Information query permission updating method, electronic equipment and storage medium

Abstract

The invention discloses an information query permission updating method, electronic equipment and a storage medium. The method belongs to the field of civil aviation services, and comprises the following steps: in response to receiving a permission processing instruction corresponding to target information, obtaining first identity information of a receiving object, the receiving object being used for representing an object receiving the permission processing instruction, and the permission processing instruction being used for representing an instruction of granting or deleting an information processing permission of the receiving object; the information processing permission is used for representing the permission for processing the target information; acquiring an information receiving state of the receiving object based on the first identity information; and in response to the information receiving state that the information processing permission can be adjusted according to the permission processing instruction, granting or deleting the information processing permission based on the permission processing instruction. According to the method and the device, the technical problem of relatively low data security of authority management in related technologies is solved.

Description

Technical Field

[0001] The present invention relates to the field of civil aviation services, and in particular to an information query authority updating method, electronic equipment and a storage medium. Background Art

[0002] In the current era of civil aviation informationization, electronic tickets have become an indispensable part of air travel. Electronic Ticket (ET) refers to an electronic ticket filled out by an airline or its authorized agent. It contains the basic information of the passenger, flight details, itinerary and applicable boarding voucher, replacing the traditional paper ticket, greatly simplifying the process of ticket purchase, change and refund, and providing convenience and efficiency for passengers and airlines.

[0003] With the increasing competition in the aviation industry and the diversification of consumer demand, airlines and agents need a more flexible and secure data sharing mechanism to quickly respond to market changes and improve service quality. However, traditional permission management methods have the risk of privacy leakage, resulting in low data security in permission management.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method for updating information query authority, an electronic device, and a storage medium, so as to at least solve the technical problem of low data security of authority management in related technologies.

[0006] According to one aspect of an embodiment of the present invention, a method for updating information query permissions is provided, comprising: in response to receiving a permission processing instruction corresponding to target information, obtaining first identity information of a receiving object, wherein the receiving object is used to characterize the object receiving the permission processing instruction, the permission processing instruction is used to characterize the instruction for granting or deleting information processing permissions for the receiving object, and the information processing permissions are used to characterize the permissions for processing the target information; based on the first identity information, obtaining an information reception status of the receiving object, wherein the information reception status is used to characterize whether the information processing permissions of the receiving object can be adjusted according to the permission processing instructions; in response to the information reception status being that the information processing permissions can be adjusted according to the permission processing instructions, granting or deleting the information processing permissions based on the permission processing instructions.

[0007] Furthermore, based on the first identity information, the information receiving status of the receiving object is obtained, including: obtaining the second identity information of the sending object, wherein the sending object is used to characterize the object of sending the permission processing instruction; based on the first identity information and the second identity information, determining the first permission relationship between the sending object and the receiving object, wherein the first permission relationship is used to characterize whether the sending object can grant or delete the information processing permission of the receiving object; in response to the first permission relationship being that the sending object can grant or delete the information processing permission, determining that the information receiving status is that the information processing permission can be adjusted according to the permission processing instruction; in response to the first permission relationship being that the sending object cannot grant or delete the information processing permission, determining that the information receiving status is that the information processing permission cannot be adjusted according to the permission processing instruction.

[0008] Furthermore, granting or deleting information processing permissions based on permission processing instructions includes: identifying the permission processing instructions, obtaining the instruction type and target processing permissions corresponding to the permission processing instructions, wherein the instruction types include: a first type of permission processing instructions for granting, and a second type of permission processing instructions for deleting, and the target processing permissions are used to characterize permissions that currently need to be updated in the information processing permissions; based on the first identity information, obtaining the current permission status of the target processing permissions, wherein the permission status is used to characterize whether the receiving object currently has the target processing permissions; and authorizing or deleting the target processing permissions based on the instruction type and the permission status.

[0009] Furthermore, based on the instruction type and the permission status, the target processing permission is authorized or deleted, including: based on the instruction type, determining the expected state corresponding to the permission processing instruction, wherein the expected state is used to characterize the permission state of the target processing permission after the target processing permission is updated; matching the expected state with the permission state to obtain a state matching result; in response to the state matching result being that the expected state and the permission state are different, authorizing or deleting the target processing permission according to the expected state; in response to the state matching result being that the expected state and the permission state are the same, keeping the target processing permission unchanged, and outputting a first prompt message, wherein the first prompt message is used to prompt that the permission state of the sending object is the same as the expected state.

[0010] Furthermore, the information processing authority includes: information query authority and object authorization authority, wherein the information query authority is used to represent the authority of the receiving object to query the target information, and the object authorization authority is used to represent the authority of the receiving object to send a permission processing instruction.

[0011] Furthermore, in response to the target processing permission being the object authorization permission and the instruction type being the second type, after deleting the target processing permission according to the expected state, the method also includes: based on the first identity information, obtaining the target object that has a second permission relationship with the receiving object, wherein the second permission relationship is used to characterize that the information processing authority of the target object is related to the permission processing instruction sent by the receiving object; based on the second permission relationship, deleting the information processing instruction of the target object.

[0012] Furthermore, the method also includes: in response to receiving an information query request corresponding to the target information, obtaining third identity information of the request object, wherein the request object is used to characterize the object sending the information query request; based on the third identity information, obtaining the target permission status of the information query permission of the request object; in response to the target permission status being that the request object has information query permission, outputting the target information; in response to the target permission status being that the request object does not have information query permission, outputting a second prompt information, wherein the second prompt information is used to characterize the reason why the request object cannot query the target information.

[0013] Furthermore, in response to the first permission relationship being that the sending object cannot grant or delete information processing permissions, the method also includes: generating a third prompt message based on the first identity information and information processing permissions, wherein the third prompt message includes the reason why the sending object cannot send permission processing instructions to the receiving object; and sending the third prompt message to the sending object.

[0014] According to another aspect of an embodiment of the present invention, there is also provided an apparatus for updating information query permissions, including: a first acquisition module, for acquiring first identity information of a receiving object in response to receiving a permission processing instruction corresponding to target information, wherein the receiving object is used to characterize the object receiving the permission processing instruction, the permission processing instruction is used to characterize the instruction for granting or deleting the information processing permission of the receiving object, and the information processing permission is used to characterize the permission to process the target information; a second acquisition module, for acquiring the information receiving status of the receiving object based on the first identity information, wherein the information receiving status is used to characterize whether the information processing permission of the receiving object can be adjusted according to the permission processing instruction; and a permission control module, for granting or deleting the information processing permission based on the permission processing instruction in response to the information receiving status being that the information processing permission can be adjusted according to the permission processing instruction.

[0015] According to another aspect of an embodiment of the present invention, there is further provided an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the method in each embodiment of the present invention is executed when the program is running.

[0016] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the methods in various embodiments of the present invention.

[0017] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the method in each embodiment of the present invention is implemented.

[0018] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method in each embodiment of the present invention is implemented.

[0019] According to another aspect of the embodiments of the present invention, a computer program is further provided. When the computer program is executed by a processor, the methods in the embodiments of the present invention are implemented.

[0020] In an embodiment of the present invention, in response to receiving a permission processing instruction corresponding to target information, the first identity information of the receiving object is obtained; based on the first identity information, the information receiving status of the receiving object is obtained; in response to the information receiving status being that the information processing authority can be adjusted according to the permission processing instruction, the information processing authority is granted or deleted based on the permission processing instruction, and the receiving object is accurately identified to accurately identify the direct target of the permission adjustment, thereby avoiding erroneous operation of permissions on irrelevant objects. At the same time, according to the current information receiving status of the receiving object, it is determined whether it can be adjusted according to the permission processing instruction to ensure the compliance of the permission adjustment. Based on the above steps, the granting and revocation of permissions can be accurately controlled, thereby preventing unauthorized access, protecting electronic ticket data from illegal acquisition or abuse, and achieving the purpose of ensuring the compliance and security of permission adjustment, thereby achieving the technical effect of improving the data security of permission management, and thus solving the technical problem of low data security of permission management in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0022] Figure 1 is a flow chart of a method for updating information query authority according to an embodiment of the present invention;

[0023] Figure 2 is a schematic diagram of an optional dynamic authorization hierarchical structure of an electronic ticket according to an embodiment of the present invention;

[0024] Figure 3 is a schematic diagram of an optional electronic ticket dynamic authorization system according to an embodiment of the present invention;

[0025] Figure 4 is a flow chart of an optional dynamic authorization operation of an electronic ticket according to an embodiment of the present invention;

[0026] Figure 5 It is a schematic diagram of a device for updating information query authority according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] According to an embodiment of the present invention, an embodiment of a method for updating information query permissions is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0030] Figure 1 is a flow chart of a method for updating information query authority according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0031] Step S102, in response to receiving the permission processing instruction corresponding to the target information, obtaining the first identity information of the receiving object, wherein the receiving object is used to represent the object receiving the permission processing instruction, the permission processing instruction is used to represent the instruction to grant or delete the information processing authority of the receiving object, and the information processing authority is used to represent the authority to process the target information.

[0032] The above-mentioned target information may refer to information that requires authority control in the management system, such as information query, information distribution and other control operations. Specifically in the electronic aviation ticket system, the target information may be the data contained in an electronic ticket. For example, the above-mentioned target information may include at least one or more of the following: ticket number, passenger information, flight information, agent information, etc., but is not limited to this.

[0033] The above-mentioned permission processing instruction may be a user input received by the management system, which is used to request to change the access or operation authority to the target information. For example, in the electronic ticket system, the permission processing instruction may be an instruction for an agent to increase the viewing authority of a certain electronic ticket, or an instruction to cancel the authority of a certain agent, but is not limited to this.

[0034] The receiving object may refer to the object directly acted upon by the authority processing instruction, that is, the entity whose authority is authorized or revoked. In the electronic ticket authority management, the receiving object is usually a specific agent or agent entity, but is not limited thereto.

[0035] The first identity information may be information for identity authentication of the recipient. The management system may ensure that the permission processing instruction is issued by a legitimate recipient by verifying the first identity information, thereby preventing the permission from being illegally tampered with.

[0036] The above-mentioned permission processing instruction can be an instruction for changing the receiving object's access or operation authority to information resources. In the dynamic permission management mechanism, the permission processing instruction can adjust the receiving object's information processing authority in real time to meet the ever-changing business needs or security policies.

[0037] The above-mentioned information processing authority may be the authority for the receiving object to access, operate or process the target information.

[0038] In an optional embodiment, considering that it is crucial to identify and verify the identity of the receiving object in authority management, by obtaining the first identity information of the receiving object, the authority management system (hereinafter referred to as the management system) can verify whether the object is qualified to execute the authority processing instruction. For example, whether agent A is truly entitled to dynamically authorize the electronic ticket, or whether agent B has obtained the corresponding authorization to view the electronic ticket information. The above-mentioned authority processing instructions are not limited to simple viewing or denial of access, but can also include operations such as granting, revoking, and modifying permissions. By responding to the authority processing instructions, the management system can dynamically adjust the information processing permissions of the receiving object to the target information according to real-time business needs and authorization status. The dynamic control of the above-mentioned information processing permissions can ensure that only verified and authorized entities can access or operate sensitive information such as electronic ticket personal information, thereby achieving the goal of meeting the needs of business operations while reducing potential information leakage risks and protecting passenger privacy.

[0039] Step S104: based on the first identity information, obtaining the information receiving status of the receiving object, wherein the information receiving status is used to characterize the information processing authority of the receiving object, and whether it can be adjusted according to the authority processing instruction.

[0040] The above-mentioned information receiving status may refer to the status of whether the information processing authority of the receiving object can be adjusted according to the authority processing instruction in the dynamic authority management mechanism.

[0041] In an optional embodiment, based on the above-mentioned first identity information, the management system can accurately locate the current recipient, and by obtaining the information receiving status of the recipient, the management system can determine whether the recipient currently has the information processing authority for the target information, and whether the authority can be adjusted. For example, if the recipient currently has the viewing authority for a certain electronic ticket, when the management system receives the deletion authority instruction, it can identify the information receiving status of the recipient and accurately perform the authority revocation operation to ensure that the authority status is consistent with the business requirements or security policies.

[0042] Step S106: in response to the information receiving status indicating that the information processing authority can be adjusted according to the authority processing instruction, grant or delete the information processing authority based on the authority processing instruction.

[0043] In an optional embodiment, the management system can determine whether the permissions of the receiving object can be adjusted according to the permission processing instruction based on the queried information reception status. If the above information reception status indicates that the information processing permission can be adjusted according to the permission processing instruction, the management system can grant or delete the information processing permission based on the permission processing instruction. If the above information reception status does not allow permission adjustment, the management system can return an error or prompt message indicating the reason why the permission adjustment cannot be performed. The above steps ensure that the permission management has high real-time, accuracy and security, and can adapt to changing business needs and security environments.

[0044] In an embodiment of the present invention, in response to receiving a permission processing instruction corresponding to target information, the first identity information of the receiving object is obtained; based on the first identity information, the information receiving status of the receiving object is obtained; in response to the information receiving status being that the information processing authority can be adjusted according to the permission processing instruction, the information processing authority is granted or deleted based on the permission processing instruction, and the receiving object is accurately identified to accurately identify the direct target of the permission adjustment, thereby avoiding erroneous operation of permissions on irrelevant objects. At the same time, according to the current information receiving status of the receiving object, it is determined whether it can be adjusted according to the permission processing instruction to ensure the compliance of the permission adjustment. Based on the above steps, the granting and revocation of permissions can be accurately controlled, thereby preventing unauthorized access, protecting electronic ticket data from illegal acquisition or abuse, and achieving the purpose of ensuring the compliance and security of permission adjustment, thereby achieving the technical effect of improving the data security of permission management, and thus solving the technical problem of low data security of permission management in related technologies.

[0045] Furthermore, based on the first identity information, the information receiving status of the receiving object is obtained, including: obtaining the second identity information of the sending object, wherein the sending object is used to characterize the object of sending the permission processing instruction; based on the first identity information and the second identity information, determining the first permission relationship between the sending object and the receiving object, wherein the first permission relationship is used to characterize whether the sending object can grant or delete the information processing permission of the receiving object; in response to the first permission relationship being that the sending object can grant or delete the information processing permission, determining that the information receiving status is that the information processing permission can be adjusted according to the permission processing instruction; in response to the first permission relationship being that the sending object cannot grant or delete the information processing permission, determining that the information receiving status is that the information processing permission cannot be adjusted according to the permission processing instruction.

[0046] The above-mentioned sending object may refer to the entity that initiates the permission processing instruction in the system, that is, the user or system component that requests to adjust the information processing authority of the receiving object. For example, in the dynamic authorization scenario of civil aviation electronic tickets, the sending object may be a ticket issuing agent, a booking agent or other authorized agent entity, but not limited to this. The above-mentioned sending object may initiate instructions such as "authorize viewing" or "revoke viewing authority". The above-mentioned second identity information may be information used by the sending object for identity confirmation and authority verification. The management system can use the second identity information to identify the identity of the sending object and determine whether the sending object has the right to adjust the information processing authority of the receiving object. The above-mentioned first authority relationship may be a permission association between the sending object and the receiving object, which may specifically refer to whether the sending object can grant or revoke the information processing authority of the receiving object according to the rules of dynamic authority management.

[0047] In an optional embodiment, the management system obtains the second identity information of the sending object through the permission processing instruction, which can ensure the authenticity and legality of the source of the permission processing instruction. Based on the first identity information and the second identity information, the management system can determine the first permission relationship between the sending object and the receiving object through the permission management rule. For example, in the civil aviation electronic ticket system, the ticket issuing agent has the right to adjust the permissions of the booking agent and the subordinate agent, while the booking agent may only view the electronic ticket information but cannot perform authorized operations. The above steps ensure that only authorized entities can initiate permission processing instructions, prevent unauthorized entities from arbitrarily modifying permissions, and reduce the risk of security vulnerabilities and data leakage. The management system can also determine whether the information receiving state of the receiving object is allowed to be adjusted according to the permission processing instruction based on the determination result of the first permission relationship. If the first permission relationship indicates that the sending object can grant or delete the information processing permission of the receiving object, the management system can determine that the information receiving state can be adjusted according to the permission processing instruction. If the first permission relationship indicates that the sending object cannot grant or delete the information processing permission of the receiving object, the management system can determine that the information receiving state cannot be adjusted according to the permission processing instruction, thereby avoiding illegal changes in permissions. By verifying the first permission relationship, the management system can ensure that the execution of the permission adjustment instruction complies with the permission management rules, thereby avoiding illegal or erroneous permission changes.

[0048] Furthermore, granting or deleting information processing permissions based on permission processing instructions includes: identifying the permission processing instructions, obtaining the instruction type and target processing permissions corresponding to the permission processing instructions, wherein the instruction types include: a first type of permission processing instructions for granting, and a second type of permission processing instructions for deleting, and the target processing permissions are used to characterize permissions that currently need to be updated in the information processing permissions; based on the first identity information, obtaining the current permission status of the target processing permissions, wherein the permission status is used to characterize whether the receiving object currently has the target processing permissions; and authorizing or deleting the target processing permissions based on the instruction type and the permission status.

[0049] The above-mentioned instruction type may be the nature of the permission processing instruction, which is mainly used to distinguish whether it is an operation of increasing or decreasing permissions. The above-mentioned target processing permission may refer to the specific permission pointed to by the permission processing instruction, that is, the information processing permission that currently needs to be updated. The above-mentioned first type may be an instruction type that grants permission to the receiving object, allowing the receiving object to access or operate information resources. The above-mentioned second type may be an instruction type that revokes or deletes the permission of the receiving object, thereby limiting the receiving object's access to or operation of information resources. The above-mentioned permission status may be a status used to describe whether the receiving object currently has the target processing permission.

[0050] In an optional embodiment, after receiving the permission processing instruction, the management system first needs to parse and identify the instruction to extract the instruction type and the target processing authority. Among them, the instruction type includes a first type of permission processing instruction for granting permission, and a second type of permission processing instruction for deleting permission. The target processing authority refers to the access and operation authority for information resources (such as electronic tickets, documents, database records, etc.), including but not limited to viewing, editing, deleting, and authorizing. The above steps are the starting point of the permission update operation, ensuring that the subsequent steps can accurately process the instructions. Subsequently, the management system can query the pre-built permission database based on the first identity information of the receiving object to obtain the current permission status of the target processing authority. The above permission status reflects whether the receiving object already has the target processing authority, as well as the level and scope of the authority. By obtaining the permission status, the management system can determine whether the target processing authority needs to be updated, and the specific method of updating, avoiding repeated granting of permissions or deleting non-existent permissions, thereby reducing conflicts and confusion in the permission management process. Finally, the management system can decide whether to perform the permission update operation and the specific content of the update based on the type of permission processing instruction (granting permission or deleting permission) and the current status of the target processing authority. For example, if the authority status shows that the receiving object currently does not have the target processing authority, the management system can grant the receiving object the corresponding authority according to the instruction. If the authority status shows that the receiving object currently has the target processing authority, the management system can perform a deletion operation to revoke the authority.

[0051] Furthermore, based on the instruction type and the permission status, the target processing permission is authorized or deleted, including: based on the instruction type, determining the expected state corresponding to the permission processing instruction, wherein the expected state is used to characterize the permission state of the target processing permission after the target processing permission is updated; matching the expected state with the permission state to obtain a state matching result; in response to the state matching result being that the expected state and the permission state are different, authorizing or deleting the target processing permission according to the expected state; in response to the state matching result being that the expected state and the permission state are the same, keeping the target processing permission unchanged, and outputting a first prompt message, wherein the first prompt message is used to prompt that the permission state of the sending object is the same as the expected state.

[0052] The above-mentioned expected state may refer to the expected permission state that the target processing permission should be in after the permission processing instruction is executed. The above-mentioned state matching result may refer to the result obtained by comparing the expected state and the current permission state. The state matching result can be used to determine whether the target processing permission needs to be updated, as well as the specific method of updating. The above-mentioned first prompt information may refer to the information output by the management system to the sending object when the state matching result shows that the expected state is the same as the current permission state, which is used to remind the sending object that the target processing permission does not need to be updated and the current permission state has met the expectations of the permission processing instruction.

[0053] In an optional embodiment, the management system first parses the permission processing instruction, and determines the corresponding expected state according to the instruction type (granting permission or deleting permission), and the above-mentioned expected state is the state expected to be achieved after the target processing permission is updated. Subsequently, the management system can query the pre-built permission database to obtain the current permission state of the target processing permission, and the above-mentioned current permission state can be the existing configuration of the receiving object on the target processing permission. The management system can compare the expected state with the current permission state to determine whether the two are consistent. If the state matching result shows that the expected state is different from the current permission state, the management system can perform authorization or deletion operations according to the expected state and update the state of the target processing permission. This dynamic adjustment helps to ensure that the permission configuration is consistent with the current business needs and security policies, and avoids lags or conflicts in permission configuration. If the state matching result shows that the expected state is the same as the current permission state, the management system can keep the target processing permission unchanged and output the first prompt information to inform the sending object that the permission state has met the expectations and no permission update is required. This feedback mechanism can avoid unnecessary permission management operations, reduce resource consumption, and provide information transparency to help the sending object understand the current permission configuration. The above steps can accurately match the expected state and the current permission state, so that the management system can avoid invalid permission update operations and ensure that each permission adjustment is necessary, thereby improving the accuracy and efficiency of permission management.

[0054] Furthermore, the information processing authority includes: information query authority and object authorization authority, wherein the information query authority is used to represent the authority of the receiving object to query the target information, and the object authorization authority is used to represent the authority of the receiving object to send a permission processing instruction.

[0055] The above-mentioned information query permission may refer to the permission of the receiving object to access and view the specified information resources. Such permission control can ensure that sensitive or private data is not accessed by unauthorized entities, while ensuring the transparency and availability of data. The above-mentioned object authorization permission may refer to the permission of the receiving object to execute permission processing instructions on information or objects.

[0056] In an optional embodiment, by accurately configuring information query permissions, the management system can prevent unauthorized entities from accessing sensitive information, such as personal identity information, financial data, or corporate secrets, thereby protecting data security and user privacy. Object authorization permissions allow the receiving object to dynamically adjust the permissions of other entities based on business needs and security policies, enhancing the flexibility and responsiveness of the permission management mechanism. In addition, the control mechanism of object authorization permissions can prevent unauthorized entities from arbitrarily modifying permission configurations, reducing security risks in the permission management process.

[0057] Furthermore, in response to the target processing permission being the object authorization permission and the instruction type being the second type, after deleting the target processing permission according to the expected state, the method also includes: based on the first identity information, obtaining the target object that has a second permission relationship with the receiving object, wherein the second permission relationship is used to characterize that the information processing authority of the target object is related to the permission processing instruction sent by the receiving object; based on the second permission relationship, deleting the information processing instruction of the target object.

[0058] The second permission relationship may be a permission relationship existing between the target object and the receiving object. The second permission relationship indicates that the information processing authority of the target object (such as information query authority, object authorization authority, etc.) is granted or adjusted by the receiving object through the permission processing instruction. The existence of the second permission relationship ensures the traceability and controllability of permission management. The target object may refer to an entity whose information processing authority is affected by the permission processing instruction of the receiving object in the second permission relationship.

[0059] In an optional embodiment, after the management system confirms that the target processing authority is the object authorization authority and the instruction type is the second type, it can query the pre-built authority database to identify the target object that has a second authority relationship with the receiving object. The above target object can refer to those entities that are granted information processing authority through the authority processing instruction sent by the receiving object. Through the above steps, it is ensured that the revocation of authority is not limited to the receiving object, but can be traced down along the authority chain to identify all target objects affected by the receiving object. Subsequently, based on the acquired second authority relationship, the management system can start the authority diffusion revocation mechanism, which will revoke the authority granted by the receiving object to the target object step by step along the authority chain, thereby ensuring that the information processing authority of the target object is consistent with the authority status of the receiving object. Once the authority of the receiving object is revoked, all the authority of the target object authorized by the receiving object will also be deleted. By identifying and processing the second authority relationship between the receiving object and the target object, the management system can effectively prevent the residual influence after the authority revocation, ensure the thoroughness of the authority revocation, avoid the confusion of authority configuration and the risk of data leakage, thereby improving the security of the overall system.

[0060] For ease of understanding, Figure 2 is a schematic diagram of an optional dynamic authorization hierarchical structure of an electronic ticket according to an embodiment of the present invention, such as Figure 2 As shown, the solid-line box in the figure indicates that the current agent has no re-authorization authority, and the dotted-line box indicates that the current agent has re-authorization authority. The structure starts from the top, with the root layer, followed by the authorized first-layer agent nodes, as well as the second-layer agent nodes and the third-layer agent nodes. Theoretically, the layers can continue to expand downward, and only the third layer is shown in the figure. Among them, the root layer includes agent A as the ticket issuing office, and agent B as the booking office. Agent A can authorize the next layer of agents, that is, to authorize agents B1 and B2 in the first layer. Agent B1 in the first layer can further authorize agents C1 and C2 in the second layer, and agent B2 can further authorize agents C3 and C4 in the second layer. Agent C1 in the second layer can first authorize agents D1 and D2 in the third layer, and agent C4 can first authorize agents D3 and D4 in the third layer. Figure 2 It not only shows the hierarchical structure of permission management, but also reflects the chain effect on the permissions of lower-level agent nodes when authorization is revoked.

[0061] Furthermore, the method also includes: in response to receiving an information query request corresponding to the target information, obtaining third identity information of the request object, wherein the request object is used to characterize the object sending the information query request; based on the third identity information, obtaining a target permission status of the information query permission of the request object; in response to the target permission status being that the request object has information query permission, outputting the target information; in response to the target permission status being that the request object does not have information query permission, outputting a second prompt information, wherein the second prompt information is used to characterize the reason why the request object cannot query the target information.

[0062] The above-mentioned request object may be the entity that sends the information query request. In the authority management mechanism, the identity of the request object needs to be clearly identified to facilitate authority verification. The above-mentioned third identity information may be the unique identity identifier of the request object, which is used to determine the identity of the request object. The above-mentioned target authority status may refer to the current authority status of the request object for the target information. The above-mentioned target authority status indicates whether the request object has the ability to access and query the target information, as well as the specific scope of the authority. The above-mentioned second prompt information may be the information returned by the management system to the request object when the request object does not have information query authority. The information explains why the request object cannot query the target information.

[0063] In an optional embodiment, when the management system receives an information query request sent by a requesting object, it will first analyze the request content to determine the target information that the requesting object wishes to query, and then the management system can extract the third identity information of the requesting object from the information query request, and based on the above third identity information, determine the target permission status of the requesting object for the target information. If the target permission status indicates that the requesting object has information query permission, the management system can output the target information to the requesting object according to the permission status to ensure that the authorized requesting object can access the information within the permission scope of the requesting object, thereby meeting business needs. If the target permission status indicates that the requesting object does not have information query permission, the management system can output a second prompt message to explain why the requesting object cannot query the target information. Through strict permission verification, the management system can ensure that private information and data are only visible to authorized entities, thereby improving the security of data access.

[0064] Further, in response to the first permission relationship being that the sending object cannot grant or delete information processing permissions, the method also includes: generating a third prompt message based on the first identity information and information processing permissions, wherein the third prompt message includes the reason why the sending object cannot send permission processing instructions to the receiving object; and sending the third prompt message to the sending object.

[0065] The third prompt information may be information used to explain to the sending object why the permission processing instruction cannot be sent to the receiving object.

[0066] In an optional embodiment, when the management system receives a permission update request, it will immediately check the first identity information and information processing authority of the sending object. If the management system finds that the sending object does not have sufficient authority to perform the permission update operation, it can generate a third prompt information based on the above first identity information and information processing authority. The above third prompt information can clearly indicate that the permission level or role type of the sending object does not allow the permission update operation. After completing the generation of the above third prompt information, the management system can send the third prompt information to the operation interface of the sending object to clearly explain the reason why the permission update of the sending object is limited, thereby preventing possible abuse of authority and protecting the security of data.

[0067] For ease of understanding, Figure 3 is a schematic diagram of an optional electronic ticket dynamic authorization system according to an embodiment of the present invention, such as Figure 3 As shown, the system includes a sales front end, an electronic ticket management system, an electronic ticket dynamic authority processing module, an electronic ticket dynamic authority query module and an electronic ticket database. Among them, the sales front end is the front-end way for operators to implement electronic ticket sales, electronic ticket inquiries and other businesses. The above-mentioned sales front end can include a traditional black screen front end, a web front end, etc. The staff can set it according to actual needs, which is not limited here. The electronic ticket management system is a system that performs electronic ticket operations based on electronic ticket sales data and provides electronic ticket inquiries and management. The electronic ticket dynamic authority processing module can process the dynamic authorization and cancellation of dynamic authorization operations of electronic tickets, and is responsible for writing dynamic authorization information into the electronic ticket database. The electronic ticket dynamic authority query module can process the dynamic authority query operation of electronic tickets, read the electronic ticket database, and thus obtain relevant electronic ticket dynamic authorization information, and return it to the electronic ticket management system. The electronic ticket database can be used to store electronic ticket dynamic authorization information.

[0068] Figure 4 is a flow chart of an optional dynamic authorization operation of an electronic ticket according to an embodiment of the present invention. Figure 4As shown, the process starts from the sales front end. The staff of the sales front end can initiate dynamic permission operations. The electronic ticket management system determines whether the above operation is an authorization query or an authorization operation. If it is an authorization query, the operation is sent to the electronic ticket dynamic permission query module. The module can read the electronic ticket content and determine whether there is permission to query. If the judgment result is that there is permission, the dynamic authorization information of the electronic ticket is queried and the return result content is constructed. If the judgment result is that there is no permission, an error prompt is returned: "No permission to process", and then the electronic ticket dynamic permission query module can return the operation result. If the above dynamic permission operation is an authorization operation, the operation is sent to the dynamic permission processing module of the electronic ticket. The module can read the content of the electronic ticket and determine whether the current agent has the permission. If the judgment result is no permission, an error message is returned: "No permission to process". If the judgment result is permission, it is further determined whether the current operation is to increase authorization or cancel authorization. If it is to increase authorization, the authorization is granted to the lower-level agent, and it is specified whether the authorized agent can authorize downward. If it is to cancel authorization, the permission of the authorized agent is canceled, and all the permissions authorized by the agent are canceled. Subsequently, the dynamic permission processing module of the electronic ticket returns the operation success information and the operation result. Then, the electronic ticket management system can obtain and construct the return result, and the sales front end can display the operation result information and end the process.

[0069] According to an embodiment of the present invention, an embodiment of an apparatus for updating information query authority is provided. It should be noted that the apparatus can be used to execute the above-mentioned method for updating information query authority. The specific implementation and application scenario are the same as those of the above-mentioned embodiment, and will not be described in detail here. Figure 5 is a schematic diagram of a device for updating information query authority according to an embodiment of the present invention, such as Figure 5 As shown, the device comprises:

[0070] The first acquisition module 502 is used to obtain the first identity information of the receiving object in response to receiving the permission processing instruction corresponding to the target information, wherein the receiving object is used to represent the object receiving the permission processing instruction, the permission processing instruction is used to represent the instruction to grant or delete the information processing authority of the receiving object, and the information processing authority is used to represent the authority to process the target information.

[0071] The second acquisition module 504 is used to acquire the information receiving status of the receiving object based on the first identity information, wherein the information receiving status is used to represent the information processing authority of the receiving object and whether it can be adjusted according to the authority processing instruction.

[0072] The authority control module 506 is used to grant or delete the information processing authority based on the authority processing instruction in response to the information receiving status indicating that the information processing authority can be adjusted according to the authority processing instruction.

[0073] Furthermore, the second acquisition module is also used to: acquire the second identity information of the sending object, wherein the sending object is used to characterize the object of sending the permission processing instruction; determine the first permission relationship between the sending object and the receiving object based on the first identity information and the second identity information, wherein the first permission relationship is used to characterize whether the sending object can grant or delete the information processing permission of the receiving object; in response to the first permission relationship being that the sending object can grant or delete the information processing permission, determine that the information receiving status is that the information processing permission can be adjusted according to the permission processing instruction; in response to the first permission relationship being that the sending object cannot grant or delete the information processing permission, determine that the information receiving status is that the information processing permission cannot be adjusted according to the permission processing instruction.

[0074] Furthermore, the permission control module is also used to: identify the permission processing instructions, obtain the instruction type and target processing authority corresponding to the permission processing instructions, wherein the instruction type includes: a first type of permission processing instruction for granting, and a second type of permission processing instruction for deleting, the target processing authority is used to characterize the authority that currently needs to be updated in the information processing authority; based on the first identity information, obtain the current permission status of the target processing authority, wherein the permission status is used to characterize whether the receiving object currently has the target processing authority; based on the instruction type and the permission status, authorize or delete the target processing authority.

[0075] Furthermore, the permission control module is also used to: determine the expected state corresponding to the permission processing instruction based on the instruction type, wherein the expected state is used to characterize the permission state of the target processing permission after the target processing permission is updated; match the expected state with the permission state to obtain a state matching result; in response to the state matching result being that the expected state and the permission state are different, authorize or delete the target processing permission according to the expected state; in response to the state matching result being that the expected state and the permission state are the same, keep the target processing permission unchanged, and output a first prompt message, wherein the first prompt message is used to prompt that the permission state of the sending object is the same as the expected state.

[0076] Furthermore, the information processing authority includes: information query authority and object authorization authority, wherein the information query authority is used to represent the authority of the receiving object to query the target information, and the object authorization authority is used to represent the authority of the receiving object to send a permission processing instruction.

[0077] Further, in response to the target processing permission being the object authorization permission and the instruction type being the second type, after deleting the target processing permission according to the expected state, the device also includes: a third acquisition module, used to acquire, based on the first identity information, the target object that has a second permission relationship with the receiving object, wherein the second permission relationship is used to characterize that the information processing authority of the target object is related to the permission processing instruction sent by the receiving object; based on the second permission relationship, the information processing instruction of the target object is deleted.

[0078] Furthermore, the device also includes: a fourth acquisition module, used to obtain the third identity information of the request object in response to receiving an information query request corresponding to the target information, wherein the request object is used to characterize the object sending the information query request; a fifth acquisition module, used to obtain the target permission status of the information query permission of the request object based on the third identity information; in response to the target permission status being that the request object has information query permission, output the target information; a first output module, used to output a second prompt information in response to the target permission status being that the request object does not have information query permission, wherein the second prompt information is used to characterize the reason why the request object cannot query the target information.

[0079] Further, in response to the first permission relationship being that the sending object cannot grant or delete information processing permissions, the device also includes: an information generation module, used to generate a third prompt message based on the first identity information and information processing permissions, wherein the third prompt message includes the reason why the sending object cannot send permission processing instructions to the receiving object; an information sending module, used to send the third prompt message to the sending object.

[0080] An embodiment of the present application further provides an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the program executes the methods in various embodiments of the present invention when running.

[0081] An embodiment of the present application further provides a computer-readable storage medium, which includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the methods in various embodiments of the present invention.

[0082] An embodiment of the present application further provides a computer program product, including a computer program, which implements the methods in various embodiments of the present invention when executed by a processor.

[0083] An embodiment of the present application further provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, the method in each embodiment of the present invention is implemented.

[0084] The embodiments of the present application further provide a computer program, which implements the methods in the above-mentioned embodiments of the present invention when executed by a processor.

[0085] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0086] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0087] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0088] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0089] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0090] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for updating information query authority, characterized in that: include: In response to receiving a permission processing instruction corresponding to the target information, obtaining first identity information of a receiving object, wherein the receiving object is used to represent the object receiving the permission processing instruction, the permission processing instruction is used to represent an instruction to grant or delete information processing permission for the receiving object, and the information processing permission is used to represent permission to process the target information; Based on the first identity information, acquiring the information receiving status of the receiving object, wherein the information receiving status is used to indicate whether the information processing authority of the receiving object can be adjusted according to the authority processing instruction; In response to the information reception status indicating that the information processing authority can be adjusted according to the authority processing instruction, the information processing authority is granted or deleted based on the authority processing instruction.

2. The method according to claim 1, characterized in that Acquiring the information receiving status of the receiving object based on the first identity information includes: Acquire second identity information of a sending object, wherein the sending object is used to represent the object to which the permission processing instruction is sent; Determine a first permission relationship between the sending object and the receiving object based on the first identity information and the second identity information, wherein the first permission relationship is used to indicate whether the sending object can grant or delete the information processing permission of the receiving object; In response to the first permission relationship being that the sending object can grant or delete the information processing permission, determining that the information receiving state is that the information processing permission can be adjusted according to the permission processing instruction; In response to the first permission relationship being that the sending object cannot grant or delete the information processing permission, it is determined that the information receiving status is that the information processing permission cannot be adjusted according to the permission processing instruction.

3. The method according to claim 1, characterized in that Granting or deleting the information processing permission based on the permission processing instruction includes: Identify the permission processing instruction to obtain the instruction type and target processing permission corresponding to the permission processing instruction, wherein the instruction type includes: a first type of granting the permission processing instruction and a second type of deleting the permission processing instruction, and the target processing permission is used to represent the permission that currently needs to be updated in the information processing permission; Based on the first identity information, obtaining the current permission status of the target processing permission, wherein the permission status is used to indicate whether the receiving object currently has the target processing permission; Based on the instruction type and the permission status, the target processing permission is authorized or deleted.

4. The method according to claim 3, characterized in that Based on the instruction type and the permission status, authorizing or deleting the target processing permission includes: Based on the instruction type, determining an expected state corresponding to the permission processing instruction, wherein the expected state is used to represent the permission state of the target processing permission after the target processing permission is updated; Matching the expected state with the permission state to obtain a state matching result; In response to the state matching result being that the expected state is different from the permission state, authorizing or deleting the target processing permission according to the expected state; In response to the state matching result being that the expected state is the same as the permission state, the target processing permission is kept unchanged, and a first prompt message is output, wherein the first prompt message is used to prompt the sending object that the permission state is the same as the expected state.

5. The method according to claim 4, characterized in that The information processing authority includes: information query authority and object authorization authority. The information query permission is used to represent the permission of the receiving object to query the target information, and the object authorization permission is used to represent the permission of the receiving object to send the permission processing instruction.

6. The method according to claim 5, characterized in that In response to the target processing permission being the object authorization permission and the instruction type being the second type, after deleting the target processing permission according to the expected state, the method further includes: Based on the first identity information, acquiring a target object having a second permission relationship with the receiving object, wherein the second permission relationship is used to represent that the information processing permission of the target object is related to the permission processing instruction sent by the receiving object; Based on the second permission relationship, the information processing instruction of the target object is deleted.

7. The method according to claim 5, characterized in that The method further comprises: In response to receiving an information query request corresponding to the target information, obtaining third identity information of a request object, wherein the request object is used to represent an object sending the information query request; Based on the third identity information, obtaining a target permission status of the information query permission of the request object; In response to the target permission status indicating that the requesting object has the information query permission, outputting the target information; In response to the target permission status being that the requesting object does not have the information query permission, second prompt information is output, wherein the second prompt information is used to indicate the reason why the requesting object cannot query the target information.

8. The method according to claim 2, characterized in that: In response to the first permission relationship being that the sending object cannot grant or delete the information processing permission, the method further includes: Based on the first identity information and the information processing authority, generating third prompt information, wherein the third prompt information includes the reason why the sending object cannot send the authority processing instruction to the receiving object; The third prompt information is sent to the sending object.

9. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 7 when running.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

Images