein the permission query instructions include query conditions, and the query conditions define the permission information to be obtained.

[0082] The user determines the permission query result corresponding to the permission keyword (product name, role name, resource information, etc.) according to the permission information stored in the permission management database.

[0083] In the step S105, the target permission information matching the query condition is visualized, a target permission view corresponding to the permission query instruction is generated, and the target permission view is displayed.

[0084] After filtering out the target permission information that matches the query conditions from the database query results, the results are further visualized to ensure that the information returned to the user is both accurate and easy to understand, and can clearly display the user's permissions, abnormal status of permissions, and abnormal information, to facilitate permission management.

[0085] Please refer to Figure 3 , Figure 3 A flowchart of the method for dynamic management of permissions described in an embodiment of the present application is shown; Figure 3 As shown, the method further includes the following steps S301-S304:

[0086] S301, configuring an exception verification rule based on permission exceptions; the permission exceptions include: the user has permissions that are not related to the product, the user has permissions that do not match the role, and there are unattributed resources under the product;

[0087] S302: Based on the exception verification rule, determine whether there is exception information in the target permission information that complies with the exception verification rule;

[0088] S303: Determine the permission status of the user permission information table based on the abnormal information;

[0089] S304: generating an exception identifier for the exception information when visualizing the target permission information matching the query condition, and generating a target permission view corresponding to the permission query instruction, wherein the target permission view includes the exception identifier for the exception information.

[0090] In other words, the view identifies the following situations for abnormal permissions: personnel have permissions that are not related to the product, personnel have permissions that do not match the role, and there are unattributed resources under the product; users need to regularly take management actions such as adjusting personnel roles, adjusting resource ownership, and deleting permissions based on permission information and permission status, and abnormal identification in the target permission view.

[0091] That is to say, the dynamic permission management method described in the embodiment of the present application classifies permissions, and according to different management strategies, can dynamically judge abnormalities of the current permission information and reflect them in the system permission view.

[0092] Taking the production host authority management module as an example, first of all, different roles of the product have different authorities. For example, the privileged account of the host can only be owned by the system administrator. If users of other roles have it, the authority will be marked as abnormal authority, and the user and relevant personnel will be reminded to clean it up. Secondly, when there are different production management strategies, the authority abnormality judgment can be dynamically performed by increasing the policy level to achieve accurate control, real-time reflection, and timely cleaning of abnormal authority judgment logic. Finally, the dynamic authority management method described in the embodiment of the present application will realize closed-loop management of authority by regularly tracing back abnormal authorities, automatically generating reports for abnormal authorities, and notifying relevant personnel.

[0093] Specifically, in some embodiments, the method for dynamic management of permissions further includes:

[0094] Generate a permission modification work order for the exception information that meets the exception verification rules;

[0095] Based on the permission modification work order, the user permission information table and / or the product information table are modified.

[0096] In other words, through permission modification work orders, automatic reports are generated for abnormal permissions and relevant personnel are notified, thus achieving closed-loop management of permissions.

[0097] In some embodiments, the configuration of the user authority information table includes:

[0098] Obtain each type of permission information from the business system associated with each type of permission information;

[0099] Based on each type of permission information obtained, a user permission information table is configured.

[0100] Please refer to Figure 2 , Figure 2 The shown permission dynamic management system 200 is divided into three parts, namely, database permission management module 201, production host permission management module 202, and firewall permission management module 203, which mainly display different types of permission information. The data of the database permission management module 201 comes from three different business systems, and the data of the firewall permission management module 202 and the production host permission management module 203 are both from two different business systems. The user permission information table is configured by obtaining information from the business system, which is convenient for improving the real-time and accuracy of data synchronization.

[0101] Taking the database permission management module as an example, the data sources of this module are divided into data usage permission operation platform permission data, direct database (single instance) permission data, and cloud database permission data. The data of these three modules together constitute the data of the database permission module.

[0102] The permissions in information products are determined based on the user's business division of labor, and in enterprises with a large number of users, organizational structure changes and business adjustments will be more frequent. When changes and adjustments come, how to quickly and accurately handle the permissions that change is also a thorny issue. The negligence of permission managers, insufficient system automation, or irregular processes can easily cause security risks and trigger security risks. The permission information in the embodiment of the present application comes from the business system. When a permission addition or deletion request is received from the business system, the permission information contained in the request is obtained to facilitate dynamic data updates and improve the real-time and accuracy of data synchronization.

[0103] In some embodiments, the method for dynamic rights management further includes:

[0104] Generate a permission management work order in response to the user's permission management operation;

[0105] In response to the permission management work order, the user permission information table is updated.

[0106] The user's permission management operations include adding permissions, deleting permissions, and modifying permissions.

[0107] Based on the permission management work order, automatic authorization of user permissions is realized. Users can manage their own permissions by submitting corresponding permission work orders in the system to add and delete permissions, which enables self-inspection, self-examination and self-sales of permission management.

[0108] Please refer to Figure 4 , Figure 4 A flowchart of the method for automatic authorization of user rights according to an embodiment of the present application is shown; Figure 4 As shown, when the user authorizes you to enter the user, host and account; Dynamic Permission Management System ( Figure 4 (referred to as 4a in the figure) checks whether the user has been created; if "the user has been created in 4a", the process continues to the step of querying the host information; if the user does not exist, the "create 4a user" operation is executed, that is, a new account is created; after confirming that the user has been created, the system checks whether the host already exists; if "the host has been created in 4a", it further continues to the step of querying the account information. If the host does not exist, the "create host in 4a" operation is executed; after confirming that "the host has been created in 4a", the system checks whether the account already exists. If not, the host information is queried and the account is created. If it exists, authorization is added and the process ends.

[0109] After the process is completed, the dynamic permission management system will send a message to the user, indicating that the automatic authorization has been completed.

[0110] In the embodiment of the present application, the user authority information table and the product information table are stored in the database. However, due to the different database types of different business systems, the database log files (such as MySQL binlog) cannot be opened due to security and management requirements. Some old database tables do not have timestamp fields, which brings difficulties to real-time synchronization of data. Based on this, the present invention uses a multi-table approach and utilizes all data in the entire table to synchronize, so that users will not feel it when the synchronization time is long.

[0111] In some embodiments, the method for dynamic rights management further includes:

[0112] For the user authority information table and the product information table, respectively configure a spare user authority information table and a spare product information table;

[0113] Configuring a preset management timing strategy; the preset management timing strategy includes alternating first preset time periods and second preset time periods;

[0114] Performing authority management based on the user authority information table and the product information table within a first preset time period, and performing data synchronization between the standby user authority information table and the standby product information table;

[0115] Within a second preset time period, authority management is performed based on the spare user authority information table and the spare product information table, and data synchronization is performed between the user authority information table and the product information table.

[0116] The first preset time period and the second preset time period have the same length.

[0117] Please refer to Figure 5 , Figure 5 The flowchart of multi-table data synchronization of the embodiment of the present application is shown; taking the first preset time period and the second preset time period as 30 minutes, that is, synchronization once every 30 minutes as an example, the original table and the standby table are marked as table A and table B respectively, and the directional query pointer is marked as current, through which the database table to be queried is directed; at the beginning, the directional query pointer points to table A, and the 30-minute synchronization timing strategy updates table B. After the synchronization is completed, the current pointer points to table B, and the table A is updated at the next synchronization, and the current pointer points to table A after the update is completed, and the cycle repeats. The advantage of this method is that, on the basis of ensuring the real-time performance of 30 minutes, there is no need to worry about the synchronization process affecting the data displayed by the system, because the current pointer will be modified only after the synchronization is successful, and because of the full table update mechanism, the deletion and addition of permissions will be reflected in real time to the display interface of this system, so that real-time, imperceptible and accurate data synchronization is achieved.

[0118] Based on the same inventive concept, the embodiment of the present application also provides a dynamic permission management device corresponding to the dynamic permission management method. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned dynamic permission management method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0119] Please refer to Figure 6 , Figure 6 The schematic diagram of the structure of the dynamic rights management device according to the embodiment of the present application is shown; the dynamic rights management device comprises:

[0120] The first configuration module 601 is used to configure a user permission information table; the user permission information table includes a user ID, a user role, permission information corresponding to the user role, permission status and a product ID; the permission information corresponding to the user role includes multiple types of permission information;

[0121] The second configuration module 602 is used to configure a product information table; the product information table includes a product identifier, a product type, a product role, personnel information corresponding to the product role, and different types of resource information; the personnel information corresponding to the product role includes a user identifier of at least one user;

[0122] Processing module 603 is used to process the user authority information table and the product information table, and determine the target authority information of each user for the product under the product dimension by combining the user ID and product ID in the user authority information table and the product ID and product role personnel information in the product information table;

[0123] An acquisition module 604 is used to, in response to receiving a permission query instruction, acquire target permission information matching the query condition based on the query condition in the permission query instruction;

[0124] The generation module 605 is used to visualize the target permission information matching the query condition, generate a target permission view corresponding to the permission query instruction, and display the target permission view.

[0125] In some embodiments, in the dynamic permission management device, the multiple types of permission information include database permission information, host permission information, and firewall permission information;

[0126] The acquisition module, in response to receiving the permission query instruction, acquires target permission information matching the query condition based on the query condition in the permission query instruction, specifically for:

[0127] In response to a permission query instruction for permission information of a target type, based on a query condition for permission information of a target type in a query condition in the permission query instruction, target permission information of the target type matching the query condition is acquired.

[0128] In some embodiments, the dynamic rights management device further includes:

[0129] A judgment module is used to configure abnormal verification rules based on abnormal permission conditions; the abnormal permission conditions include: the user has permissions that are irrelevant to the product, the user has permissions that do not match the role, and there are unattributed resources under the product;

[0130] Based on the exception verification rule, determining whether there is exception information in the target permission information that meets the exception verification rule;

[0131] Based on the abnormal information, determining the permission status of the user permission information table;

[0132] When visualizing the target permission information matching the query condition, an exception identifier for the exception information is generated, and a target permission view corresponding to the permission query instruction is generated, wherein the target permission view includes the exception identifier for the exception information.

[0133] In some embodiments, the dynamic rights management device further includes:

[0134] A modification module, used to generate a permission modification work order for the exception information that meets the exception verification rules;

[0135] Based on the permission modification work order, the user permission information table and / or the product information table are modified.

[0136] In some embodiments, the first configuration module in the dynamic rights management device is specifically used to:

[0137] Obtain each type of permission information from the business system associated with each type of permission information;

[0138] Based on each type of permission information obtained, a user permission information table is configured.

[0139] In some embodiments, the dynamic rights management device further includes:

[0140] An update module, used to generate a permission management work order in response to a user's permission management operation;

[0141] In response to the permission management work order, the user permission information table is updated.

[0142] In some embodiments, the dynamic rights management device further includes:

[0143] A synchronization module, configured to configure a spare user authority information table and a spare product information table respectively for the user authority information table and the product information table;

[0144] Configuring a preset management timing strategy; the preset management timing strategy includes alternating first preset time periods and second preset time periods;

[0145] Performing authority management based on the user authority information table and the product information table within a first preset time period, and performing data synchronization between the standby user authority information table and the standby product information table;

[0146] Within a second preset time period, authority management is performed based on the spare user authority information table and the spare product information table, and data synchronization is performed between the user authority information table and the product information table.

[0147] Based on the same inventive concept, an electronic device corresponding to the permission dynamic management method is also provided in the embodiment of the present application. Since the principle of solving the problem by the electronic device in the embodiment of the present application is similar to the above-mentioned permission dynamic management method in the embodiment of the present application, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0148] Please refer to Figure 7 , Figure 7 A schematic diagram of the structure of the electronic device described in an embodiment of the present application is shown; the electronic device 700 includes: a processor 702, a memory 701 and a bus, the memory 701 stores machine-readable instructions executable by the processor 702, and when the electronic device 700 is running, the processor 702 communicates with the memory 701 through the bus, and when the machine-readable instructions are executed by the processor 702, the steps of the dynamic permission management method are executed.

[0149] Based on the same inventive concept, a computer-readable storage medium corresponding to the permission dynamic management method is also provided in the embodiment of the present application. Since the principle of solving the problem by the computer-readable storage medium in the embodiment of the present application is similar to the above-mentioned permission dynamic management method in the embodiment of the present application, the implementation of the computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0150] A computer-readable storage medium stores a computer program, which executes the steps of the dynamic permission management method when executed by a processor.

[0151] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0152] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0153] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0154] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0155] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for dynamic management of permissions, characterized in that: The following steps are involved: Configure a user permission information table; the user permission information table includes the user ID, user role, permission information corresponding to the user role, permission status and product ID of the user; the permission information corresponding to the user role of the user includes multiple types of permission information; Configure a product information table; the product information table includes product identification, product type, product role, personnel information corresponding to the product role, and different types of resource information; the personnel information corresponding to the product role includes a user identification of at least one user; Processing the user authority information table and the product information table, combining the user ID and product ID in the user authority information table and the product ID and product role personnel information in the product information table, to determine the target authority information of each user for the product under the product dimension; In response to receiving the permission query instruction, based on the query condition in the permission query instruction, obtaining target permission information matching the query condition; The target permission information matching the query condition is visualized, a target permission view corresponding to the permission query instruction is generated, and the target permission view is displayed.

2. The method for dynamic management of permissions according to claim 1, characterized in that: The multiple types of permission information include database permission information, host permission information and firewall permission information; In response to receiving the permission query instruction, based on the query condition in the permission query instruction, obtaining target permission information matching the query condition includes: In response to a permission query instruction for permission information of a target type, based on a query condition for permission information of a target type in a query condition in the permission query instruction, target permission information of the target type matching the query condition is acquired.

3. The method for dynamic management of permissions according to claim 1, characterized in that: The method further comprises: Configure exception verification rules based on permission exceptions; the permission exceptions include: the user has permissions that are not related to the product, the user has permissions that do not match the role, and there are unattributed resources under the product; Based on the exception verification rule, determining whether there is exception information in the target permission information that meets the exception verification rule; Based on the abnormal information, determining the permission status of the user permission information table; When visualizing the target permission information matching the query condition, an exception identifier for the exception information is generated, and a target permission view corresponding to the permission query instruction is generated, wherein the target permission view includes the exception identifier for the exception information.

4. The method for dynamic management of permissions according to claim 3, characterized in that: The method further comprises: Generate a permission modification work order for the exception information that meets the exception verification rules; Based on the permission modification work order, the user permission information table and / or the product information table are modified.

5. The method for dynamic management of permissions according to claim 1, characterized in that: The configuration user authority information table includes: Obtain each type of permission information from the business system associated with each type of permission information; Based on each type of permission information obtained, a user permission information table is configured.

6. The method for dynamic management of permissions according to claim 1, characterized in that: The method further comprises: Generate a permission management work order in response to the user's permission management operation; In response to the permission management work order, the user permission information table is updated.

7. The method for dynamic management of permissions according to claim 1, characterized in that: The method further comprises: For the user authority information table and the product information table, respectively configure a spare user authority information table and a spare product information table; Configuring a preset management timing strategy; the preset management timing strategy includes alternating first preset time periods and second preset time periods; Performing authority management based on the user authority information table and the product information table within a first preset time period, and performing data synchronization between the standby user authority information table and the standby product information table; Within a second preset time period, authority management is performed based on the spare user authority information table and the spare product information table, and data synchronization is performed between the user authority information table and the product information table.

8. A dynamic rights management device, characterized in that: The device comprises: The first configuration module is used to configure a user permission information table; the user permission information table includes a user ID, a user role, permission information corresponding to the user role, a permission status, and a product ID; the permission information corresponding to the user role includes multiple types of permission information; The second configuration module is used to configure a product information table; the product information table includes a product identifier, a product type, a product role, personnel information corresponding to the product role, and different types of resource information; the personnel information corresponding to the product role includes a user identifier of at least one user; A processing module is used to process the user authority information table and the product information table, and determine the target authority information of each user for the product under the product dimension by combining the user ID and product ID in the user authority information table and the product ID and product role personnel information in the product information table; An acquisition module, configured to, in response to receiving a permission query instruction, acquire target permission information matching the query condition based on a query condition in the permission query instruction; A generation module is used to visualize the target permission information matching the query condition, generate a target permission view corresponding to the permission query instruction, and display the target permission view.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the dynamic permission management method as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the method for dynamic rights management as described in any one of claims 1 to 7.

Images