Permission processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a permission processing method and device, electronic equipment and a storage medium, and relates to the technical field of data processing. A specific embodiment of the method comprises the following steps: receiving an operation request of a user, and obtaining corresponding first operation information and permission parameters; determining a corresponding first permission resource, querying second operation information, and determining a second permission resource corresponding to the second operation information; determining permission jump information according to the first permission resource and the second permission resource; calling a preset calculation model, and calculating a permission security value of the user according to the permission parameter and the permission jump information; and obtaining a corresponding decision model according to the first operation information, determining a permission processing result in combination with the permission security value, and processing the operation request. According to the embodiment, the problems that in order to meet the requirement of authority processing, a large number of roles can appear, management is difficult and disordered easily, the authority allocated to a certain role is too large, risk authority cannot be recycled in time, and safety is low can be solved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, electronic device and storage medium for permission processing. Background Art

[0002] In various business processing scenarios, data security is a problem that is often encountered, and improving data security through permission restrictions has become a common method. In related technologies, the method of permission processing is to assign users to different roles, each role has specific permissions, and users obtain the permissions of the roles by becoming members of various roles. When users perform data-related operations, the operations can be processed according to the user roles. However, in order to meet the needs of permission processing, this method will result in a large number of roles, which can easily lead to management difficulties and confusion. In addition, there is a risk that the permissions assigned to a role are too large and cannot be recovered in time, which has low security. Summary of the invention

[0003] In view of this, the embodiments of the present invention provide a method, device, electronic device and storage medium for permission processing, which can solve the problem that a large number of roles will appear in order to meet the needs of permission processing, which can easily lead to management difficulties and confusion, and there are risky permissions allocated to a certain role that are too large and cannot be recovered in time, resulting in low security.

[0004] To achieve the above objective, according to one aspect of an embodiment of the present invention, a method for handling permissions is provided.

[0005] A method for handling permissions in an embodiment of the present invention includes:

[0006] Receive an operation request from a user, and obtain first operation information corresponding to the first operation and a permission parameter of the user;

[0007] Determine a corresponding first permission resource based on the first operation information, query second operation information of a second operation associated with the first operation, determine a second permission resource corresponding to the second operation information, and execute the second operation after the first operation is completed;

[0008] Calling a preset permission hierarchy model, and determining permission jump information according to the first permission resource and the second permission resource;

[0009] Calling a preset calculation model to calculate the permission security value of the user according to the permission parameter and the permission jump information;

[0010] A corresponding decision model is obtained according to the first operation information to determine a permission processing result in combination with the permission security value, and the operation request is processed according to the permission processing result.

[0011] In one embodiment, calling a preset permission hierarchy model and determining permission jump information according to the first permission resource and the second permission resource includes:

[0012] Calling a preset permission level model to obtain a first permission level of the first permission resource and a second permission level corresponding to the second permission resource respectively;

[0013] A hierarchical distance and a jump direction between the first authority level and the second authority level are calculated to determine the hierarchical distance and the jump direction as authority jump information.

[0014] In yet another embodiment, determining the permission processing result in combination with the permission security value includes:

[0015] Acquire a corresponding decision strategy based on the decision model to determine the membership of the permission security value to a preset set;

[0016] In response to the membership satisfying a preset condition, the permission processing result is determined to be an allowed operation; in response to the membership not satisfying a preset condition, the permission processing result is determined to be an unallowed operation.

[0017] In yet another embodiment, determining the degree of membership of the authority security value to a preset set includes:

[0018] A decision range is determined based on the decision strategy, and a difference between the authority security value and the decision range is calculated to determine the membership degree of the authority security value to a preset set according to the difference.

[0019] In yet another embodiment, querying second operation information of a second operation associated with the first operation information includes:

[0020] An operation object and an operation type are determined based on the first operation information to query a corresponding jump page, and a second operation associated with the operation object in the jump page is obtained to determine corresponding second operation information.

[0021] In yet another embodiment, obtaining the second operation associated with the operation object in the jump page includes:

[0022] Acquire an operation set associated with the operation object in the jump page;

[0023] For each operation in the operation set, calculating the time interval between the first operation and each operation in the operation set according to the historical operation record;

[0024] A second operation associated with the operation object is determined from the operation set according to the time interval.

[0025] To achieve the above objective, according to another aspect of an embodiment of the present invention, a device for handling permissions is provided.

[0026] A permission processing device according to an embodiment of the present invention includes: an acquisition unit, configured to receive an operation request from a user, and acquire first operation information corresponding to a first operation and a permission parameter of the user;

[0027] a determining unit, configured to determine a corresponding first permission resource based on the first operation information, and query second operation information of a second operation associated with the first operation to determine a second permission resource corresponding to the second operation information, wherein the second operation is performed after the first operation is completed;

[0028] The determining unit is further configured to call a preset permission hierarchy model to determine permission jump information according to the first permission resource and the second permission resource;

[0029] A calculation unit, used to call a preset calculation model to calculate the permission security value of the user according to the permission parameter and the permission jump information;

[0030] A processing unit is used to obtain a corresponding decision model according to the first operation information, to determine a permission processing result in combination with the permission security value, and to process the operation request according to the permission processing result.

[0031] In one embodiment, the determining unit is specifically configured to:

[0032] Calling a preset permission level model to obtain a first permission level of the first permission resource and a second permission level corresponding to the second permission resource respectively;

[0033] A hierarchical distance and a jump direction between the first authority level and the second authority level are calculated to determine the hierarchical distance and the jump direction as authority jump information.

[0034] In yet another embodiment, the processing unit is specifically configured to:

[0035] Acquire a corresponding decision strategy based on the decision model to determine the membership of the permission security value to a preset set;

[0036] In response to the membership satisfying a preset condition, the permission processing result is determined to be an allowed operation; in response to the membership not satisfying a preset condition, the permission processing result is determined to be an unallowed operation.

[0037] In yet another embodiment, the processing unit is specifically configured to:

[0038] A decision range is determined based on the decision strategy, and a difference between the authority security value and the decision range is calculated to determine the membership degree of the authority security value to a preset set according to the difference.

[0039] In yet another embodiment, the determining unit is specifically configured to:

[0040] An operation object and an operation type are determined based on the first operation information to query a corresponding jump page, and a second operation associated with the operation object in the jump page is obtained to determine corresponding second operation information.

[0041] In yet another embodiment, the determining unit is specifically configured to:

[0042] Acquire an operation set associated with the operation object in the jump page;

[0043] For each operation in the operation set, calculating the time interval between the first operation and each operation in the operation set according to the historical operation record;

[0044] A second operation associated with the operation object is determined from the operation set according to the time interval.

[0045] To achieve the above objective, according to another aspect of an embodiment of the present invention, an electronic device is provided.

[0046] An electronic device according to an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method for permission processing provided by the embodiment of the present invention.

[0047] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer readable medium is provided.

[0048] A computer-readable medium according to an embodiment of the present invention stores a computer program, and when the program is executed by a processor, the method for handling permissions provided by the embodiment of the present invention is implemented.

[0049] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer program product is provided.

[0050] A computer program product according to an embodiment of the present invention includes a computer program, and when the program is executed by a processor, the method for handling permissions provided by the embodiment of the present invention is implemented.

[0051] One embodiment of the above invention has the following advantages or beneficial effects:

[0052] In an embodiment of the present invention, after receiving an operation request from a user, permission processing is performed on the user according to the corresponding first operation information and the user's permission parameters; based on the first operation information, the corresponding first permission resource can be determined, and the second permission resource corresponding to the second operation information associated with the second operation after the first operation can also be determined, and then the permission jump information of the first permission resource and the second permission resource, that is, the permission information of the user's continuous operation trajectory, is determined, and then the user's permission security value, that is, the security permission value of the user's continuous operation, can be calculated; through the corresponding decision model, the permission processing result can be determined in combination with the permission security value to process the operation request. In this way, in an embodiment of the present invention, the permission processing of user operations not only considers the user's permission parameters but also combines the permission security of the user's continuous operations, thereby improving the accuracy of permission security management, and there is no need to assign roles to users in advance, reducing the complexity of user omnidirectional management.

[0053] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0055] Figure 1 is a schematic diagram of a main process of a method for handling permissions according to an embodiment of the present invention;

[0056] Figure 2 is a structural diagram of permission resources corresponding to permission levels according to an embodiment of the present invention;

[0057] Figure 3 is a schematic diagram of another main process of the method for handling permissions according to an embodiment of the present invention;

[0058] Figure 4 is a schematic diagram of main units of an apparatus for handling permissions according to an embodiment of the present invention;

[0059] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0060] Figure 6 It is a schematic diagram of the structure of a computer system suitable for implementing the embodiment of the present invention. DETAILED DESCRIPTION

[0061] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0062] It should be pointed out that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict. The acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. In the embodiments of this application, some existing solutions in the industry such as certain software, components, and models may be mentioned, which should be considered as exemplary. Their purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0063] The embodiment of the present invention provides a permission processing system, which can be used in the scenario of user permission processing, and specifically can be used in the scenario of operation permission processing in user operation.

[0064] The embodiment of the present invention provides a method for handling permissions, which can be executed by a permission handling system. Figure 1 As shown, the method includes the following steps.

[0065] S101: receiving an operation request from a user, and obtaining first operation information corresponding to a first operation and a user authority parameter.

[0066] Among them, the user's operation request represents the user's request to operate the content or URL, link and other content in the displayed page, and the user's operation is the first operation corresponding to the operation request. The specific content of the operation can be set according to the needs, for example, it can include selection, call, deletion, modification, creation and other operations that can cause data changes. The first operation information may include information such as the operation object and the operation type, which is used to determine the details of the data changes caused by this operation. The permission parameters represent parameters associated with user permissions, which can be set according to the scenario, for example, they may include: request time, request frequency, continuous request track information, user permission level, permission level of similar users, network environment and device environment, etc. The request time can indicate the time period to which the operation request belongs; the request frequency can indicate the frequency of operation requests within a preset historical time period; the continuous request trajectory information can indicate the information on the permission level corresponding to the user's operation requests within the historical time period, such as the permission level change trend and amplitude; the user permission level can indicate the user's permission credit level, etc.; the same type of user permission level can indicate the permission level, credit level, etc. of the same type of users or similar users; the network environment and device environment can indicate the user's current network environment (such as IP segment, IP location, etc.) and the user's current device environment (common device fingerprints, device version, etc.).

[0067] It should be noted that, in the embodiment of the present invention, some operations with higher security do not require permission processing, so in this step, after receiving the user's operation request, it can first be determined whether permission processing is required, and if necessary, subsequent actions can be performed, and if not, the operation request can be directly processed. The determination of whether the operation request needs permission processing can be performed according to preset conditions, such as setting a request set that needs permission processing, so as to determine whether permission processing is required based on whether the operation request belongs to the request set.

[0068] S102: Determine a corresponding first permission resource based on the first operation information, query second operation information of a second operation associated with the first operation, and determine a second permission resource corresponding to the second operation information.

[0069] The second operation is executed after the first operation is completed. The permission resource can represent the resource whose operation affects data security and requires permission processing, such as menus, links, buttons, external ports (HTTP access ports, RPC access ports, etc.) and files and data that can be operated. In the embodiment of the present invention, each permission resource can be obtained in advance and the permission level and resource classification of each permission resource can be determined in advance to facilitate subsequent processing. As shown in Table 1, detailed information of some permission resources in the embodiment of the present invention is provided.

[0070] Table 1

[0071] Permission Number Permission resource name Permission levels Resource Classification 1 Create a User Account L1 User Management 2 Reset User Password L0 User Management 3 Create / delete service instances L0 Service Management 4 Monitoring service status L4 Service Management 5 Adjust service configuration L3 Service Management 6 Create a storage space L1 Storage Management 7 Set storage space access permissions L1 Storage Management 8 View consumption details L4 Cost Management 9 Generate billing report L4 Cost Management

[0072] It should be noted that, in the embodiment of the present invention, the classification of permission resources can be set according to requirements, and can be divided into coarse granularity or fine granularity, and the permission resources obtained in advance can be implemented according to the permission processing requirements.

[0073] Since a user's operation once may affect the data security of subsequent operations, in an embodiment of the present invention, after determining the first operation, the second operation associated with the first operation information can be queried to determine the corresponding second operation information, and then the corresponding second permission resource can be determined for this permission processing.

[0074] Specifically, querying the second operation information in this step can be performed as follows: determining the operation object and the operation type based on the first operation information to query the corresponding jump page and obtain the second operation information associated with the operation object in the jump page.

[0075] The first operation may include an operation object and an operation type, based on which the page to be jumped to after executing the current operation, i.e., the corresponding jump page, can be determined. The object associated with the operation object after the jump page is the object most likely to be continued to be operated, thereby determining the second operation. For example, for a data query button, after clicking the operation, it usually jumps to the page of query results, i.e., the jump page, and the query results in the jump page are the objects most likely to be operated, so the second operation may include downloading, saving, etc. of the query results.

[0076] It should be noted that in the embodiments of the present invention, after some operations are completed, the entire page content is not necessarily redirected, but part of the content in the page is updated, and the updated page can also be used as the page after the jump. For example, for a menu including a drop-down option, after a click operation, more drop-down options under the menu are usually displayed, that is, the jump page, and the drop-down option in the jump page is the most likely object to be operated, so the second operation information can include an operation of selecting one of the drop-down options.

[0077] In one implementation, the operations associated with the operation object in the jump page may include multiple operations, that is, forming an operation set. At this time, for each operation in the operation set, the time interval between each operation and the first operation can be calculated according to the historical operation record, and then the second operation associated with the operation object can be determined from the operation set according to the time interval. Since the closer the time interval is, the stronger the correlation between the two is, and the greater the possibility of being a continuous operation, the operation with a small time interval can be determined as the second operation.

[0078] S103: Calling a preset permission hierarchy model, and determining permission jump information according to the first permission resource and the second permission resource.

[0079] The permission hierarchy model may be pre-established, and may be specifically established based on the permission hierarchy of the permission resources acquired in advance.

[0080] For example, as shown in Table 1, the permission level of each permission resource can be marked as L0, L1, L2, L3, L4...Ln. Generally, the higher the permission level, the lower the marking level. By marking the level of permission resources, the two-dimensional model composed of permission resources at the same level can be added with the level dimension to construct a three-dimensional model of the permission level model, such as Figure 2 shown.

[0081] The permission resources of the same permission level are at the same level, so the level jump information can be determined based on the permission levels to which the first permission resource and the second permission resource respectively belong, that is, the permission jump information can be determined.

[0082] The permission jump information may include the jump direction and the number of jump levels. Specifically, this step may be performed as follows: calling a preset permission hierarchy model, respectively obtaining the first permission level of the first permission resource and the second permission level corresponding to the second permission resource; calculating the level distance and jump direction between the first permission level and the second permission level, and determining the level distance and jump direction as the permission jump information. Figure 2 As shown, the first permission level is L2, the second permission level is L4, the level distance is 2, and the jump direction is from low to high.

[0083] S104: calling a preset calculation model to calculate the user's permission security value according to the permission parameters and permission jump information.

[0084] The calculation model may be pre-trained, or may be a multi-layer deep neural network model. In this step, a feature vector may be generated based on the permission parameters and permission jump information to input into the calculation model to obtain the user's permission security value.

[0085] In the embodiment of the present invention, for the computing model, historical application records of simulation can be used, and a training set and a verification set can be output after data cleaning and sorting to train the computing model.

[0086] By inputting the permission parameters and permission jump information of users of various dimensions, as well as the weights of each parameter into the calculation model, through feature extraction, optimizing the propagation algorithm, adjusting the network structure, fine-tuning the parameters of the training set and the verification set, repeating the training process, only until the set verification conditions are met, the training and initialization of the decision model are completed. In addition to using simulation data, user access resource feedback and collision detection feedback are also used as training data to optimize the model training.

[0087] It should be noted that in the embodiments of the present invention, a multi-layer deep neural network model can also be used for model training. The environment and permission data features are extracted through multi-layer networks and neurons, and network parameters are updated by calculating losses and optimizing algorithms to improve the generalization ability of the model and the accuracy of the calculated permission security value. The result of the permission security value calculation can be a value in the range of 0-1.

[0088] S105: Acquire a corresponding decision model according to the first operation information, determine a permission processing result in combination with the permission security value, and process the operation request according to the permission processing result.

[0089] The decision model is preset and includes corresponding decision strategies, which can set different strategies according to different operations. The permission processing result can include allowing the operation and not allowing the operation. If the permission processing result is allowing the operation, it means that the user is allowed to operate, and the user's operation request can be executed; if the permission processing result is not allowing the operation, it means that the user is not allowed to operate, and the user's operation request can be prohibited.

[0090] In this step, the decision model sets the corresponding decision strategy, which may include a preset set to determine the membership of the preset set through the permission security value; and then determine the permission processing result according to the membership, that is, in response to the membership satisfying the preset condition, the permission processing result is determined to be allowed operation; in response to the membership not satisfying the preset condition, the permission processing result is determined to be not allowed operation. The preset condition can be set according to demand, for example, it can be set to a threshold, and if the membership is greater than the threshold, the permission processing result is determined to be allowed operation; if the membership is not greater than the threshold, the permission processing result is determined to be not allowed operation.

[0091] Specifically, in this step, the decision strategy may include a decision range, which may be a value or an interval, and then the difference between the authority security value and the decision range may be calculated to determine the degree of membership of the authority security value to a preset set based on the difference.

[0092] For example, if the difference is small, the membership can be determined to be a median range; if the difference is large, when the authority security value and the preset value are both small values, the membership can be determined to be a small value range, and when the authority security value and the preset value are both large values, the membership can be determined to be a large value range. Each small value, large value, median range, small value range, and large value range can be set based on specific scenarios.

[0093] It should be noted that in the embodiment of the present invention, the operation application that is not approved by the authority can also be confirmed whether it is a misjudgment through the decision feedback management system. When it is determined to be a misjudgment, the calculation model or decision model can be entered for intervention training through the assembled environmental parameters and authority processing results to optimize the accuracy of the model decision; when it is confirmed that there is no misjudgment, the general decision feedback management system can be used to feedback the correct decision and give rewards to improve the accuracy of the model's decision. The obtained authority processing results can also be compared with the expected decision results to verify the accuracy of the decision, intervene and train the calculation model and decision model, and improve the accuracy of the model.

[0094] In the embodiment of the present invention, the permission processing of user operations not only considers the user's permission parameters but also combines the permission security of the user's continuous operations, thereby improving the accuracy of permission security management, and eliminating the need to assign roles to users in advance, reducing the complexity of user omnidirectional management.

[0095] Combine the following Figure 1 The embodiment shown in the figure specifically describes the method for handling permissions in the embodiment of the present invention. Figure 3 As shown, the method includes the following steps.

[0096] S301: receiving an operation request from a user, and obtaining first operation information corresponding to a first operation and a user authority parameter.

[0097] S302: Determine a corresponding first permission resource based on the first operation information, and determine an operation object and an operation type based on the first operation information to query a corresponding jump page.

[0098] S303: Acquire second operation information associated with the operation object in the jump page, and determine a second permission resource corresponding to the second operation information.

[0099] S304: Calling a preset permission level model to obtain a first permission level of a first permission resource and a second permission level corresponding to a second permission resource.

[0100] S305: Calculate the level distance and jump direction between the first permission level and the second permission level, and determine the level distance and jump direction as permission jump information.

[0101] S306: Calling a preset calculation model to calculate the user's permission security value according to the permission parameters and permission jump information.

[0102] S307: Obtain a corresponding decision model according to the operation information, and obtain a corresponding decision strategy based on the decision model to determine the degree of membership of the permission security value to a preset set.

[0103] S308: In response to the membership satisfying the preset condition, determining the permission processing result as allowing the operation; in response to the membership not satisfying the preset condition, determining the permission processing result as not allowing the operation.

[0104] It should be noted that the data processing principle in the embodiment of the present invention is the same as Figure 1 The corresponding data processing principles in the illustrated embodiments are the same and will not be described in detail here.

[0105] In order to solve the problems existing in the prior art, an embodiment of the present invention provides a permission processing device 400, such as Figure 4 As shown, the device 400 includes:

[0106] The acquisition unit 401 is used to receive an operation request from a user, and acquire first operation information corresponding to a first operation and a user authority parameter;

[0107] A determining unit 402 is configured to determine a corresponding first permission resource based on the first operation information, and query second operation information of a second operation associated with the first operation to determine a second permission resource corresponding to the second operation information, wherein the second operation is performed after the first operation is completed;

[0108] The determining unit 402 is further configured to call a preset permission hierarchy model to determine permission jump information according to the first permission resource and the second permission resource;

[0109] The calculation unit 403 is used to call a preset calculation model to calculate the permission security value of the user according to the permission parameter and the permission jump information;

[0110] The processing unit 404 is used to obtain a corresponding decision model according to the first operation information, to determine a permission processing result in combination with the permission security value, and to process the operation request according to the permission processing result.

[0111] It should be understood that the manner of implementing the embodiments of the present invention is different from the Figure 1 The method of the illustrated embodiment is the same and will not be repeated here.

[0112] In one embodiment, the determining unit 402 is specifically configured to:

[0113] Calling a preset permission level model to obtain a first permission level of the first permission resource and a second permission level corresponding to the second permission resource respectively;

[0114] A hierarchical distance and a jump direction between the first authority level and the second authority level are calculated to determine the hierarchical distance and the jump direction as authority jump information.

[0115] In yet another embodiment, the processing unit 404 is specifically configured to:

[0116] Acquire a corresponding decision strategy based on the decision model to determine the membership of the permission security value to a preset set;

[0117] In response to the membership satisfying a preset condition, the permission processing result is determined to be an allowed operation; in response to the membership not satisfying a preset condition, the permission processing result is determined to be an unallowed operation.

[0118] In yet another embodiment, the processing unit 404 is specifically configured to:

[0119] A decision range is determined based on the decision strategy, and a difference between the authority security value and the decision range is calculated to determine the membership degree of the authority security value to a preset set according to the difference.

[0120] In yet another embodiment, the determining unit 402 is specifically configured to:

[0121] An operation object and an operation type are determined based on the first operation information to query a corresponding jump page, and a second operation associated with the operation object in the jump page is obtained to determine corresponding second operation information.

[0122] In yet another embodiment, the determining unit 402 is specifically configured to:

[0123] Acquire an operation set associated with the operation object in the jump page;

[0124] For each operation in the operation set, calculating the time interval between the first operation and each operation in the operation set according to the historical operation record;

[0125] A second operation associated with the operation object is determined from the operation set according to the time interval.

[0126] It should be understood that the manner of implementing the embodiments of the present invention is different from the Figure 1 , 3 The method of the illustrated embodiment is the same and will not be repeated here.

[0127] In the embodiment of the present invention, the permission processing of user operations not only considers the user's permission parameters but also combines the permission security of the user's continuous operations, thereby improving the accuracy of permission security management, and eliminating the need to assign roles to users in advance, reducing the complexity of user omnidirectional management.

[0128] According to an embodiment of the present invention, the embodiment of the present invention further provides an electronic device and a readable storage medium.

[0129] The electronic device of an embodiment of the present invention includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the method for permission processing provided by the embodiment of the present invention.

[0130] Figure 5 An exemplary system architecture 500 is shown to which the method or apparatus for handling permissions according to an embodiment of the present invention may be applied.

[0131] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0132] The user can use the terminal devices 501, 502, 503 to interact with the server 505 through the network 504 to receive or send messages, etc. Various client applications can be installed on the terminal devices 501, 502, 503.

[0133] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0134] The server 505 may be a server that provides various services. The server may analyze and process the received data such as the product information query request, and feed back the processing result (such as product information - just an example) to the terminal device.

[0135] It should be noted that the permission processing method provided in the embodiment of the present invention is generally executed by the server 505 , and accordingly, the permission processing device is generally set in the server 505 .

[0136] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0137] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 suitable for implementing an embodiment of the present invention. Figure 6 The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0138] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0139] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0140] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are executed.

[0141] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0142] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a unit, a program segment, or a part of a code, and the above-mentioned unit, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0143] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be arranged in a processor, for example, it may be described as: a processor includes a receiving unit, a determining unit, a calculating unit and a processing unit. The names of these units do not constitute a limitation on the units themselves in some cases, for example, the receiving unit may also be described as a "unit of receiving function".

[0144] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device executes the permission processing method provided by the present invention.

[0145] As another aspect, the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the permission processing method provided by an embodiment of the present invention.

[0146] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for handling permissions, characterized in that: include: Receive an operation request from a user, and obtain first operation information corresponding to the first operation and a permission parameter of the user; Determine a corresponding first permission resource based on the first operation information, query second operation information of a second operation associated with the first operation, determine a second permission resource corresponding to the second operation information, and execute the second operation after the first operation is completed; Calling a preset permission hierarchy model, and determining permission jump information according to the first permission resource and the second permission resource; Calling a preset calculation model to calculate the permission security value of the user according to the permission parameter and the permission jump information; A corresponding decision model is obtained according to the first operation information to determine a permission processing result in combination with the permission security value, and the operation request is processed according to the permission processing result.

2. The method according to claim 1, characterized in that The calling of a preset permission hierarchy model and determining permission jump information according to the first permission resource and the second permission resource includes: Calling a preset permission level model to obtain a first permission level of the first permission resource and a second permission level corresponding to the second permission resource respectively; A hierarchical distance and a jump direction between the first authority level and the second authority level are calculated to determine the hierarchical distance and the jump direction as authority jump information.

3. The method according to claim 1, characterized in that Determining the permission processing result in combination with the permission security value includes: Acquire a corresponding decision strategy based on the decision model to determine the membership of the permission security value to a preset set; In response to the membership satisfying a preset condition, the permission processing result is determined to be an allowed operation; in response to the membership not satisfying a preset condition, the permission processing result is determined to be an unallowed operation.

4. The method according to claim 3, characterized in that: Determining the degree of membership of the permission security value to a preset set includes: A decision range is determined based on the decision strategy, and a difference between the authority security value and the decision range is calculated to determine the membership degree of the authority security value to a preset set according to the difference.

5. The method according to claim 1, characterized in that Querying second operation information of a second operation associated with the first operation information includes: An operation object and an operation type are determined based on the first operation information to query a corresponding jump page, and a second operation associated with the operation object in the jump page is obtained to determine corresponding second operation information.

6. The method according to claim 5, characterized in that Acquiring a second operation associated with the operation object in the jump page includes: Acquire an operation set associated with the operation object in the jump page; For each operation in the operation set, calculating the time interval between the first operation and each operation in the operation set according to the historical operation record; A second operation associated with the operation object is determined from the operation set according to the time interval.

7. A device for handling permissions, characterized in that: include: An acquisition unit, configured to receive an operation request from a user, and acquire first operation information corresponding to the first operation and a permission parameter of the user; a determining unit, configured to determine a corresponding first permission resource based on the first operation information, and query second operation information of a second operation associated with the first operation to determine a second permission resource corresponding to the second operation information, wherein the second operation is performed after the first operation is completed; The determining unit is further configured to call a preset permission hierarchy model to determine permission jump information according to the first permission resource and the second permission resource; A calculation unit, used to call a preset calculation model to calculate the permission security value of the user according to the permission parameter and the permission jump information; A processing unit is used to obtain a corresponding decision model according to the first operation information, to determine a permission processing result in combination with the permission security value, and to process the operation request according to the permission processing result.

8. The device according to claim 7, characterized in that The determining unit is specifically configured to: Calling a preset permission level model to obtain a first permission level of the first permission resource and a second permission level corresponding to the second permission resource respectively; A hierarchical distance and a jump direction between the first authority level and the second authority level are calculated to determine the hierarchical distance and the jump direction as authority jump information.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images