Access control method and device, electronic equipment and readable storage medium

Abstract

The invention relates to the technical field of digital management, and provides an access control method and device, electronic equipment and a readable storage medium. The method comprises the following steps: acquiring to-be-processed data; performing label matching processing on the to-be-processed data to obtain at least one label corresponding to the to-be-processed data; processing each label corresponding to the to-be-processed data through a preset label combination template to obtain an identifier corresponding to the to-be-processed data; obtaining access permission data corresponding to the to-be-processed data from a preset database based on the identifier corresponding to the to-be-processed data; according to the access authority data corresponding to the to-be-processed data, an access control list corresponding to the to-be-processed data is determined, and the access control list corresponding to the to-be-processed data comprises at least one piece of accessible data corresponding to the to-be-processed data; and in response to the permission calling instruction, each piece of accessible data corresponding to the to-be-processed data is sent to the current user graphical interface of the target terminal device for display, so that the flexibility and the processing efficiency are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of digital management technology, and in particular to an access control method, device, electronic device and readable storage medium. Background Art

[0002] Conventional access control methods achieve secure access to data through username and password verification, role-based permission management, and other means. However, with the growth of data volume and the diversification of data types, the traditional username and password-based verification method has the risk of password leakage and theft, and role-based permission management is difficult to achieve refined permission control when facing complex data access requirements. And it is impossible to dynamically adjust access rights according to the specific content of the data. Conventional solutions can enhance the security of username and password verification by introducing multi-factor authentication, or achieve more flexible permission management by refining the division of roles and permissions. However, the aforementioned method only divides data into fixed categories, and does not make full use of the data's label information to achieve refined permission control. This not only increases the complexity of system management, but also leads to inaccurate and untimely permission control.

[0003] It can be seen that the existing technology has the problem of poor security and flexibility of data access due to the inability to implement dynamic permission control through data tag information. Summary of the invention

[0004] In view of this, the embodiments of the present disclosure provide an access control method, device, electronic device and readable storage medium to solve the problem in the prior art that dynamic permission control cannot be achieved through data tag information, resulting in poor security and flexibility of data access.

[0005] In a first aspect of an embodiment of the present disclosure, an access control method is provided, including: acquiring data to be processed; performing label matching processing on the data to be processed to obtain at least one label corresponding to the data to be processed; processing each label corresponding to the data to be processed by a preset label combination template to obtain an identifier corresponding to the data to be processed; acquiring access permission data corresponding to the data to be processed from a preset database based on the identifier corresponding to the data to be processed; determining an access control list corresponding to the data to be processed based on the access permission data corresponding to the data to be processed, the access control list corresponding to the data to be processed containing at least one accessible data corresponding to the data to be processed; and in response to a permission call instruction, sending each accessible data corresponding to the data to be processed to the current user graphical interface of a target terminal device for display.

[0006] According to a second aspect of an embodiment of the present disclosure, an access control device is provided, including: an acquisition module for acquiring data to be processed; a first processing module for performing label matching processing on the data to be processed to obtain at least one label corresponding to the data to be processed; a second processing module for processing each label corresponding to the data to be processed by a preset label combination template to obtain an identifier corresponding to the data to be processed; a third processing module for acquiring access permission data corresponding to the data to be processed from a preset database based on the identifier corresponding to the data to be processed; a determination module for determining an access control list corresponding to the data to be processed based on the access permission data corresponding to the data to be processed, the access control list corresponding to the data to be processed containing at least one accessible data corresponding to the data to be processed; and a fourth processing module for sending each accessible data corresponding to the data to be processed to the current user graphical interface of the target terminal device for display in response to a permission call instruction.

[0007] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0008] According to a fourth aspect of an embodiment of the present disclosure, a readable storage medium is provided, which stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0009] Compared with the prior art, the disclosed embodiment has the following beneficial effects: by acquiring data to be processed and matching the data to be processed with a label, at least one label corresponding to the data to be processed is obtained, and then all the obtained labels can be combined with a preset label combination template to obtain a templated label, that is, an identifier corresponding to the data to be processed, and the access permission data corresponding to the data to be processed can be retrieved in a preset database through the obtained identifier corresponding to the data to be processed, and then, based on the access permission data corresponding to the data to be processed, an access control list corresponding to the data to be processed can be determined, and the access control list contains all accessible data corresponding to the data to be processed, and then, in response to a permission call instruction, each accessible data corresponding to the data to be processed can be displayed according to the requirements of the current user graphical interface of the target terminal device, thereby improving the refinement of access control, enhancing the dynamic processing effect, improving the access control processing efficiency, and enhancing flexibility and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0011] Figure 1 is a schematic diagram of an application scenario of an embodiment of the present disclosure;

[0012] Figure 2 It is a flowchart of an access control method provided by an embodiment of the present disclosure;

[0013] Figure 3 is a schematic diagram of the structure of an access control device provided by an embodiment of the present disclosure;

[0014] Figure 4 It is a structural schematic diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0015] In the following description, specific details such as specific system structures and technologies are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present disclosure. However, it should be clear to those skilled in the art that the present disclosure may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obstructing the description of the present disclosure with unnecessary details.

[0016] It should be noted that the user information (including but not limited to terminal device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0017] An access control method and device according to an embodiment of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0018] Figure 1 1 is a schematic diagram of an application scenario of an embodiment of the present disclosure. The application scenario may include terminal devices 1, 2 and 3, a server 4 and a network 5.

[0019] Terminal devices 1, 2 and 3 can be hardware or software. When terminal devices 1, 2 and 3 are hardware, they can be various electronic devices with display screens and supporting communication with server 4, including but not limited to smart phones, tablet computers, laptop portable computers and desktop computers, etc.; when terminal devices 1, 2 and 3 are software, they can be installed in the above electronic devices. Terminal devices 1, 2 and 3 can be implemented as multiple software or software modules, or as a single software or software module, and the embodiments of the present disclosure are not limited to this. Furthermore, various applications can be installed on terminal devices 1, 2 and 3, such as data processing applications, instant messaging tools, social platform software, search applications, shopping applications, etc.

[0020] The server 4 may be a server that provides various services, for example, a background server that receives a request sent by a terminal device that establishes a communication connection with the server, and the background server may receive and analyze the request sent by the terminal device, and generate a processing result. The server 4 may be a single server, or a server cluster composed of several servers, or a cloud computing service center, which is not limited in the embodiments of the present disclosure.

[0021] It should be noted that the server 4 can be hardware or software. When the server 4 is hardware, it can be various electronic devices that provide various services for the terminal devices 1, 2, and 3. When the server 4 is software, it can be multiple software or software modules that provide various services for the terminal devices 1, 2, and 3, or it can be a single software or software module that provides various services for the terminal devices 1, 2, and 3, and the embodiments of the present disclosure are not limited to this.

[0022] The network 5 can be a wired network connected by coaxial cable, twisted pair and optical fiber, or it can be a wireless network that can interconnect various communication devices without wiring, such as Bluetooth, Near Field Communication (NFC), infrared, etc., which is not limited in the embodiments of the present disclosure.

[0023] The user can establish a communication connection with the server 4 via the network 5 through the terminal devices 1, 2 and 3 to receive or send information, etc. Specifically, the server 4 can obtain the data to be processed through the terminal devices 1, 2 and 3, and match the data to be processed with the label to obtain at least one label corresponding to the data to be processed, and then all the obtained labels can be combined with the preset label combination template to obtain a templated label, that is, an identifier corresponding to the data to be processed, and the access permission data corresponding to the data to be processed can be retrieved in the preset database through the obtained identifier corresponding to the data to be processed, and then the access control list corresponding to the data to be processed can be determined according to the access permission data corresponding to the data to be processed, and the access control list contains all the accessible data corresponding to the data to be processed, and then the various accessible data corresponding to the data to be processed can be displayed according to the requirements of the current user graphical interface of the target terminal device in response to the permission call instruction.

[0024] It should be noted that the specific types, quantities and combinations of the terminal devices 1, 2 and 3, the server 4 and the network 5 can be adjusted according to the actual needs of the application scenario, and the embodiments of the present disclosure are not limited to this.

[0025] Figure 2 It is a flowchart of an access control method provided by an embodiment of the present disclosure. Figure 2 The access control method can be Figure 1 The server executes. Figure 2 As shown, the access control method includes:

[0026] Step 201, obtaining data to be processed.

[0027] Specifically, the user information and job attribute data authorized by the user and related to the job tag can be collected and extracted as the data to be processed through the Application Programming Interface (API) interface or database query, which are not limited here. The data to be processed includes but is not limited to the label information such as the user's channel, level, city, function, and / or position, thereby enhancing the accuracy and completeness of the data to be processed, improving the efficiency and accuracy of authority allocation, and improving response speed and flexibility.

[0028] Among them, the data to be processed can be basic information used to define and assign user roles and permissions. The data to be processed can be stored and managed through a preset data structure or database table, and can also be used for subsequent label combination logic processing, role generation, and real-time permission updates.

[0029] For example, in the dynamic authority management of port enterprises, the position data obtained through the database is the data to be processed, such as "channel" (which can be an inland waterway or a seaport channel), "level" (which can be a management level or an operational level), "city" (which can be Shanghai or Guangzhou), "function" (which can be logistics or safety), and "position" (which can be a dispatcher or a security inspector), etc.

[0030] Step 202: Perform label matching processing on the data to be processed to obtain at least one label corresponding to the data to be processed.

[0031] Specifically, through a preset label matching algorithm or rule, various attributes in the data to be processed, including but not limited to user information and / or job description, etc., can be compared and matched with defined job labels, which can be waterways, levels, cities, functions, and / or positions, etc., and then at least one relevant label corresponding to the data to be processed can be determined and extracted, thereby enhancing the accuracy and efficiency of data processing, improving the accuracy and reliability of label matching, and enhancing the degree of automation and intelligence.

[0032] The label corresponding to the data to be processed may be a label determined and extracted according to the attribute information of the data to be processed, and the label may match the defined position label. The label corresponding to the data to be processed may be obtained by comparing and matching the data to be processed with the labels in the preset label library. The label corresponding to the data to be processed may be used to characterize the position and attributes of the data to be processed in the position label system. The label corresponding to the data to be processed may be used in subsequent role generation, authority allocation, and dynamic update of authority, etc., which are not limited here.

[0033] For example, in the dynamic permission management of the port enterprise in the aforementioned embodiment, when a new employee joins the company, the job description may be "Safety Manager of Guangzhou Seaport and Waterway". The access control method may perform label matching processing on the job description of the new employee, and may obtain key information of the job description through parsing, such as "Guangzhou", "Seaport and Waterway", and "Safety Manager". The obtained key information may then be compared and matched with the defined job labels to determine and extract corresponding labels, such as "City: Guangzhou", "Waterway: Seaport and Waterway", and "Function: Security".

[0034] Step 203: Process each label corresponding to the data to be processed by using a preset label combination template to obtain an identifier corresponding to the data to be processed.

[0035] Specifically, according to a pre-set label combination template, the various labels obtained from the label matching processing of the data to be processed can be combined and processed according to the combination method and logical operation rules specified in the label combination template to obtain an identifier that can uniquely identify the data to be processed, thereby enhancing the flexibility and configurability of the label combination, improving the efficiency and accuracy of identifier generation, and enhancing scalability and maintainability.

[0036] The preset label combination template may be a rule or framework for guiding label combination and processing, and the preset label combination template may specify a method for combining multiple labels according to specific logical relationships and operation rules, so as to obtain an identifier corresponding to the data to be processed. The preset label combination template may be configured according to business needs.

[0037] The identifier corresponding to the data to be processed may be a character string or a code obtained by processing each label through a preset label combination template, and the identifier corresponding to the data to be processed may uniquely identify the data to be processed.

[0038] For example, in the dynamic rights management of the port enterprise in the aforementioned embodiment, the labels corresponding to the job description can be processed according to the preset label combination template, such as the label combination template can stipulate that the "city", "channel", and "function" labels are combined as primary keys, and the "level" and "position" labels can be added as auxiliary information. According to the preset label combination template, the labels of new employees can be combined to obtain the identifier of "Guangzhou_Seaport Channel_Dispatching_Primary_Employee".

[0039] Step 204: acquiring access permission data corresponding to the data to be processed from a preset database based on the identifier corresponding to the data to be processed.

[0040] Specifically, the identifier corresponding to the data to be processed can be used as a query condition or key value, and a query operation can be performed in a preset permission database to retrieve and obtain access permission data that matches the identifier. The preset database can be a database that stores the relationship between users or positions and their corresponding permissions. The preset database can exist in the form of a relational database or a non-relational database (Not Only SQL, NoSQL), which is not limited here. The preset database can contain a mapping relationship between the identifier corresponding to the data to be processed and the permission data. The query operation can be implemented by key value search or SQL query, thereby enhancing the accuracy and automation of permission management, improving the retrieval efficiency and accuracy of permission data, and improving the response speed and user experience.

[0041] The preset database may be a database for storing the relationship between users or positions and their corresponding permissions. The preset database may be used to store permission data, including but not limited to user identity (ID), role ID, permission ID, and / or resource ID, etc., as well as the association between each permission data.

[0042] The access permission data corresponding to the data to be processed may be access permission information corresponding to the data to be processed and retrieved from a preset database. The access permission data corresponding to the data to be processed may include a list of resources that the user can access, the types of operations allowed to be performed, and / or a time limit for access, etc. The access permission data may be used to ensure that the user operates within the authorized scope.

[0043] For example, in the dynamic permission management of the port enterprise in the aforementioned embodiment, the identifier corresponding to the job description can be used as a query condition to search the preset database for access permission data corresponding to the new employee's position. For example, it can be retrieved that the new employee has the right to access the scheduling system related to the "Guangzhou Seaport Channel", view flight information, and issue scheduling instructions, etc. The retrieved data is the access permission data corresponding to the data to be processed.

[0044] Step 205 , determining an access control list corresponding to the data to be processed according to the access permission data corresponding to the data to be processed, wherein the access control list corresponding to the data to be processed contains at least one accessible data corresponding to the data to be processed.

[0045] Specifically, the access permission data corresponding to the data to be processed can be parsed. The access permission data can be used to characterize information such as the resource list and / or operation type that the user or position can access, which is not limited here. Then, an access control list (ACL) can be dynamically generated according to the access permission data. The access control list can be used to characterize all data resources that the data to be processed can access, thereby enhancing the granularity and flexibility of permission management, improving the accuracy and security of access control, and enhancing adaptability and scalability.

[0046] The access control list corresponding to the data to be processed may be a rule list dynamically generated according to the access permission data corresponding to the data to be processed, and the access control list corresponding to the data to be processed may be used to control the access of the data to be processed to data resources. The access control list corresponding to the data to be processed may be used to characterize the identification, access type (such as read, write, and / or execute, etc., which are not limited here) and / or access conditions and other information of all data resources that the data to be processed can access.

[0047] The accessible data corresponding to the data to be processed may be data resources that the data to be processed is authorized to access. The accessible data corresponding to the data to be processed may be dynamically determined based on the job label and permission data of the data to be processed, including but not limited to files, database records, API interfaces, and system modules.

[0048] For example, in the dynamic permission management of the port enterprise in the aforementioned embodiment, the access control method can generate an access control list for the new employee based on the access permission data. The access control list lists all data resources that the new employee can access, such as the flight information data table related to the "Guangzhou Port Channel" and the scheduling instruction publishing system module.

[0049] Step 206 , in response to the permission calling instruction, each accessible data corresponding to the data to be processed is sent to the current user graphical interface of the target terminal device for display.

[0050] Specifically, when a permission call instruction initiated by a user is received, the permission call instruction can be used to characterize the identifier or type of the data resource that the user wants to access. It is then possible to check whether the user who initiated the permission call instruction has the authority to access the data resource. If the verification is successful, the corresponding accessible data can be obtained according to the access control list corresponding to the user, and the obtained accessible data can be encapsulated and sent to the target terminal device currently being used by the user through a network communication protocol. After receiving the accessible data, the target terminal device can parse the accessible data and display it on the current user graphical interface for the user to view and operate, thereby enhancing the convenience and real-time nature of the user's access to data and improving the accuracy and interactivity of data display.

[0051] The permission call instruction may be a request initiated by a user, and the permission call instruction may be used to request access to one or more data resources. The permission call instruction may be used to characterize the user's identity information, the identifier or type of the data resource to be accessed, and other information, which is not limited here. The permission call instruction may also be used to verify the user's access rights.

[0052] The target terminal device may be a device currently being used by the user, including but not limited to a smart phone, tablet computer, laptop computer, or desktop computer, etc., which can be connected to the network and display a user graphical interface.

[0053] The current user graphical interface may be the interface displayed to the user on the target terminal device. The current user graphical interface may be used to represent a variety of user interaction elements, including but not limited to buttons, text boxes, and / or drop-down menus, etc., which are not limited here. The current user graphical interface may also be used to represent data display areas, such as charts, lists, and / or pictures, etc.

[0054] For example, in the dynamic rights management of the port enterprise in the aforementioned embodiment, if the new employee is currently using a laptop, i.e., the target terminal device, and needs to view the flight information of "Guangzhou Seaport Channel", he can click the "View Flight Information" button on the user graphical interface, i.e., the permission call instruction, and then the access control method can verify the access rights of the new employee, confirm that the new employee has the right to view the flight information of "Guangzhou Seaport Channel", and then obtain the corresponding flight information data according to the access control list and send it to the dispatcher's laptop. After receiving the corresponding flight information data, the laptop can parse it and display it on the current user graphical interface for the dispatcher to view and operate.

[0055] According to the technical solution provided by the embodiment of the present disclosure, by acquiring the data to be processed and matching the data to be processed with the label, at least one label corresponding to the data to be processed is obtained, and then all the obtained labels can be combined with a preset label combination template to obtain a templated label, that is, an identifier corresponding to the data to be processed, and the access permission data corresponding to the data to be processed can be retrieved in a preset database through the obtained identifier corresponding to the data to be processed, and then the access control list corresponding to the data to be processed can be determined according to the access permission data corresponding to the data to be processed, and the access control list contains all the accessible data corresponding to the data to be processed, and then in response to the permission call instruction, each accessible data corresponding to the data to be processed can be displayed according to the requirements of the current user graphical interface of the target terminal device, thereby improving the refinement of access control, enhancing the dynamic processing effect, improving the access control processing efficiency, and enhancing flexibility and scalability.

[0056] In some embodiments, the access control method also includes: in response to an access instruction, determining whether the access control list corresponding to the data to be processed contains the data to be accessed; if the access control list corresponding to the data to be processed contains the data to be accessed, determining to call the data to be accessed; if the access control list corresponding to the data to be processed does not contain the data to be accessed, returning preset rejection prompt data to the access instruction.

[0057] Specifically, when an access instruction is received, the access instruction can be used to characterize the data to be accessed corresponding to the user, and then the identifier of the data to be accessed in the access instruction can be extracted, and the identifier of the data to be accessed can be compared with the access control list corresponding to the data to be processed. The comparison can be performed by traversing the accessible data items in the ACL to check whether there is an item that matches the identifier of the data to be accessed. If the ACL contains the data to be accessed, it can be determined to call the data to be accessed, and the data to be accessed can be prepared to be sent to the user for display or operation. If the ACL does not contain the data to be accessed, preset rejection prompt data can be returned to the access instruction, and the preset rejection prompt data can be used to characterize the reason for the access rejection or error code and other information.

[0058] The access instruction may be a request initiated by a user, and the access instruction may be used to request access to one or more specific data resources. The access instruction may be used to represent the user's identity information and the identifier of the data resource to be accessed, and the access instruction may also be used to verify the user's access rights.

[0059] The data to be accessed may be data resources that a user requests to access through an access instruction, a file, a database record, and / or data returned by an API interface, etc.

[0060] The preset rejection prompt data may be a prompt message returned to the user when the user's access instruction is rejected by the system, including information such as the reason for the access rejection and an error code. The preset rejection prompt data may be generated by an error handling mechanism, and the preset rejection prompt data may be used to inform the user that he or she does not have permission to access the requested data resource, and may guide the user to perform subsequent operations or seek help.

[0061] For example, in the dynamic authority management of the port enterprise in the aforementioned embodiment, if an intermediate dispatcher wants to view the detailed information of a specific flight of the "Shanghai Seaport Channel" to make a scheduling decision. Then, the "View Flight Details" button can be clicked on the user graphical interface. After receiving the access instruction, the data identifier to be accessed in the access instruction can be extracted, and the data identifier can be compared with the access control list corresponding to the intermediate dispatcher. After comparison, if the ACL contains the detailed information of the flight, it can be determined to call the corresponding data resource. If the ACL does not contain the detailed information of the flight, the system can return a preset rejection prompt data to inform the intermediate dispatcher that he does not have the authority to view the detailed information of the flight, and can guide him to contact the superior administrator to apply for or inquire about the authority.

[0062] According to the technical solution provided by the embodiment of the present disclosure, when an access instruction is received, the access instruction can be used to characterize the data to be accessed corresponding to the user, and then the identifier of the data to be accessed in the access instruction can be extracted, and the identifier of the data to be accessed can be compared with the access control list corresponding to the data to be processed. If the ACL contains the data to be accessed, it can be determined to call the data to be accessed, and the data to be accessed can be prepared to be sent to the user for display or operation. If the ACL does not contain the data to be accessed, preset rejection prompt data can be returned to the access instruction, thereby enhancing the rigor and security of access control, improving the accuracy and efficiency of permission verification, and enhancing the user experience when using the dynamic permission management system.

[0063] In some embodiments, based on the access permission data corresponding to the data to be processed, an access control list corresponding to the data to be processed is determined, including: parsing the access permission data corresponding to the data to be processed to obtain a permission rule data set corresponding to the access permission data; and performing list generation processing on the permission rule data set corresponding to the access permission data to obtain an access control list corresponding to the data to be processed.

[0064] Specifically, the access permission data corresponding to the data to be processed can be parsed. The parsing process can obtain a permission rule data set by identifying, extracting, and converting each field in the access permission data. The permission rule data set can be used to characterize the identification, access type, and access conditions of all data resources that the data to be processed can access. No limitation is made here. The permission rule data set can be organized and stored in a structured manner, and then the permission rule data set can be list generated. An access control list can be generated according to the rules therein. The access control list can be used to characterize all data resources and their access conditions that the data to be processed can access.

[0065] The permission rule data set corresponding to the access permission data may be rule information obtained after parsing the access permission data corresponding to the data to be processed. The permission rule data set corresponding to the access permission data may be used to characterize the identification, access type, and access conditions of all data resources that the data to be processed can access, and is not limited here. The permission rule data set corresponding to the access permission data may be the basis for generating an access control list.

[0066] For example, in the dynamic rights management of the port enterprise in the aforementioned embodiment, the access rights data of new employees can be parsed and processed to obtain a set of rights rule data sets. The rights rule data sets can be used to characterize all flight information data tables, dispatch instruction release system modules and other information related to the "Shenzhen Seaport Channel" that the employee can access, as well as the corresponding access types and access conditions, and then an ACL can be generated according to the rules to clearly list all data resources that the employee can access and their access conditions.

[0067] According to the technical solution provided by the embodiment of the present disclosure, by parsing the access permission data corresponding to the data to be processed, a permission rule data set is obtained, and then the permission rule data set can be processed for list generation, thereby enhancing the flexibility and configurability of permission management, improving the degree of automation of access control list generation, and improving the response speed and accuracy of the dynamic permission management system.

[0068] In some embodiments, the access control method also includes: obtaining update data corresponding to the data to be processed; processing each label corresponding to the data to be processed based on the update data corresponding to the data to be processed to obtain at least one update label corresponding to the data to be processed; processing at least one update label corresponding to the data to be processed through a preset label combination template to obtain an update identifier corresponding to the data to be processed; obtaining access permission update data corresponding to the data to be processed from a preset database based on the update identifier corresponding to the data to be processed; and updating the access control list corresponding to the data to be processed according to the access permission update data corresponding to the data to be processed.

[0069] Specifically, update data corresponding to the data to be processed can be obtained, and the update data can come from the user's job change notification or the job label update event within the system, etc., which is not limited here. Then, the various labels corresponding to the data to be processed can be processed according to the update data, such as identifying the labels that need to be replaced and the labels that need to be added, and then at least one update label corresponding to the data to be processed can be obtained. The update label can be processed by a preset label combination template, and the preset label combination template can be used to define a way to combine different labels to generate a unique identifier. The update identifier corresponding to the data to be processed can be obtained, and the corresponding access permission update data can be retrieved from a preset database based on the update identifier. The access permission update data can be used to represent all permission information that the data to be processed has under the updated label combination, and then the access control list corresponding to the data to be processed can be updated according to the access permission update data to ensure that the user's permissions are consistent with his current job label.

[0070] The update data corresponding to the data to be processed may be information that causes the label or attribute of the data to be processed to change. The update data corresponding to the data to be processed may come from a user's job change or a permission update event within the system, etc., which is not limited here.

[0071] The updated tag corresponding to the data to be processed can be a new tag obtained after processing the updated data. The updated tag corresponding to the data to be processed can be used to characterize the current state or attributes of the data to be processed, including but not limited to the user's new position, new level, and / or new city and other information.

[0072] The update identifier corresponding to the data to be processed may be an identifier obtained by processing the update tag through a preset tag combination template, and the update identifier may be used to uniquely identify the current state or attribute of the data to be processed. The update identifier may be composed of multiple tags and may be used to uniquely identify a user or position.

[0073] The access permission update data corresponding to the data to be processed may be all permission information retrieved from the preset database according to the update identifier. The access permission update data corresponding to the data to be processed may be used to represent all permission information that the data to be processed should have under the updated label combination. The permission information may include access permissions and / or operation permissions to different data resources, etc., which are not limited here.

[0074] For example, in the dynamic authority management of the port enterprise in the aforementioned embodiment, if an employee of the port enterprise is promoted from "intermediate dispatcher of Guangzhou Seaport Channel" to "senior dispatcher of Shenzhen Seaport Channel", the employee's job change notification can be obtained as update data, and the new label of the employee can be obtained according to the notification processing: "Shenzhen Seaport Channel" and "senior dispatcher", and the new label can be combined into an update identifier through a preset label combination template, and then all the authority information that the employee should have after the promotion can be retrieved from the preset database based on the update identifier as access permission update data. The access control list of the employee can be updated according to the update data to ensure that he can access the data resources that match his new position after the promotion.

[0075] According to the technical solution provided by the embodiment of the present disclosure, by obtaining update data corresponding to the data to be processed, each label corresponding to the data to be processed can be processed according to the update data, and then at least one update label corresponding to the data to be processed can be obtained, and the update label can be processed by a preset label combination template to obtain an update identifier corresponding to the data to be processed, and the corresponding access permission update data can be retrieved from a preset database based on the update identifier, and then the access control list corresponding to the data to be processed can be updated according to the access permission update data, thereby enhancing the real-time and accuracy of permission management, improving the response speed to user position changes, and enhancing flexibility and maintainability.

[0076] In some embodiments, label matching processing is performed on the data to be processed to obtain at least one label corresponding to the data to be processed, including: disassembling the data to be processed to obtain at least one label element corresponding to the data to be processed; matching processing is performed on each label element corresponding to the data to be processed based on a preset combination logic to obtain at least one label corresponding to the data to be processed.

[0077] Specifically, the data to be processed can be disassembled, and the disassembly process can extract various components or attributes in the data to be processed to obtain label elements. For example, for user information, the name, department, and position can be extracted as label elements, and the label elements can be matched according to the preset combination logic. The preset combination logic can be pre-configured according to business needs or system architecture, and then at least one label corresponding to the data to be processed can be obtained, and the label can be used to characterize the key attributes or characteristics of the user or position.

[0078] The label element corresponding to the data to be processed may be each component or attribute extracted from the data to be processed during the disassembly process, and the label element may be used to characterize key information or features of the data to be processed.

[0079] The preset combination logic may be a rule or method pre-configured according to business requirements or system architecture, and the preset combination logic may be used to combine different tag elements to form a meaningful tag. The preset combination logic may be determined by analyzing business requirements, building system architecture, and considering the association between tags.

[0080] For example, in the dynamic authority management of the port enterprise in the aforementioned embodiment, if a new employee joins the port enterprise and his job description is "Senior Dispatcher of Shenzhen Port Channel", then when performing label matching processing on the job description, the job description can be disassembled to extract label elements such as "Shenzhen Port Channel", "Senior", and "Dispatcher". The label elements can be matched according to the preset combination logic to obtain labels that can be used to characterize the key attributes or characteristics of the employee's position. For example, the label elements can be combined to obtain a label of "Senior Dispatcher of Shenzhen Port Channel", or three independent labels of "Shenzhen Port Channel", "Senior", and "Dispatcher" can be generated respectively.

[0081] According to the technical solution provided by the embodiment of the present disclosure, by disassembling the data to be processed, the disassembling process can extract the various components or attributes in the data to be processed to obtain label elements, and the label elements can be matched according to the preset combination logic to obtain at least one label corresponding to the data to be processed, thereby enhancing the flexibility and accuracy of label matching, improving the ability to parse complex job descriptions, and enhancing scalability and maintainability.

[0082] In some embodiments, each label corresponding to the data to be processed is processed by a preset label combination template to obtain an identifier corresponding to the data to be processed, including: performing description matching processing on each label corresponding to the data to be processed to obtain description data corresponding to each label; processing the description data corresponding to each label based on the preset label combination template to obtain an identifier corresponding to the data to be processed.

[0083] Specifically, description matching processing can be performed on each tag, and the description matching processing can match each tag with preset description data to obtain a detailed description or attribute information of the tag. The description data can be predefined, and the description data can provide a detailed explanation or supplement to the meaning of the tag. The description data can be processed according to a preset tag combination template, and the preset tag combination template can be used to combine different description data to generate a unique identifier, that is, an identifier corresponding to the data to be processed, and the identifier can be a string or code obtained by combining the description data of multiple tags.

[0084] The descriptive data corresponding to the tag may be data associated with the tag, and the descriptive data may be used to provide a detailed explanation or supplementary information of the tag. The descriptive data may be determined by analyzing business requirements, designing system architecture, and considering the semantic features of the tag. The descriptive data includes, but is not limited to, information such as the name, definition, attributes, and / or classification of the tag.

[0085] For example, in the dynamic rights management of the port enterprise in the aforementioned embodiment, if the port enterprise has an employee assigned to the position of "intermediate dispatcher of Shenzhen Seaport Channel". When generating an identifier for the employee, the various tags in the employee's job description can be identified: "Shenzhen Seaport Channel", "intermediate", and "dispatcher", and the description matching processing can be performed on each tag to obtain the corresponding description data. For example, the description data of "Shenzhen Seaport Channel" can include information such as the geographical location of the channel, the channel type, and the department to which it belongs; the description data of "intermediate" can include information such as the scope of responsibilities and promotion conditions of this level; the description data of "dispatcher" can include information such as the responsibilities and skill requirements of the position. Then, the description data can be combined into an identifier according to a preset tag combination template, such as "SZGH-MD-DLY-001", where "SZGH" can be used to represent "Shenzhen Seaport", "MD" can be used to represent "intermediate", "DLY" can be used to represent "dispatcher", and "001" can be the employee's number.

[0086] According to the technical solution provided by the embodiment of the present disclosure, by performing description matching processing on each tag to obtain a detailed description or attribute information of the tag, the description data can be processed according to a preset tag combination template to obtain an identifier corresponding to the data to be processed, thereby enhancing the uniqueness and readability of the identifier, improving the ability to integrate tag information, and improving accuracy and efficiency.

[0087] In some embodiments, access permission data corresponding to the data to be processed is obtained from a preset database based on an identifier corresponding to the data to be processed, including: searching and processing the identifier corresponding to the data to be processed through the preset database to obtain the access permission record corresponding to the identifier; parsing and processing the access permission record corresponding to the identifier to obtain the access permission data corresponding to the data to be processed.

[0088] Specifically, the identifier corresponding to the data to be processed can be retrieved through a preset database, and the retrieval process can be implemented by searching for a record matching the identifier in an index or table of the database. The access permission record can be stored in the form of a table, and the access permission record can be used to characterize the correspondence between the identifier and the access permission, and then the access permission record can be parsed to extract the access permission data corresponding to the data to be processed. The access permission data may include a list of resources allowed to be accessed, operation permissions, and / or access time limits, etc., which are not limited here.

[0089] The access permission record corresponding to the identifier may be access permission information associated with the identifier and stored in a preset database. The access permission record corresponding to the identifier may be used to represent the mapping relationship between the identifier and the access permission, as well as specific permission information.

[0090] For example, in the dynamic rights management of the port enterprise in the aforementioned embodiment, in order to obtain the access rights data of an employee, the record matching the identifier can be retrieved in the preset database, and then the access rights record can be parsed to extract the access rights data corresponding to the employee's position. For example, the access rights record can indicate that the employee has the right to access the dispatching system related to the "Shenzhen Port Channel", view the channel status, and issue dispatching instructions. When the employee's position label changes, such as being promoted to "senior dispatcher" or adjusted to other channels, the access rights record corresponding to its identifier can be automatically updated according to the real-time update mechanism, and the corresponding permissions can be reallocated to it.

[0091] According to the technical solution provided by the embodiment of the present disclosure, the identifier corresponding to the data to be processed is retrieved and processed through a preset database to obtain the access permission record corresponding to the identifier, and then the access permission record can be parsed and processed to extract the access permission data corresponding to the data to be processed, thereby enhancing the retrieval efficiency and accuracy of the permission data, improving the dynamic management capability of user or position permissions, and enhancing security and flexibility.

[0092] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present disclosure, and will not be described in detail here.

[0093] The following are embodiments of the device disclosed herein, which can be used to execute the method embodiments disclosed herein. For details not disclosed in the device embodiments disclosed herein, please refer to the method embodiments disclosed herein.

[0094] Figure 3 Schematic diagram of an access control device provided by an embodiment of the present disclosure. Figure 3 As shown, the access control device includes:

[0095] An acquisition module 301 is used to acquire data to be processed;

[0096] The first processing module 302 is used to perform label matching processing on the data to be processed to obtain at least one label corresponding to the data to be processed;

[0097] The second processing module 303 is used to process each label corresponding to the data to be processed by using a preset label combination template to obtain an identifier corresponding to the data to be processed;

[0098] The third processing module 304 is used to obtain access permission data corresponding to the data to be processed from a preset database based on the identifier corresponding to the data to be processed;

[0099] A determination module 305, configured to determine an access control list corresponding to the data to be processed according to the access permission data corresponding to the data to be processed, wherein the access control list corresponding to the data to be processed includes at least one accessible data corresponding to the data to be processed;

[0100] The fourth processing module 306 is used to send each accessible data corresponding to the data to be processed to the current user graphical interface of the target terminal device for display in response to the permission calling instruction.

[0101] According to the technical solution provided by the embodiment of the present disclosure, the data to be processed is acquired by the acquisition module 301, and the data to be processed is matched with the label by the first processing module 302 to obtain at least one label corresponding to the data to be processed, and then all the obtained labels can be combined with the preset label combination template by the second processing module 303 to obtain a templated label, that is, an identifier corresponding to the data to be processed, and the identifier corresponding to the data to be processed obtained can be retrieved in the preset database by the third processing module 304 to obtain the access permission data corresponding to the data to be processed, and then the access control list corresponding to the data to be processed can be determined by the determination module 305 according to the access permission data corresponding to the data to be processed, and the access control list contains all the accessible data corresponding to the data to be processed, and then in response to the permission call instruction, each accessible data corresponding to the data to be processed can be displayed according to the requirements of the current user graphical interface of the target terminal device, thereby improving the refinement of access control, enhancing the dynamic processing effect, improving the access control processing efficiency, and enhancing flexibility and scalability.

[0102] In some embodiments, the access control device is also used to, in response to an access instruction, determine whether the access control list corresponding to the data to be processed contains the data to be accessed; if the access control list corresponding to the data to be processed contains the data to be accessed, determine to call the data to be accessed; if the access control list corresponding to the data to be processed does not contain the data to be accessed, return preset rejection prompt data to the access instruction.

[0103] In some embodiments, the determination module 305 is specifically used to parse the access permission data corresponding to the data to be processed to obtain a permission rule data set corresponding to the access permission data; and perform list generation processing on the permission rule data set corresponding to the access permission data to obtain an access control list corresponding to the data to be processed.

[0104] In some embodiments, the access control device is also used to obtain update data corresponding to the data to be processed; process each label corresponding to the data to be processed based on the update data corresponding to the data to be processed to obtain at least one update label corresponding to the data to be processed; process at least one update label corresponding to the data to be processed through a preset label combination template to obtain an update identifier corresponding to the data to be processed; obtain access permission update data corresponding to the data to be processed from a preset database based on the update identifier corresponding to the data to be processed; and update the access control list corresponding to the data to be processed according to the access permission update data corresponding to the data to be processed.

[0105] In some embodiments, the first processing module 302 is specifically used to disassemble the data to be processed to obtain at least one label element corresponding to the data to be processed; match the various label elements corresponding to the data to be processed based on a preset combination logic to obtain at least one label corresponding to the data to be processed.

[0106] In some embodiments, the second processing module 303 is specifically used to perform description matching processing on each label corresponding to the data to be processed to obtain description data corresponding to each label; and process the description data corresponding to each label based on a preset label combination template to obtain an identifier corresponding to the data to be processed.

[0107] In some embodiments, the third processing module 304 is specifically used to retrieve the identifier corresponding to the data to be processed through a preset database to obtain the access permission record corresponding to the identifier; and parse the access permission record corresponding to the identifier to obtain the access permission data corresponding to the data to be processed.

[0108] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure.

[0109] Figure 4 Schematic diagram of an electronic device 4 provided in an embodiment of the present disclosure. Figure 4 As shown, the electronic device 4 of this embodiment includes: a processor 401, a memory 402, and a computer program 403 stored in the memory 402 and executable on the processor 401. When the processor 401 executes the computer program 403, the steps in the above-mentioned method embodiments are implemented. Alternatively, when the processor 401 executes the computer program 403, the functions of the modules / units in the above-mentioned device embodiments are implemented.

[0110] The electronic device 4 may be a desktop computer, a notebook, a PDA, a cloud server, or other electronic device. The electronic device 4 may include, but is not limited to, a processor 401 and a memory 402. Those skilled in the art will appreciate that Figure 4 The electronic device 4 is merely an example and does not limit the electronic device 4 , and may include more or less components than those shown in the figure, or different components.

[0111] The processor 401 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0112] The memory 402 may be an internal storage unit of the electronic device 4, for example, a hard disk or memory of the electronic device 4. The memory 402 may also be an external storage device of the electronic device 4, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 4. The memory 402 may also include both an internal storage unit and an external storage device of the electronic device 4. The memory 402 is used to store computer programs and other programs and data required by the electronic device.

[0113] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0114] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium (e.g., a computer-readable storage medium). Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable storage medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0115] The above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be included in the protection scope of the present disclosure.

Claims

1. An access control method, characterized in that: include: Get the data to be processed; Performing label matching processing on the data to be processed to obtain at least one label corresponding to the data to be processed; Processing each label corresponding to the data to be processed by a preset label combination template to obtain an identifier corresponding to the data to be processed; Acquiring access permission data corresponding to the data to be processed from a preset database based on an identifier corresponding to the data to be processed; Determine, according to the access permission data corresponding to the data to be processed, an access control list corresponding to the data to be processed, wherein the access control list corresponding to the data to be processed includes at least one accessible data corresponding to the data to be processed; In response to the permission calling instruction, each accessible data corresponding to the data to be processed is sent to the current user graphical interface of the target terminal device for display.

2. The access control method according to claim 1, characterized in that: The method further comprises: In response to the access instruction, determining whether the access control list corresponding to the data to be processed contains the data to be accessed; If the access control list corresponding to the data to be processed includes the data to be accessed, determining to call the data to be accessed; If the access control list corresponding to the data to be processed does not include the data to be accessed, preset rejection prompt data is returned to the access instruction.

3. The access control method according to claim 1, characterized in that: The step of determining the access control list corresponding to the data to be processed according to the access permission data corresponding to the data to be processed includes: Parsing the access permission data corresponding to the data to be processed to obtain the permission rule data set corresponding to the access permission data; A list generation process is performed on the permission rule data set corresponding to the access permission data to obtain an access control list corresponding to the data to be processed.

4. The access control method according to claim 1, characterized in that: The method further comprises: Obtaining update data corresponding to the data to be processed; Processing each label corresponding to the data to be processed based on the update data corresponding to the data to be processed to obtain at least one update label corresponding to the data to be processed; Processing at least one update label corresponding to the data to be processed by using the preset label combination template to obtain an update identifier corresponding to the data to be processed; Acquire access permission update data corresponding to the data to be processed from the preset database based on the update identifier corresponding to the data to be processed; The access control list corresponding to the data to be processed is updated according to the access permission update data corresponding to the data to be processed.

5. The access control method according to claim 1, characterized in that: The performing label matching processing on the data to be processed to obtain at least one label corresponding to the data to be processed includes: Decomposing the data to be processed to obtain at least one tag element corresponding to the data to be processed; Based on a preset combination logic, matching processing is performed on each label element corresponding to the data to be processed to obtain at least one label corresponding to the data to be processed.

6. The access control method according to claim 1, characterized in that: The processing of each label corresponding to the data to be processed by a preset label combination template to obtain an identifier corresponding to the data to be processed includes: Perform description matching processing on each tag corresponding to the data to be processed to obtain description data corresponding to each tag; The description data corresponding to each of the labels is processed based on the preset label combination template to obtain an identifier corresponding to the data to be processed.

7. The access control method according to claim 1, characterized in that: The acquiring access permission data corresponding to the data to be processed from a preset database based on the identifier corresponding to the data to be processed includes: Retrieve the identifier corresponding to the data to be processed through the preset database to obtain the access permission record corresponding to the identifier; The access permission record corresponding to the identifier is parsed to obtain access permission data corresponding to the data to be processed.

8. An access control device, characterized in that: include: An acquisition module is used to acquire data to be processed; A first processing module, configured to perform label matching processing on the data to be processed to obtain at least one label corresponding to the data to be processed; A second processing module, used to process each label corresponding to the data to be processed by using a preset label combination template to obtain an identifier corresponding to the data to be processed; A third processing module, configured to obtain access permission data corresponding to the data to be processed from a preset database based on an identifier corresponding to the data to be processed; A determination module, configured to determine an access control list corresponding to the data to be processed according to access permission data corresponding to the data to be processed, wherein the access control list corresponding to the data to be processed includes at least one accessible data corresponding to the data to be processed; The fourth processing module is used to send each accessible data corresponding to the data to be processed to the current user graphical interface of the target terminal device for display in response to the permission calling instruction.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images