System authority management method and device, equipment, medium and product

Abstract

The invention discloses a system authority management method, device and equipment, a medium and a product, relates to the technical field of data processing and the technical field of network security, and can be applied to the field of financial science and technology. Responding to a system login operation of the employee on the target system; employee login information of the employee is acquired; the employee login information comprises a target login IP, a target MAC address and employee basic information; determining the system authority of the employee according to the employee login information; the system authority comprises a system menu authority, an operation authority and a client information access authority. By means of the technical scheme, system authority management is achieved, and then system safety is improved.

Description

Technical Field

[0001] The present invention relates to the fields of data processing technology and network security technology, and can be applied to the field of financial technology, and in particular to a system authority management method, device, equipment, medium and product. Background Art

[0002] With the rapid development of the Internet and information technology, the digital age has profoundly affected people's lives, work and social operations. However, the widespread application of digital technology has also brought challenges in network security. Therefore, how to maintain system security is crucial. Summary of the invention

[0003] The present invention provides a system authority management method, device, equipment, medium and product to realize system authority management and thus improve system security.

[0004] According to one aspect of the present invention, a method for managing system rights is provided, the method comprising:

[0005] Responding to a system login operation of a target system by an employee;

[0006] Obtaining employee login information of the employee; the employee login information includes target login IP, target MAC address, and employee basic information;

[0007] The system permissions of the employee are determined according to the employee login information; the system permissions include system menu permissions, operation permissions and customer information access permissions.

[0008] According to another aspect of the present invention, a system authority management device is provided, the device comprising:

[0009] A login operation response module, used to respond to the employee's system login operation on the target system;

[0010] An employee login information acquisition module is used to acquire the employee login information of the employee; the employee login information includes a target login IP, a target MAC address, and basic employee information;

[0011] The system authority determination module is used to determine the system authority of the employee according to the employee login information; the system authority includes system menu authority, operation authority and customer information access authority.

[0012] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the system authority management method described in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the system authority management method described in any embodiment of the present invention when executed.

[0017] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the system authority management method according to any embodiment of the present invention is implemented.

[0018] The technical solution of the embodiment of the present invention obtains the employee's login information by responding to the employee's system login operation on the target system; the employee login information includes the target login IP, target MAC address, and employee basic information, and then determines the employee's system permissions based on the employee login information; the system permissions include system menu permissions, operation permissions, and customer information access permissions. The above technical solution can avoid arbitrary operation of the system by managing and controlling the system permissions, thereby improving system security.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a system authority management method provided according to an embodiment of the present invention;

[0022] Figure 2 This is a schematic diagram of an email reminder configuration provided according to an embodiment of the present invention;

[0023] Figure 3 is a flow chart of a system authority management method provided according to an embodiment of the present invention;

[0024] Figure 4 is a menu function item permission flow chart provided according to an embodiment of the present invention;

[0025] Figure 5 is a structural diagram of a system authority management device provided according to an embodiment of the present invention;

[0026] Figure 6 It is a structural schematic diagram of an electronic device for implementing the system authority management method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] In addition, it should be noted that the collection, storage, use, processing, transmission, provision and disclosure of employee login information, customer information and other related data involved in the technical solution of the present invention are in compliance with the relevant laws and regulations and do not violate public order and good customs.

[0030] Figure 1 1 is a flowchart of a system authority management method provided according to an embodiment of the present invention. This embodiment is applicable to the situation of how to manage system authority, and is particularly applicable to the situation of managing system authority in a financial system. The method can be executed by a system authority management device, which can be implemented in the form of hardware and / or software and can be integrated into an electronic device that carries the system authority management function, such as a server. Figure 1 As shown, the method includes:

[0031] S110 , responding to an employee's system login operation on a target system.

[0032] In this embodiment, the target system refers to a system that needs to be managed by rights, such as a banking and financial system, etc. The so-called system login operation refers to the operation of logging into the system.

[0033] Specifically, the employee can log in to the target system using the account password, and accordingly, the backend server can respond to the employee's system login operation on the target system.

[0034] S120: Obtain employee login information of the employee.

[0035] Among them, employee login information refers to the physical address information and basic information of employees when they log in to the system. The physical address information includes the target login IP and target MAC address. Among them, the basic information of employees includes basic information such as name, institution, branch, position information, and current job level.

[0036] Specifically, based on the employee's unique number, that is, the unified authentication number, the employee's login information can be obtained through a unified API data interface.

[0037] S130. Determine the system authority of the employee according to the employee login information.

[0038] Among them, system permissions refer to the permissions granted to users in the target system, which are optional, including system menu permissions, operation permissions, and customer information access permissions. Among them, the target system includes management menus, query menus, change operation menus, and menus shared by the entire bank. Customer information access permissions include full access permissions, limited viewing permissions, and no access permissions. Among them, full access permissions allow you to see the complete information of the customer; limited viewing permissions allow you to view the customer's information marked with *, such as: 350************227, and system users can query customer information through full matching; no access permissions mean that you cannot view customer information.

[0039] An optional method may be to determine the system permissions of an employee based on the employee level corresponding to the employee login information.

[0040] The technical solution provided by the embodiment of the present invention responds to the employee's system login operation on the target system, and then obtains the employee's employee login information; the employee login information includes the target login IP, the target MAC address, and the employee's basic information, and then determines the employee's system permissions based on the employee login information; the system permissions include system menu permissions, operation permissions, and customer information access permissions. The above technical solution can avoid arbitrary operation of the system by managing and controlling the system permissions, thereby improving system security.

[0041] Based on the above embodiment, as an optional method of the present invention, in response to the email configuration operation of illegal login or unauthorized access in the configuration center; when the illegal login or unauthorized access operation is identified, a reminder email is sent.

[0042] Specifically, the parameter configuration center can be used to set the email recipient mailbox and the intrusion reminder email switch, in response to the administrator's email configuration operation for illegal login or unauthorized access in the configuration center, such as Figure 2 The email reminder configuration diagram shown in the figure, where ALERT_EMAIL_RECIPIENTS: [Tool] Required, branch alarm recipient email, used to receive batch task execution alarms, data visualization, port detection SMTP related alarm emails. REMIND_EMAIL_SWITCH: [Tool] Required, intrusion detection reminder email switch. ON-on, OFF-off. The default is off. After that, when illegal login or unauthorized access operations are identified, a reminder email is sent.

[0043] It is understandable that, through configuration, the user login status and the user's unauthorized menu permission login status can be detected, thereby being used to identify and detect hacker attacks and further ensure system security.

[0044] On the basis of the above embodiments, as an optional method of the present invention, the sensitive data in the system can also be encrypted. Specifically, by using an encrypted mode to store key sensitive data and interacting with the client through ciphertext, the security of the key data can be protected even if the data is stolen. It can also reduce the risk of key data leakage after the database is "out of the database", which ensures both the security of data transmission and the security of data storage. Sensitive data is encrypted and stored using an agreed encryption method, such as AES encryption. Taking the ID card number as an example, a key is agreed upon: ICBC. Then, through the AES encryption algorithm, the actual result of the persistence layer storage is: U2FsdGVkX19buwjDn0IEP1L / 933htErJD4QLvOmKA54Yu+VZbMih13Sc1sNdvYOf.

[0045] Figure 3 1 is a flowchart of a system authority management method provided according to an embodiment of the present invention. Based on the above embodiments, this embodiment further optimizes "determining the system authority of an employee according to the employee login information" and provides an optional implementation scheme. Figure 3 As shown, the method includes:

[0046] S210: Responding to the employee's system login operation on the target system.

[0047] S220: Obtain employee login information of the employee.

[0048] Among them, employee login information includes target login IP, target MAC address, and employee basic information.

[0049] S230. Determine the system authority of the employee according to the employee login information.

[0050] Among them, system permissions include system menu permissions, operation permissions and customer information access rights.

[0051] An optional method is to determine the target network environment according to the target login IP based on the association between the IP and the network environment; and to determine the system menu permissions according to the target network environment based on the correspondence between the network environment and the menu permissions.

[0052] The network environment includes but is not limited to an office environment, a test environment, a production environment, an isolated network environment, and an Internet environment. Different network environments have different IP address segments. For example, the IP address segment 119.6.*. is dedicated to the test environment, while 119.[1-5]..* is allocated to the office environment.

[0053] Specifically, based on the association between IP and network environment, the target network environment can be determined according to the target login IP, and then based on the correspondence between network environment and menu permissions, the system menu permissions can be determined according to the target environment network. For example, only the network in the production environment has management menus, and the network in the office environment only has query menu permissions, but does not have the permission to change operation menu access permissions.

[0054] It is understandable that it is possible to prevent the execution of commands that change operations by mistake in a test or office environment, thereby reducing user operation risks.

[0055] An optional method is to automatically identify the target role of the employee based on the position information in the employee login information; based on the correspondence between the menu and the role, determine the system menu authority according to the target role.

[0056] Among them, roles can include system management, operation approval, daily operation, development, experiment, experience and tool sharing, and basic roles. Specifically, the system management position (admin_role) is responsible for the operation and maintenance management of the application system. The main scenarios are: role permission allocation, service start and stop, batch job start and stop, parameter maintenance, etc. It has operation rights on the "self-service" menu. The operation approval position (appr_role) is responsible for reviewing and approving applications initiated by other roles. The main scenario is: approving emergency operations initiated by other roles. The system can only run after approval. It has operation rights on the "approval list". The daily operation position (oper_role) is responsible for the daily operation and maintenance of the institution. The main scenarios are: installation and deployment, operating system, middleware, database, storage backup, security inspection, etc. It has operation rights on various operation and maintenance tools in the operation menu. The development position (dev_role) is responsible for the development, testing, integration, release, and online release of operation and maintenance tools; the main scenarios are: debugging inspection, demonstration template, and integrated release. Please do not check for ordinary branches; this role has operation rights on the "Developer Center". The Experimental Role (try_role) is responsible for small-scale pilot testing of new tools, mainly for development branches that can bear tool risks and troubleshoot problems. Please do not check for ordinary branches. This role has the operation rights to the "Laboratory". The Experience and Tool Sharing Role (share_role) is responsible for experience and tool sharing; mainly for branches that share experience and tools; this role has the operation rights to the "Sharing Platform". The Basic Role Role (base_role) is the default role for system login; this role is assigned by the system by default.

[0057] Specifically, the target role of the employee is automatically identified based on the position information in the employee login information; then the target role is used as an index, and based on the correspondence between the menu and the role, the system menu permission for the target role is determined. It should be noted that the correspondence between the menu and the role can be determined through a configuration file.

[0058] It is understandable that different menu permissions are assigned to different roles to prevent any employee from accessing the system menu, thereby improving system security.

[0059] An optional method is to determine the employee's operation authority based on the target MAC address based on the binding relationship between the risk operation and the physical server MAC address.

[0060] Specifically, based on the binding relationship between risky operations and the MAC address of the physical server, the employee's operation authority is determined according to the target MAC address, wherein the risky operations are high-risk operations involving deleting files or databases.

[0061] It is understandable that risky operations are bound to the MAC addresses of physical servers to ensure that these servers are in a fully monitored physical environment, to ensure the operational safety of technicians, and to achieve minimum authorized access in order to ensure the stability and security of the banking system.

[0062] An optional method is to automatically identify the employee's target role based on the position information in the employee's login information; based on the correspondence between the role and the customer authority, determine the customer information access rights according to the target role.

[0063] Specifically, the target role of an employee can be automatically identified based on the job information in the employee login information; the employee's customer information access rights can be determined based on the target role as an index and the correspondence between the role and the customer rights. For example, the viewing rights of customer information can be automatically assigned based on the obtained employee login information. For example, the president of a branch has full access rights to the customers marketed by the branch, and the marketing account manager has limited viewing rights to the customers of the branch, and has no access rights to customers who are not affiliated with the branch.

[0064] It is understandable that different roles are given different access rights to customer information to prevent any employee from accessing customer information and ensure the security of customer information.

[0065] The technical solution provided by the embodiment of the present invention responds to the employee's system login operation on the target system, and then obtains the employee's employee login information; the employee login information includes the target login IP, the target MAC address, and the employee's basic information, and then determines the employee's system permissions based on the employee login information; the system permissions include system menu permissions, operation permissions, and customer information access permissions. The above technical solution can avoid arbitrary operation of the system by managing and controlling the system permissions, thereby improving system security.

[0066] A specific example, such as Figure 4 The menu function item permission flow chart shown in the figure. First, user Deng Li system. Obtain the user client IP address and MAC address information. Automatically obtain IP environment information, that is, target environment information, from the IP resource pool. Obtain the user's unified authentication number. Obtain employee organization and position information through the API interface: if it is a technical staff, the relevant position role is automatically assigned through the technical position; if it is a business staff, the business role authority is automatically assigned through the position level.

[0067] After that, click a certain function menu item to determine the user role menu permission. If not, that is, the user does not have the menu permission, access is denied. If the user has the menu permission, determine whether the user client IP address is in the whitelist. If not, that is, not in the whitelist, access is denied. If it is in the whitelist, determine whether it is a sensitive change operation. If it is a sensitive change operation, determine whether the MAC address matches. If not, access is denied. If it matches, normal access is allowed. If it is not a sensitive change operation, normal access is allowed.

[0068] Figure 5 1 is a schematic diagram of the structure of a system authority management device provided according to an embodiment of the present invention. This embodiment can be applied to the situation of how to manage system authority, and is particularly applicable to the situation of managing system authority in a financial system. The system authority management device can be implemented in the form of hardware and / or software, and can be integrated into an electronic device that carries the system authority management function, such as a server. Figure 5 As shown, the device comprises:

[0069] A login operation response module 310 is used to respond to an employee's system login operation on a target system;

[0070] An employee login information acquisition module 320 is used to acquire employee login information of an employee; the employee login information includes a target login IP, a target MAC address, and basic employee information;

[0071] The system authority determination module 330 is used to determine the system authority of the employee according to the employee login information; the system authority includes system menu authority, operation authority and customer information access authority.

[0072] The technical solution provided by the embodiment of the present invention responds to the employee's system login operation on the target system, and then obtains the employee's employee login information; the employee login information includes the target login IP, the target MAC address, and the employee's basic information, and then determines the employee's system permissions based on the employee login information; the system permissions include system menu permissions, operation permissions, and customer information access permissions. The above technical solution can avoid arbitrary operation of the system by managing and controlling the system permissions, thereby improving system security.

[0073] Optionally, the system authority determination module 330 is specifically used for:

[0074] Based on the association between IP and network environment, the target network environment is determined according to the target login IP;

[0075] Based on the correspondence between the network environment and the menu permissions, the system menu permissions are determined according to the target network environment.

[0076] Optionally, the system authority determination module 330 is specifically used for:

[0077] Automatically identify the target role of employees based on their job information in their login information;

[0078] Based on the correspondence between menus and roles, the system menu permissions are determined according to the target role.

[0079] Optionally, the system authority determination module 330 is specifically used for:

[0080] Based on the binding relationship between risky operations and physical server MAC addresses, the employee's operation permissions are determined according to the target MAC address.

[0081] Optionally, the system authority determination module 330 is specifically used for:

[0082] Automatically identify the target role of employees based on their job information in their login information;

[0083] Based on the correspondence between roles and customer permissions, determine customer information access permissions based on the target role.

[0084] Optionally, the device further includes an email reminder module, which is used to:

[0085] In response to an email configuration operation in a configuration center for illegal login or unauthorized access;

[0086] When illegal login or unauthorized access is detected, a reminder email is sent.

[0087] The system authority management device provided in the embodiment of the present invention can execute the system authority management method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0088] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0089] Figure 6 It is a structural schematic diagram of an electronic device for implementing the system authority management method according to an embodiment of the present invention. Figure 6A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0090] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0091] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0092] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a system rights management method.

[0093] In some embodiments, the system rights management method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the system rights management method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the system rights management method in any other appropriate manner (e.g., by means of firmware).

[0094] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0095] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0096] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0097] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0098] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0099] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0100] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0101] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A system rights management method, characterized in that: include: Responding to a system login operation of a target system by an employee; Obtaining employee login information for the employee; The employee login information includes the target login IP, target MAC address, and employee basic information; Determining the system permissions of the employee according to the employee login information; The system permissions include system menu permissions, operation permissions and customer information access permissions.

2. The method according to claim 1, characterized in that Determine the system permissions of the employee according to the employee login information, including: Based on the association between the IP and the network environment, determine the target network environment according to the target login IP; Based on the correspondence between the network environment and the menu authority, the system menu authority is determined according to the target network environment.

3. The method according to claim 2, characterized in that Determine the system permissions of the employee according to the employee login information, including: Automatically identify the target role of the employee based on the job information in the employee login information; Based on the correspondence between menus and roles, the system menu permissions are determined according to the target role.

4. The method according to claim 1, characterized in that: Determine the system permissions of the employee according to the employee login information, including: Based on the binding relationship between the risk operation and the physical server MAC address, the operation authority of the employee is determined according to the target MAC address.

5. The method according to claim 1, characterized in that Determine the system permissions of the employee according to the employee login information, including: Automatically identify the target role of the employee based on the job information in the employee login information; Based on the correspondence between roles and customer permissions, the customer information access permissions are determined according to the target role.

6. The method according to claim 4, characterized in that Also includes: In response to an email configuration operation in a configuration center for illegal login or unauthorized access; When illegal login or unauthorized access is detected, a reminder email is sent.

7. A system rights management device, characterized in that: include: A login operation response module, used to respond to the employee's system login operation on the target system; An employee login information acquisition module, used to acquire the employee login information of the employee; The employee login information includes the target login IP, target MAC address, and employee basic information; A system authority determination module, used to determine the system authority of the employee according to the employee login information; The system permissions include system menu permissions, operation permissions and customer information access permissions.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the system authority management method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the system authority management method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the system authority management method according to any one of claims 1 to 6.

Images