Permission detection method and device, equipment and storage medium

Abstract

The invention relates to a permission detection method and device, equipment and a storage medium, and the method comprises the steps: receiving a generation instruction for a role permission template, the generation instruction carrying target role information and a target permission set comprising a plurality of target permissions; detecting whether a plurality of target permissions in the target permission set conflict or not according to a preset conflict matrix; when a plurality of target permissions in the target permission set have conflicts, modifying the target permissions having conflicts in the target permission set to obtain a modified target permission set; and when the multiple target permissions in the modified target permission set do not conflict, generating a role permission template based on the modified target permission set. According to the method, whether the permissions in the role permission template conflict or not can be automatically detected, manual auditing is not needed, the problem that the stability of a software system is reduced due to auditing errors is avoided, and the stability of the software system is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a permission detection method, device, equipment and storage medium. Background Art

[0002] Permission management is a security mechanism of the software system, which is used to manage the user's access to and processing of specific resources in the system. Permission management can ensure that only authorized users can access specific information or perform specific operations, restrict access by unauthorized users, prevent data leakage and malicious operations, and protect the security and stability of the system.

[0003] When setting a permission template, it is necessary to manually review whether there are conflicts between permissions in the permission template, which requires the administrator to be familiar with the scope of each permission. However, software systems often have a large number of permissions. Even if the administrator understands the scope of each permission, it is easy to make mistakes in the review, resulting in conflicting permissions being configured for a permission template, thereby reducing the stability of the software system. Summary of the invention

[0004] The present application provides a permission detection method, apparatus, device and storage medium, which can automatically detect whether there is a conflict in permissions in a role permission template without manual review, thus avoiding the problem of reducing the stability of the software system due to review errors and improving the stability of the software system.

[0005] In a first aspect, the present application provides a permission detection method, the method comprising:

[0006] Receive a generation instruction for a role permission template, the generation instruction carrying target role information and a target permission set including a plurality of target permissions;

[0007] According to a preset conflict matrix, detecting whether multiple target permissions in the target permission set conflict;

[0008] When multiple target permissions in the target permission set conflict with each other, modify the target permissions in the target permission set that conflict with each other to obtain a modified target permission set;

[0009] When there is no conflict among multiple target permissions in the modified target permission set, a role permission template is generated based on the modified target permission set.

[0010] Optionally, the detecting whether there is a conflict among multiple target permissions in the target permission set according to a preset conflict matrix includes:

[0011] For all target permissions in the target permission set, any two target permissions are combined to obtain at least one target permission pair;

[0012] Determine the target index pair corresponding to each target permission pair;

[0013] According to the target index pair and a preset conflict matrix, determining whether the target permission pair corresponding to the target index pair meets a preset condition, wherein the preset condition is that there is a conflict between two target permissions in the target permission pair;

[0014] When there is a target permission pair that meets the preset condition, determining that multiple target permissions in the target permission set have a conflict;

[0015] When there is no target permission pair that meets the preset condition, it is determined that there is no conflict between the multiple target permissions in the target permission set.

[0016] Optionally, determining whether the target permission pair corresponding to the target index pair satisfies a preset condition according to the target index pair and a preset conflict matrix includes:

[0017] According to the target index pair, searching in a preset conflict matrix to determine the element corresponding to the target index pair;

[0018] When the element corresponding to the target index pair is the first identifier, determining that the target permission pair corresponding to the target index pair does not satisfy a preset condition;

[0019] When the element corresponding to the target index pair is a second identifier, it is determined that the target permission pair corresponding to the target index pair meets a preset condition.

[0020] Optionally, generating a role permission template based on the modified target permission set includes:

[0021] Get each role permission template in the preset role permission template set;

[0022] In the role information in each role permission template, detecting whether there is role information identical to the target role information;

[0023] When there is role information identical to the target role information, modify the target role information to obtain modified target role information;

[0024] When there is no role information identical to the modified target role information, a role permission template is generated according to the modified target role information and the modified target permission set.

[0025] Optionally, modifying the conflicting target permissions in the target permission set to obtain a modified target permission set includes:

[0026] Obtaining a conflicting permission pair, wherein there is a conflict between two target permissions in the conflicting permission pair;

[0027] Determine the weight corresponding to each target permission in the conflicting permission pair;

[0028] In the target permission set, the target permission with the smallest weight in the conflicting permission pair is deleted to obtain a modified target permission set.

[0029] Optionally, the method further includes:

[0030] Obtain reference role information of target users;

[0031] According to the reference role information, determine the reference role permission template to be used in the preset role permission template set;

[0032] Based on the reference role permission template, permissions for the target user are set.

[0033] Optionally, when there are multiple reference role permission templates, setting the permission of the target user based on the reference role permission template includes:

[0034] Combine the reference permissions in each reference role permission template to obtain a reference permission set;

[0035] According to a preset conflict matrix, detecting whether multiple reference permissions in the reference permission set conflict;

[0036] When multiple reference permissions in the reference permission set conflict, modify the reference permission set to obtain a modified reference permission set;

[0037] When multiple reference permissions in the modified reference permission set do not conflict, permissions for the target user are set based on the modified reference permission set.

[0038] In a second aspect, the present application provides a permission detection device, the device comprising:

[0039] A receiving unit, configured to receive a generation instruction for a role permission template, wherein the generation instruction carries target role information and a target permission set including a plurality of target permissions;

[0040] A detection unit, configured to detect whether there is a conflict between multiple target permissions in the target permission set according to a preset conflict matrix;

[0041] a modifying unit, configured to modify the conflicting target permissions in the target permission set when there are conflicts among multiple target permissions in the target permission set, so as to obtain a modified target permission set;

[0042] The generating unit is used to generate a role permission template based on the modified target permission set when there is no conflict between multiple target permissions in the modified target permission set.

[0043] Optionally, a detection unit for:

[0044] For all target permissions in the target permission set, any two target permissions are combined to obtain at least one target permission pair;

[0045] Determine the target index pair corresponding to each target permission pair;

[0046] According to the target index pair and a preset conflict matrix, determining whether the target permission pair corresponding to the target index pair meets a preset condition, wherein the preset condition is that there is a conflict between two target permissions in the target permission pair;

[0047] When there is a target permission pair that meets the preset condition, determining that multiple target permissions in the target permission set have a conflict;

[0048] When there is no target permission pair that meets the preset condition, it is determined that there is no conflict between the multiple target permissions in the target permission set.

[0049] Optionally, the detection unit is used to:

[0050] According to the target index pair, searching in a preset conflict matrix to determine the element corresponding to the target index pair;

[0051] When the element corresponding to the target index pair is the first identifier, determining that the target permission pair corresponding to the target index pair does not satisfy a preset condition;

[0052] When the element corresponding to the target index pair is a second identifier, it is determined that the target permission pair corresponding to the target index pair meets a preset condition.

[0053] Optionally, the generating unit is used to:

[0054] Get each role permission template in the preset role permission template set;

[0055] In the role information in each role permission template, detecting whether there is role information identical to the target role information;

[0056] When there is role information identical to the target role information, modify the target role information to obtain modified target role information;

[0057] When there is no role information identical to the modified target role information, a role permission template is generated according to the modified target role information and the modified target permission set.

[0058] Optionally, the modification unit is used to:

[0059] Obtaining a conflicting permission pair, wherein there is a conflict between two target permissions in the conflicting permission pair;

[0060] Determine the weight corresponding to each target permission in the conflicting permission pair;

[0061] In the target permission set, the target permission with the smallest weight in the conflicting permission pair is deleted to obtain a modified target permission set.

[0062] Optionally, the device further includes a setting unit, wherein the setting unit is configured to:

[0063] Obtain reference role information of target users;

[0064] According to the reference role information, determine the reference role permission template to be used in the preset role permission template set;

[0065] Based on the reference role permission template, permissions for the target user are set.

[0066] Optionally, the setting unit is used to:

[0067] Combine the reference permissions in each reference role permission template to obtain a reference permission set;

[0068] According to a preset conflict matrix, detecting whether multiple reference permissions in the reference permission set conflict;

[0069] When multiple reference permissions in the reference permission set conflict, modify the reference permission set to obtain a modified reference permission set;

[0070] When multiple reference permissions in the modified reference permission set do not conflict, permissions for the target user are set based on the modified reference permission set.

[0071] In a third aspect, the present application provides a permission detection device, comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; at least one memory connected to the at least one bus, wherein the processor is configured to:

[0072] Receive a generation instruction for a role permission template, the generation instruction carrying target role information and a target permission set including a plurality of target permissions;

[0073] According to a preset conflict matrix, detecting whether multiple target permissions in the target permission set conflict;

[0074] When multiple target permissions in the target permission set conflict with each other, modify the target permissions in the target permission set that conflict with each other to obtain a modified target permission set;

[0075] When there is no conflict among multiple target permissions in the modified target permission set, a role permission template is generated based on the modified target permission set.

[0076] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the above-mentioned permission detection method when executed by a processor.

[0077] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: in the embodiment of the present application, a generation instruction for a role permission template is received, and the generation instruction carries target role information and a target permission set including multiple target permissions; according to a pre-set conflict matrix, it is detected whether there are conflicts among multiple target permissions in the target permission set; when there are conflicts among multiple target permissions in the target permission set, the conflicting target permissions in the target permission set are modified to obtain a modified target permission set; when there are no conflicts among multiple target permissions in the modified target permission set, a role permission template is generated based on the modified target permission set. In summary, when it is necessary to generate a role permission template, the present application can detect whether the target permissions in the target permission set conflict according to the pre-set conflict matrix, and when there is a conflict, the conflicting target permissions are modified until the modified target permissions do not conflict. It can be seen that the present application can automatically detect whether the permissions in the role permission template conflict, without manual review, thus avoiding the problem of reducing the stability of the software system due to review errors, and improving the stability of the software system. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0079] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0080] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0081] Figure 1 A flowchart of a permission detection method provided in an embodiment of the present application;

[0082] Figure 2 A flowchart of another permission detection method provided in an embodiment of the present application;

[0083] Figure 3 A flowchart of another permission detection method provided in an embodiment of the present application;

[0084] Figure 4 A flowchart of a method for detecting role information provided in an embodiment of the present application;

[0085] Figure 5 A flowchart of a method for modifying a permission set provided in an embodiment of the present application;

[0086] Figure 6 A flowchart of a method for setting user rights provided in an embodiment of the present application;

[0087] Figure 7 A flowchart of another permission detection method provided in an embodiment of the present application;

[0088] Figure 8 A schematic diagram of a flow chart of a permission detection device provided in an embodiment of the present application;

[0089] Fig. 9 A schematic diagram of a permission detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0090] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0091] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0092] In an embodiment of the present application, when the software system is used for the first time, or when a new role permission template needs to be generated, the administrator can configure the new role permission template on the configuration page of the role permission template. The configuration page is provided with a role information setting box, a permission setting box and a template generation button, the role information is set in the role information setting box, and the permission is set in the permission setting box. When the user has set the information, the user can click the template generation button. At this time, the software system can generate a generation instruction for the role permission template according to the information on the configuration page. For the convenience of distinction, the application refers to the role information in the generation instruction as the target role information, the permission in the generation instruction as the target permission, and the set composed of the target permissions as the target permission set. After that, the software system can automatically detect the target permissions in the target permission set to determine whether there are conflicts among multiple target permissions, and when there are conflicts among multiple target permissions, modify the target permission set so that there are no conflicts among the target permissions in the modified target permission set, thereby making the target permissions in the newly generated role permission template not conflicting.

[0093] The above software systems are systems involving permission management, such as office automation systems involving document management permissions and process approval permissions, customer relationship management systems involving customer information access permissions and sales data permissions, etc. In these systems, only users who have completed identity authentication can use the software system, otherwise they will jump to the identity authentication interface to complete the identity authentication of the user. Identity authentication supports authentication methods such as public account transfers and corporate business license uploads. At the beginning of use, the enterprise administrator can complete the enterprise identity authentication to open the enterprise account center and apply to become an enterprise super administrator. After the cloud service provider's backend review, the user becomes the enterprise super administrator. The enterprise super administrator invites subordinate members through an invitation system and has the highest authority, such as modifying login passwords, mobile phone numbers, login emails, MFA and other security-related configurations. After that, the enterprise super administrator can set permissions for the members he invited.

[0094] In summary, the embodiment of the present application provides a permission detection method, which can automatically detect whether the permissions in the role permission template conflict, without manual review, thus avoiding the problem of reducing the stability of the software system due to review errors, and improving the stability of the software system. Figure 1 As shown, the specific steps include:

[0095] Step 101, receiving a generation instruction for a role permission template.

[0096] The generation instruction carries target role information and a target permission set including multiple target permissions. The role information includes at least information that uniquely identifies the role, such as the role name, and may also include information related to the role, such as the work content that the role is responsible for.

[0097] In this step, when the user clicks the template generation button, the software system can obtain the target role information and multiple target permissions on the configuration page, group these target permissions into a target permission set, and generate generation instructions for the role permission template based on the target role information and the target permission set.

[0098] Step 102: Detect whether there are conflicts among multiple target permissions in the target permission set according to a preset conflict matrix.

[0099] In this step, due to errors in settings by administrators, conflicts may occur between multiple target permissions in the generated instructions. Therefore, the software system can detect whether there are conflicts between multiple target permissions in the target permission set based on a preset conflict matrix.

[0100] Step 103: when multiple target permissions in the target permission set conflict, modify the conflicting target permissions in the target permission set to obtain a modified target permission set.

[0101] In this step, when multiple target permissions in the target permission set conflict, the technician can be reminded to modify the target permission set to obtain a modified target permission set. For example, the technician is reminded to delete the conflicting target permissions to implement the target permission set. Of course, a permission modification strategy is set in the software system, so that when multiple target permissions in the target permission set conflict, the software system can modify the target permission set according to the permission modification strategy to obtain a modified target permission set.

[0102] Step 104 : when there is no conflict between multiple target permissions in the modified target permission set, a role permission template is generated based on the modified target permission set.

[0103] In this step, after obtaining the modified target permission set, the permission conflict detection method is repeatedly executed until multiple target instructions in the modified target permission set do not conflict. When multiple target permissions in the modified target permission set do not conflict, the software system generates a role permission template based on the modified target permission set.

[0104] It should be noted that when executing the permission detection step, the role information can also be detected. When the detection fails, the role information is modified until the modified role information passes the detection. Finally, when there is no conflict between multiple target permissions in the modified target permission set and the role information detection passes, a role permission template is generated based on the modified target permission set and the role information that passes the detection. Of course, when there is no conflict between multiple target permissions in the updated generation instruction, the role information in the updated generation instruction can be detected. When the detection fails, the role information is modified until the modified role information detection passes. Finally, a role permission template is generated based on non-conflicting target permissions and role information that passes the detection.

[0105] The above method for detecting role information can detect whether the role information is comprehensive, for example, the role information needs to include the role name and the role's work information, or it can detect whether the role information is a duplicate of existing role information. For example, detect whether the target role information is existing role information.

[0106] In an embodiment of the present application, a generation instruction for a role permission template is received, the generation instruction carries target role information and a target permission set including multiple target permissions; according to a pre-set conflict matrix, it is detected whether there are conflicts among multiple target permissions in the target permission set; when there are conflicts among multiple target permissions in the target permission set, the conflicting target permissions in the target permission set are modified to obtain a modified target permission set; when there are no conflicts among multiple target permissions in the modified target permission set, a role permission template is generated based on the modified target permission set. In summary, when it is necessary to generate a role permission template, the present application can detect whether the target permissions in the target permission set conflict according to a pre-set conflict matrix, and when there is a conflict, the conflicting target permissions are modified until the modified target permissions do not conflict. It can be seen that the present application can automatically detect whether the permissions in the role permission template conflict, without manual review, thus avoiding the problem of reducing the stability of the software system due to review errors, and improving the stability of the software system.

[0107] In the embodiment of the present application, the software system can also detect whether multiple target permissions in the target permission set conflict according to a preset conflict matrix. Therefore, the embodiment of the present application provides a permission detection method, which is a further limitation of step 102, such as Figure 2 As shown, the specific steps include:

[0108] Step 201 : for all target permissions in the target permission set, any two target permissions are combined to obtain at least one target permission pair.

[0109] In this step, the software system obtains all target instructions in the target permission set, combines these instructions in pairs, and obtains at least one target permission pair.

[0110] For example, the target authority includes target authority 1, target authority 2, and target authority 3. These target authorities are combined in pairs, and the target authority pairs obtained are target authority 1 and target authority 2, target authority 2 and target authority 3, and target authority 1 and target authority 3.

[0111] Step 202: Determine the target index pair corresponding to each target permission pair.

[0112] The target index pair includes two target index numbers, and the two target index numbers are used to find corresponding elements in the conflict matrix.

[0113] In this step, for each target permission pair, the software system can determine the target index numbers corresponding to the two target permissions respectively according to the two target permissions in the target permission pair and the correspondence between the preset permissions and index numbers, and form a target index pair with the two target index numbers. Based on the above, the software system can determine the target index pair corresponding to each target permission pair.

[0114] Step 203: Determine whether the target permission pair corresponding to the target index pair meets a preset condition according to the target index pair and a preset conflict matrix.

[0115] The preset condition is that there is a conflict between two target permissions in the target permission pair.

[0116] In this step, based on the target index pair and the preset conflict matrix, it is detected whether there is a conflict between the two target permissions in the target permission pair corresponding to the target index pair. When there is a conflict, it is determined that the target permission pair corresponding to the target index pair meets the preset conditions. When there is no conflict, it is determined that the target permission pair corresponding to the target index pair does not meet the preset conditions.

[0117] Step 204: When there is a target permission pair that meets the preset condition, it is determined that multiple target permissions in the target permission set conflict.

[0118] In this step, when there is a target permission pair that meets the preset conditions, it means that there are conflicting target instructions among the multiple target instructions. Therefore, the software system can determine that there are conflicts among the multiple target permissions in the target permission set.

[0119] Step 205: When there is no target permission pair that meets the preset condition, it is determined that there is no conflict between the multiple target permissions in the target permission set.

[0120] In this step, when there is no target permission pair that meets the preset conditions, it means that there is no conflicting target instruction among the multiple target instructions. Therefore, the software system can determine that there is no conflict among the multiple target permissions in the target permission set.

[0121] In the embodiment of the present application, the software system can also determine whether the target permission pair corresponding to the target index pair meets the preset conditions according to the target index pair and the preset conflict matrix. Therefore, the embodiment of the present application provides a permission detection method, which is a further limitation of step 203, such as Figure 3 As shown, the specific steps include:

[0122] Step 301 : searching in a preset conflict matrix according to a target index pair to determine an element corresponding to the target index pair.

[0123] The elements include conflicting identifiers, non-conflicting identifiers, and invalid identifiers.

[0124] In this step, according to the target index pair, the corresponding position is found in the conflict matrix, and the element at the position is obtained to obtain the element corresponding to the target index pair.

[0125] Assume that the software system includes bill management authority P1, bill viewing authority P2, prohibited bill management authority P3, prohibited bill viewing authority P4, order management authority P5 and prohibited order management authority P6. Among them, the index number corresponding to P1 is 1, the index number corresponding to P2 is 2, the index number corresponding to P3 is 3, the index number corresponding to P4 is 4, the index number corresponding to P5 is 5 and the index number corresponding to P6 is 6. The preset conflict matrix M is:

[0126] Among them, N means no conflict, and C means conflict.

[0127] Assume that the target permission set S = {P1, P2, P3}. Combine the permissions in the set in pairs, and the target permission pairs are P1 P2, P2 P3, and P1 P3. Since the index numbers corresponding to P1 P2 are 1 and 2 respectively, the element corresponding to the 1st row and 2nd column can be obtained, which is N. Therefore, P1 and P2 do not conflict. Since the index numbers corresponding to P1 P3 are 1 and 3 respectively, the element corresponding to the 1st row and 3rd column can be obtained, which is C. Therefore, P1 and P3 conflict. Since the index numbers corresponding to P2 P3 are 2 and 3 respectively, the element corresponding to the 2nd row and 3rd column can be obtained, which is N. Therefore, P2 and P3 do not conflict.

[0128] Step 302: When the element corresponding to the target index pair is the first identifier, it is determined that the target permission pair corresponding to the target index pair does not satisfy a preset condition.

[0129] Among them, the first identifier is a non-conflicting identifier, which is used to indicate that the two target permissions in the target permission pair corresponding to the identifier do not conflict.

[0130] In this step, when the element corresponding to the target index pair is the first identifier, the software system determines that the two target permissions in the target permission pair corresponding to the target index pair do not conflict, that is, the target permission pair corresponding to the target index pair does not meet the preset conditions.

[0131] Step 303: When the element corresponding to the target index pair is the second identifier, it is determined that the target permission pair corresponding to the target index pair meets a preset condition.

[0132] The second identifier is a conflict identifier, which is used to indicate that two target permissions in the target permission pair corresponding to the identifier conflict.

[0133] In this step, when the element corresponding to the target index pair is the second identifier, the software system determines that two target permissions in the target permission pair corresponding to the target index pair conflict, that is, the target permission pair corresponding to the target index pair meets the preset condition.

[0134] In the embodiment of the present application, the software system can also detect whether the target role information is the existing role information. If the target role information is the existing role information, the target role information is modified to avoid duplication of the target role information and the existing role information. Therefore, the embodiment of the present application provides a role information detection method. Figure 4 As shown, the specific steps include:

[0135] Step 401, obtaining each role permission template in the preset role permission template set.

[0136] Among them, the role permission template set is obtained based on the generation instructions of the historical time period. Specifically, each time a generation instruction is received, the software system generates a corresponding role permission template based on the generation instruction and puts the role permission template into the role permission template set.

[0137] In this step, the software system obtains a preset role permission template set, and obtains each role permission template in the role permission template set.

[0138] Step 402, in the role information in each role permission template, it is detected whether there is role information that is the same as the target role information.

[0139] In this step, if the role information is only the role name, then in each role permission template, the role name corresponding to each role permission template is obtained, and it is detected whether there is a role name identical to the target role name among these role names. If the role information includes multiple information, after obtaining the role information corresponding to each role permission template, these role information and multiple information in the target role information are compared one by one to detect whether there is role information identical to the target role information among these role information.

[0140] Step 403: When there is role information identical to the target role information, the target role information is modified to obtain the modified target role information.

[0141] In this step, if the role information includes a role name, when there is a role name identical to the target role name, the target role name can be modified according to the first preset rule to obtain the modified target role name. The first preset rule can be to obtain the current time point, add the current time point to the target role name, and obtain the modified target role name. Of course, the first preset rule can also be other role name modification rules, which are not limited here. Of course, when there is role information identical to the target role information, the software system can also generate a role information duplication message, and the role information duplication information includes the reason for the role information duplication, such as the reason can be that XX information in the target role information is the same as XX information in the role information corresponding to the XX role authority template. The role information duplication message is then displayed so that the user can modify the target role information according to the reason in the role information duplication information to obtain the modified target role information.

[0142] Step 404 , when there is no role information identical to the modified target role information, a role permission template is generated according to the modified target role information and the modified target permission set.

[0143] In this step, when there is no role information identical to the modified target role information, the software system generates a role permission template according to the modified target role information and the modified target permission set.

[0144] In the embodiment of the present application, the software system modifies the conflicting target permissions in the target permission set to obtain a modified target permission set. Therefore, the embodiment of the present application provides a method for modifying a permission set. Figure 5 As shown, the specific steps include:

[0145] Step 501, obtaining conflicting permission pairs.

[0146] Among them, there is a conflict between the two target permissions in the conflicting permission pair.

[0147] In this step, the software system may obtain a target index pair whose corresponding element is the second identifier, and determine the target permission pair corresponding to the target index pair as a conflicting permission pair.

[0148] Step 502: Determine the weight corresponding to each target permission in the conflicting permission pair.

[0149] In this step, the weight of the permission can be the frequency of the permission appearing in the role template, that is, the frequency of use of the permission, or it can be pre-set by the technician for the permission based on experience. When the weight of the permission is the frequency of use of the permission, the software system can calculate the frequency of appearance of each target permission in the conflicting permission pair in the role template, and determine the frequency of appearance as the weight corresponding to each target permission in the conflicting permission pair. When the weight of the permission is set by the technician based on experience, the software system can obtain the weight corresponding to each target permission in the conflicting permission pair.

[0150] Step 503: In the target permission set, delete the target permission with the smallest weight in the conflicting permission pair to obtain a modified target permission set.

[0151] For example, the conflicting permission pair includes conflicting permission pair 1 and conflicting permission pair 2, conflicting permission pair 1 includes target permission 1 and target permission 2, and conflicting permission pair 2 includes target permission 3 and target permission 4, wherein the weight corresponding to target permission 1 is 0.6, the weight corresponding to target permission 2 is 0.5, the weight corresponding to target permission 3 is 0.4, and the weight corresponding to target permission 4 is 0.2. In conflicting permission pair 1, since the weight corresponding to target permission 2 is the smallest, target permission 2 is deleted. In conflicting permission pair 2, since the weight corresponding to target permission 4 is the smallest, target permission 4 is deleted. After deleting target permission 2 and target permission 4 in the target permission set, the modified target permission set is obtained.

[0152] In an embodiment of the present application, the software system can also receive permission setting instructions for the target user and display a permission setting page, which includes at least a template setting entry and a confirmation button. The template set in the template setting entry can be determined based on the role information of the target user, or it can be set by the administrator for the target user, which is not limited here. Multiple templates can be set in the template setting entry, or only one template can be set, which is not limited here. When a trigger operation of the confirmation button is received, the software system can obtain the template set in the template setting entry, and set the permissions of the target user based on these templates. Therefore, an embodiment of the present application provides a user permission setting method, such as Figure 6 As shown, the specific steps include:

[0153] Step 601: Obtain reference role information of a target user.

[0154] The target user is a user for whom permissions need to be set, for example, a new user for whom permissions have not yet been set.

[0155] In this step, when the software system receives a trigger operation of the confirmation button, the software system may obtain the reference role information of the target user to determine the reference role permission template based on the reference role information.

[0156] Step 602: Determine a reference role permission template to be used from a preset role permission template set according to the reference role information.

[0157] In this step, since each role permission template includes role information and at least one permission, the software system can obtain an existing role permission template from the preset role permission template set, and then compare the reference role information with the role information in the existing role permission template, and determine the role permission template where the compared role information is located as the reference role permission template to be used.

[0158] Step 603: Setting the permissions of the target user based on the reference role permission template.

[0159] In this step, when the administrator does not add a template set in the template setting entry and receives a trigger instruction of the confirmation button, the software system can only set the permissions of the target user according to the permissions in the reference role permission template. When the administrator adds a template set in the template setting entry and receives a trigger instruction of the confirmation button, the software system can only set the permissions of the target user according to the reference role permission template and the added role permission template.

[0160] Therefore, when the software system receives the trigger instruction of the confirmation button, it can also detect the number of setting templates in the template setting entry. When the number is one, the software system directly sets the permissions of the target user based on the permissions in the reference role permission template. When the number is multiple, the software system needs to detect the permissions in multiple role permission templates to determine whether these permissions conflict. Therefore, the embodiment of the present application provides a permission detection method, which is as follows: Figure 7 As shown, the specific steps include:

[0161] Step 701, combine the reference permissions in each reference role permission template to obtain a reference permission set.

[0162] In this step, the software system obtains the permissions in each reference role permission template, determines the permissions as reference permissions, and combines these reference permissions to obtain a reference permission set.

[0163] Step 702: Detect whether multiple reference permissions in the reference permission set conflict with each other according to a preset conflict matrix.

[0164] This step is similar to the step described in 102 and is not limited to one by one here.

[0165] Step 703: When multiple reference permissions in the reference permission set conflict, the reference permission set is modified to obtain a modified reference permission set.

[0166] In this step, when multiple reference permissions in the reference permission set conflict, a conflict prompt message can be generated and displayed to remind the administrator so that the administrator can modify the reference permission set to obtain a modified reference permission set. Of course, it is also possible to determine the reference permission pair with conflict, delete the reference permission with a smaller weight in the reference permission pair, and obtain a modified reference permission set.

[0167] It should be noted that when multiple reference permissions in the reference permission set do not conflict, the software system sets permissions for the target user according to the reference permission set.

[0168] Step 704: When the multiple reference permissions of the modified reference permissions do not conflict, the permissions of the target user are set based on the modified reference permission set.

[0169] In this step, when multiple reference permissions of the modified reference permissions do not conflict, permissions for the target user are set based on the modified reference permission set.

[0170] In an embodiment of the present application, a permission setting entry is also provided on the permission setting page, and the user can set permissions for the target user separately in the permission setting entry, for example, a permission selection box. When the software system receives a trigger instruction of the confirmation button, the software system not only detects the number of templates set in the template setting entry, but also detects the permissions set in the permission setting entry. When the number is one and no permissions are set in the permission setting entry, the software system directly sets the permissions of the target user based on the permissions in the reference role permission template. When the number is multiple, or permissions are set in the permission setting entry, the software system needs to detect whether there is a conflict between these permissions, as described in the above-mentioned conflict detection method.

[0171] like Figure 8 As shown, an embodiment of the present application provides a permission detection device, which corresponds to the method embodiment and specifically includes:

[0172] The receiving unit 801 is used to receive a generation instruction for a role permission template, wherein the generation instruction carries target role information and a target permission set including multiple target permissions;

[0173] A detection unit 802 is used to detect whether there are conflicts among multiple target permissions in the target permission set according to a preset conflict matrix;

[0174] A modifying unit 803, configured to modify the conflicting target permissions in the target permission set when there are conflicts among multiple target permissions in the target permission set, to obtain a modified target permission set;

[0175] The generating unit 804 is used to generate a role permission template based on the modified target permission set when there is no conflict between multiple target permissions in the modified target permission set.

[0176] Optionally, the detection unit 802 is used to:

[0177] For all target permissions in the target permission set, any two target permissions are combined to obtain at least one target permission pair;

[0178] Determine the target index pair corresponding to each target permission pair;

[0179] According to the target index pair and a preset conflict matrix, determining whether the target permission pair corresponding to the target index pair meets a preset condition, wherein the preset condition is that there is a conflict between two target permissions in the target permission pair;

[0180] When there is a target permission pair that meets the preset condition, determining that multiple target permissions in the target permission set have a conflict;

[0181] When there is no target permission pair that meets the preset condition, it is determined that there is no conflict between the multiple target permissions in the target permission set.

[0182] Optionally, the detection unit 802 is used to:

[0183] According to the target index pair, searching in a preset conflict matrix to determine the element corresponding to the target index pair;

[0184] When the element corresponding to the target index pair is the first identifier, determining that the target permission pair corresponding to the target index pair does not satisfy a preset condition;

[0185] When the element corresponding to the target index pair is a second identifier, it is determined that the target permission pair corresponding to the target index pair meets a preset condition.

[0186] Optionally, the generating unit 804 is configured to:

[0187] Get each role permission template in the preset role permission template set;

[0188] In the role information in each role permission template, detecting whether there is role information identical to the target role information;

[0189] When there is role information identical to the target role information, modify the target role information to obtain modified target role information;

[0190] When there is no role information identical to the modified target role information, a role permission template is generated according to the modified target role information and the modified target permission set.

[0191] Optionally, the modifying unit 803 is used to:

[0192] Obtaining a conflicting permission pair, wherein there is a conflict between two target permissions in the conflicting permission pair;

[0193] Determine the weight corresponding to each target permission in the conflicting permission pair;

[0194] In the target permission set, the target permission with the smallest weight in the conflicting permission pair is deleted to obtain a modified target permission set.

[0195] Optionally, the device further includes a setting unit 805, wherein the setting unit 805 is configured to:

[0196] Obtain reference role information of target users;

[0197] According to the reference role information, determine the reference role permission template to be used in the preset role permission template set;

[0198] Based on the reference role permission template, permissions for the target user are set.

[0199] Optionally, the setting unit 805 is used to:

[0200] Combine the reference permissions in each reference role permission template to obtain a reference permission set;

[0201] According to a preset conflict matrix, detecting whether multiple reference permissions in the reference permission set conflict;

[0202] When multiple reference permissions in the reference permission set conflict, modify the reference permission set to obtain a modified reference permission set;

[0203] When multiple reference permissions in the modified reference permission set do not conflict, permissions for the target user are set based on the modified reference permission set.

[0204] like Fig. 9As shown, the embodiment of the present application provides a permission detection device, including a processor 901, a communication interface 902, a memory 903 and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other through the communication bus 904.

[0205] Memory 903, used for storing computer programs;

[0206] In one embodiment of the present application, the processor 901 is used to implement the permission detection method provided by any one of the aforementioned method embodiments when executing the program stored in the memory 903, including:

[0207] Receive a generation instruction for a role permission template, the generation instruction carrying target role information and a target permission set including a plurality of target permissions;

[0208] According to a preset conflict matrix, detecting whether multiple target permissions in the target permission set conflict;

[0209] When multiple target permissions in the target permission set conflict with each other, modify the target permissions in the target permission set that conflict with each other to obtain a modified target permission set;

[0210] When there is no conflict among multiple target permissions in the modified target permission set, a role permission template is generated based on the modified target permission set.

[0211] An embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps performed by the permission detection method provided in any of the aforementioned method embodiments are implemented.

[0212] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0213] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0214] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0215] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A permission detection method, characterized in that: The method comprises: Receiving a generation instruction for a role permission template, the generation instruction carrying target role information and a target permission set including a plurality of target permissions; According to a preset conflict matrix, detecting whether multiple target permissions in the target permission set conflict; When multiple target permissions in the target permission set conflict with each other, modify the target permissions in the target permission set that conflict with each other to obtain a modified target permission set; When there is no conflict between multiple target permissions in the modified target permission set, a role permission template is generated based on the modified target permission set.

2. The method according to claim 1, characterized in that: The detecting whether there are conflicts among the plurality of target permissions in the target permission set according to a preset conflict matrix comprises: For all target permissions in the target permission set, any two target permissions are combined to obtain at least one target permission pair; Determine the target index pair corresponding to each target permission pair; According to the target index pair and a preset conflict matrix, determining whether the target permission pair corresponding to the target index pair meets a preset condition, wherein the preset condition is that there is a conflict between two target permissions in the target permission pair; When there is a target permission pair that meets the preset condition, determining that multiple target permissions in the target permission set have a conflict; When there is no target permission pair that meets the preset condition, it is determined that there is no conflict between the multiple target permissions in the target permission set.

3. The method according to claim 2, characterized in that: The determining, according to the target index pair and a preset conflict matrix, whether the target permission pair corresponding to the target index pair satisfies a preset condition includes: According to the target index pair, searching in a preset conflict matrix to determine the element corresponding to the target index pair; When the element corresponding to the target index pair is the first identifier, determining that the target permission pair corresponding to the target index pair does not satisfy a preset condition; When the element corresponding to the target index pair is a second identifier, it is determined that the target permission pair corresponding to the target index pair meets a preset condition.

4. The method according to claim 1, characterized in that: The step of generating a role permission template based on the modified target permission set includes: Get each role permission template in the preset role permission template set; In the role information in each role permission template, detecting whether there is role information identical to the target role information; When there is role information identical to the target role information, modify the target role information to obtain modified target role information; When there is no role information identical to the modified target role information, a role permission template is generated according to the modified target role information and the modified target permission set.

5. The method according to claim 2, characterized in that: The step of modifying the conflicting target permissions in the target permission set to obtain a modified target permission set includes: Obtaining a conflicting permission pair, wherein there is a conflict between two target permissions in the conflicting permission pair; Determine the weight corresponding to each target permission in the conflicting permission pair; In the target permission set, the target permission with the smallest weight in the conflicting permission pair is deleted to obtain a modified target permission set.

6. The method according to claim 1, characterized in that: The method further comprises: Obtain reference role information of target users; According to the reference role information, determine the reference role permission template to be used in the preset role permission template set; Based on the reference role permission template, permissions for the target user are set.

7. The method according to claim 6, characterized in that: When there are multiple reference role permission templates, setting the permission of the target user based on the reference role permission template includes: Combine the reference permissions in each reference role permission template to obtain a reference permission set; According to a preset conflict matrix, detecting whether multiple reference permissions in the reference permission set conflict; When multiple reference permissions in the reference permission set conflict, modify the reference permission set to obtain a modified reference permission set; When multiple reference permissions in the modified reference permission set do not conflict, permissions for the target user are set based on the modified reference permission set.

8. A permission detection device, characterized in that: The device comprises: A receiving unit, configured to receive a generation instruction for a role permission template, wherein the generation instruction carries target role information and a target permission set including a plurality of target permissions; A detection unit, configured to detect whether there is a conflict between multiple target permissions in the target permission set according to a preset conflict matrix; a modifying unit, configured to modify the conflicting target permissions in the target permission set when there are conflicts among multiple target permissions in the target permission set, so as to obtain a modified target permission set; The generating unit is used to generate a role permission template based on the modified target permission set when there is no conflict between multiple target permissions in the modified target permission set.

9. A permission detection device, characterized in that: include: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; at least one memory connected to the at least one bus, wherein the processor is configured to: Receiving a generation instruction for a role permission template, the generation instruction carrying target role information and a target permission set including a plurality of target permissions; According to a preset conflict matrix, detecting whether multiple target permissions in the target permission set conflict; When multiple target permissions in the target permission set conflict with each other, modify the target permissions in the target permission set that conflict with each other to obtain a modified target permission set; When there is no conflict between multiple target permissions in the modified target permission set, a role permission template is generated based on the modified target permission set.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the permission detection method according to any one of claims 1 to 7 is implemented.

Images