A method, device and related equipment for controlling authority of a message management system

Abstract

The present application discloses a permission control method, apparatus and related equipment for a message management system. In response to a user requesting a permission operation, the method queries the user role and the corresponding permission of the user requesting the permission operation through a pre-designed hierarchical permission model and a role-based access control model, wherein the hierarchical permission model is determined by a role table, a permission table, a role permission table, a user role table and a dynamic rule table, and permissions are dynamically allocated to user roles through dynamic permission rules and the permissions, wherein the dynamic permission rules are determined by a permission policy set, and the permission policy set is a dynamic permission trigger policy set pre-defined by the message management system, and permission verification is performed on the allocated permissions.

Description

Technical Field

[0001] The present application relates to the technical field of authority control processing, and more specifically, to an authority control method, apparatus and related equipment for a message management system. Background Art

[0002] The permission management system is a very important part of the enterprise management system. It is mainly used to control the user's access rights to system resources to ensure the security of the system and the confidentiality of data. The permission management system controls the functions that different users can use and the information they can view by setting different user roles and assigning permissions to these roles.

[0003] However, the existing permission management system is mainly based on static role permissions, which makes it difficult to quickly respond to business changes. In addition, data permission management is often tightly coupled with business code, which lacks flexibility.

[0004] Therefore, how to improve the flexibility of the permission control processing of the permission management system and quickly respond to business changes of the permission management system are problems that need to be urgently solved in this application. Summary of the invention

[0005] In view of this, the present application discloses a permission control method, apparatus and related equipment for a message management system, aiming to improve the flexibility of permission control processing of the permission management system and achieve the purpose of quickly responding to business changes of the permission management system.

[0006] In order to achieve the above purpose, the disclosed technical solution is as follows:

[0007] In a first aspect, the present application discloses a method for controlling permissions of a message management system, the method comprising:

[0008] In response to a user requesting a permission operation, query the user role and the corresponding permission of the user requesting the permission operation through a pre-designed hierarchical permission model and a role-based access control model; wherein the hierarchical permission model is determined by a role table, a permission table, a role permission table, a user role table, and a dynamic rule table;

[0009] Dynamically assign permissions to the user role through dynamic permission rules and the permissions; wherein the dynamic permission rules are determined by a permission policy set; the permission policy set is a dynamic permission triggering policy set predefined by the message management system;

[0010] Perform permission verification on the assigned permissions.

[0011] Preferably, the process of designing a hierarchical permission model includes:

[0012] Define all roles within the message management system to complete the design of the role table;

[0013] Define the permission operations corresponding to all roles to complete the design of the permission table;

[0014] Define the many-to-many mapping of all roles and permissions to complete the design of the role permission table;

[0015] Define a many-to-many mapping between all roles and users to complete the design of the user role table;

[0016] Define and store dynamic permission rules to complete the design of the dynamic rule table.

[0017] Preferably, dynamically allocating permissions to the user role through dynamic permission rules and the belonging permissions includes:

[0018] Obtain the available time and number of allowed accesses of the permission corresponding to the permission operation requested by the access user;

[0019] Permissions are dynamically allocated to the user role based on a rule engine, the length of time the permissions are available, and the number of allowed accesses.

[0020] Preferably, the permission verification of the allocated permissions includes:

[0021] The assigned permissions are checked through the middleware; wherein the permission check includes at least functional permission check and dynamic permission rule check.

[0022] Preferably, it also includes:

[0023] Customize data permissions for roles and / or functional permissions through the role management interface.

[0024] The second aspect of the present application discloses a permission control device for a message management system, the device comprising:

[0025] A response query unit, used to query the user role and the corresponding permissions of the permission operation requested by the user in response to the user requesting the permission operation through a pre-designed hierarchical permission model and a role-based access control model; wherein the hierarchical permission model is determined by a role table, a permission table, a role permission table, a user role table and a dynamic rule table;

[0026] A dynamic allocation unit, used to dynamically allocate permissions to the user role through dynamic permission rules and the belonging permissions; wherein the dynamic permission rules are determined by a permission policy set; the permission policy set is a dynamic permission triggering policy set predefined by the message management system;

[0027] The permission verification unit is used to verify the permissions after allocation.

[0028] Preferably, the response query unit of the hierarchical authority model is designed, including:

[0029] The first definition module is used to define all roles in the message management system to complete the design of the role table;

[0030] The second definition module is used to define the permission operations corresponding to all roles to complete the design of the permission table;

[0031] The third definition module is used to define the many-to-many mapping of all roles and permissions to complete the design of the role permission table;

[0032] The fourth definition module is used to define the many-to-many mapping between all roles and users to complete the design of the user role table;

[0033] The fifth definition module is used to define and store dynamic permission rules to complete the design of the dynamic rule table.

[0034] Preferably, dynamically allocating permissions to the user role through dynamic permission rules and the belonging permissions includes:

[0035] An acquisition module is used to obtain the permission availability time and the number of allowed access times of the corresponding permission of the access user requesting the permission operation;

[0036] The allocation module is used to dynamically allocate permissions to the user role based on the rule engine, the duration of the permission availability and the number of allowed accesses.

[0037] A third aspect of the present application discloses a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the permission control method of the message management system as described in any one of the first aspects.

[0038] The fourth aspect of the present application discloses an electronic device, comprising a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors as the permission control method of the message management system as described in any one of the first aspects.

[0039] It can be known from the above technical scheme that the present application discloses a permission control method, apparatus and related equipment for a message management system. In response to a user requesting a permission operation, the user role and the corresponding permission of the user requesting the permission operation are queried through a pre-designed hierarchical permission model and a role-based access control model, wherein the hierarchical permission model is determined by a role table, a permission table, a role permission table, a user role table and a dynamic rule table, and permissions are dynamically allocated to user roles through dynamic permission rules and the permissions, wherein the dynamic permission rules are determined by a permission policy set, and the permission policy set is a dynamic permission trigger policy set predefined by the message management system, and permission verification is performed on the allocated permissions.

[0040] Through the above solution, dynamic permission rules, refined low-coupled data permission control, rule engine, and audit and tracking functions of permission operations are introduced. Because dynamic permission rules support dynamic adjustment of permissions based on time, users, customers or tasks. Refined low-coupled data permission control supports data permission control at all data levels of addition, deletion, modification and query, and combined with the rule engine, the definition of data permissions is more flexible and scalable, thereby improving the flexibility of permission control processing in the permission management system. In addition, this solution enhances the audit and tracking functions of permission operations, making the use of permissions more transparent, supporting compliance and auditing, and combining the hierarchical permission model, role-based access control model and policy mode to improve the system's ability to adapt to complex business scenarios and achieve the purpose of quickly responding to business changes in the permission management system. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0042] Figure 1 A schematic diagram of the structure of the message management system disclosed in the embodiment of the present application;

[0043] Figure 2 A flowchart of a method for controlling permissions of a message management system disclosed in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of the structure of a permission control device of a message management system disclosed in an embodiment of the present application;

[0045] Figure 4 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0048] As can be seen from the background technology, the existing permission management system is mainly based on static role permissions, which makes it difficult to quickly respond to business changes. In addition, data permission management is often strongly coupled with business codes and lacks flexibility. Therefore, how to improve the flexibility of permission control processing in the permission management system and quickly respond to business changes in the permission management system are problems that need to be solved in this application.

[0049] In order to solve the above problems, the present application discloses a permission control method, device and related equipment for a message management system. The present application introduces dynamic permission rules, refined low-coupled data permission control, rule engine, and audit and tracking functions of permission operations. Because dynamic permission rules support dynamic adjustment of permissions according to time, user, customer or task. Refined low-coupled data permission control supports data permission control of all data levels of addition, deletion, modification and query, and combined with the rule engine, the definition of data permissions is more flexible and scalable, thereby improving the flexibility of permission control processing of the permission management system. In addition, this solution enhances the audit and tracking functions of permission operations, making the use of permissions more transparent, supporting compliance and auditing, and combining the hierarchical permission model, role-based access control model and policy mode, improving the system's ability to adapt to complex business scenarios, and achieving the purpose of quickly responding to business changes in the permission management system. The specific implementation method is specifically described through the following embodiments.

[0050] refer to Figure 1 , which is a schematic diagram of the structure of a message management system disclosed in an embodiment of the present application, wherein the message management system includes a permission management module, a rule engine module, an audit module and a user operation module.

[0051] The data processing process between the authority management module, rule engine module, audit module and user operation module is as follows:

[0052] The permission management module is used to define a pre-designed hierarchical permission model and supports static and dynamic permission allocation.

[0053] Specifically, the permission management module is used to respond to user requests for permission operations, and query the user role and permissions corresponding to the user's requested permission operations through a pre-designed hierarchical permission model and role-based access control model (RBAC); if the user's requested permission operation involves multiple permissions, a permission set is formed.

[0054] Among them, the hierarchical permission model is determined by the role table, permission table, role permission table, user role table and dynamic rule table; the role table is used to define all roles in the system, such as administrator, customer service, sales and other roles; the permission table is used to store the permission operations available in the message management system, such as adding roles, sending messages, viewing messages and other permission operations; the role permission table is used to store the many-to-many mapping relationship between roles and permissions, associating roles with permissions, and one role can have multiple permissions; the user role table is used to store the many-to-many mapping relationship between users and roles, associating users with roles, and one user can have multiple roles; the dynamic rule table is used to store dynamic permission triggering rules.

[0055] The process of designing a hierarchical permissions model is as follows:

[0056] Define all roles within the message management system to complete the design of the role table;

[0057] Define the permission operations corresponding to all roles to complete the design of the permission table;

[0058] Define the many-to-many mapping of all roles and permissions to complete the design of the role permission table;

[0059] Define a many-to-many mapping between all roles and users to complete the design of the user role table;

[0060] Define and store dynamic permission rules (dynamic permission rules support dynamic adjustment of permissions based on time, users, customers or tasks) to complete the design of the dynamic rule table.

[0061] It should be noted that the hierarchical permission model covers system-level permissions, module-level permissions, and data-level permissions, and supports more sophisticated permission management. In the hierarchical permission model, user permissions are managed through roles. Users can be assigned one or more roles, each with corresponding permissions. When a user requests to perform an operation, the message management system checks the roles the user has and the permissions these roles have to determine whether the user has the right to perform the operation.

[0062] System-level permissions include system settings and user management; module-level permissions include message modules and customer modules; data-level permissions include only access to certain customers' data.

[0063] Permissions are granted through roles, and roles are associated with users.

[0064] Permission management refers to limiting the access rights of different users to data and functions in the system by controlling their access levels. Permission management is usually implemented through the RBAC model, and different roles have different permissions, such as administrators, customer service personnel, and sales. Specifically, permission management is based on the security rules or security policies set by the system, and users can and can only access the resources they are authorized to access. The permission management system controls the user's access scope and operation rights to system resources by verifying the user's identity and assigning permissions. It mainly includes three basic functions: authentication, authorization, and auditing.

[0065] The role-based access control model is a permission management model strategy that assigns permissions based on the user's role. Each role is bound to a specific set of permissions, and users obtain corresponding access rights based on their roles, thereby achieving efficient permission control and security.

[0066] The steps to query the user role and permissions corresponding to the permission operation requested by the user are as follows:

[0067] 1. User authentication: First, the message management system needs to authenticate the user to determine the user's identity.

[0068] 2. Role acquisition: If the user's identity is confirmed, the message management system searches for all roles owned by the user.

[0069] 3. Permission acquisition: For each role, the message management system searches for all permissions that role has.

[0070] 4. Permission check: The system will check whether the operation requested by the user is within the permissions the user has. If there are multiple permissions, the permission set will be obtained.

[0071] The permission management module is used to dynamically assign permissions to user roles through dynamic permission rules and permissions; the dynamic permission rules are determined by a permission policy set (Policy); the permission policy set is a dynamic permission trigger policy set predefined by the message management system. Specifically, the permission management module is used to obtain the permission availability duration and the number of allowed accesses of the permissions corresponding to the permission operation requested by the access user, and dynamically assign permissions to user roles based on the rule engine module, the permission availability duration and the number of allowed accesses. For example, if the user enters an incorrect password three times, triggering subsequent operations, the rule engine module uses the dynamic permission rule engine (dynamic permission rules can be made for specific permission requirements) to limit the user's retry time. After the user requests a permission, the permission availability duration / number of accesses can be dynamically specified, and temporary permissions can be assigned to a user.

[0072] It should be noted that dynamic allocation of permissions can be done through the policy interface, by configuring dynamic permission rules, such as restricting specific users from operating during non-working hours, and dynamically allocating permissions to user roles.

[0073] There are also other ways to assign permissions to user roles, such as static permission assignment and data permission assignment. Assign roles and permissions in the system settings interface to implement static permission assignment. Through the role management interface, customize the data permissions of a role or a function permission to implement data permission assignment.

[0074] The permission policy set can dynamically adjust permissions by account, time, location, contact, conversation, etc. After the rule restriction is triggered, the system can dynamically trigger subsequent tasks to limit user permissions.

[0075] The rule engine module is responsible for parsing and executing dynamic permission rules. It supports dynamic adjustment of permissions based on time, location, user behavior, etc., and generates temporary permissions. The rule engine module implements centralized management of data permission logic and reduces coupling with business logic.

[0076] The data permission verification module is used to ensure the target data operation permission; the data permission verification module is used to verify the permission (such as time, location conditions, etc.) according to the dynamic permission rules; specifically, the data permission verification module verifies the assigned permissions through the middleware; wherein, the permission verification includes at least functional permission verification and dynamic permission rule verification.

[0077] Policy is a set of dynamic permission triggering policies predefined by the system. Policy is usually described using a grammatical structure. For example, a policy is defined as: user condition, behavior condition, trigger dynamic permission rule: If a user with the sales role (user.role=saler) sends more than 3 banned words within 2 hours (time=120m &sensitivewords>=3), the user's permission to send messages will be disabled for 30 minutes (forbidden:message, time=30m).

[0078] When a message is received from a certain user, in response to the message to trigger the Policy, a rule appears in the dynamic permission rules that restricts the user's permission to send messages / send messages to a specific user.

[0079] In the implementation of the message management system, the functional permissions and dynamic permission rule verification are completed through the middleware. The code for checking the permissions after allocation through the middleware is as follows:

[0080] public function handle($request,Closure $next)

[0081] {

[0082] $user = auth()->user();

[0083] $action = $request->route()->getActionName();

[0084] / / Get the permissions of the user role

[0085] $permissions = $user->roles->flatMap->permissions->pluck('name');

[0086] / / Dynamic permission check

[0087] $dynamicRulePass = $this->checkDynamicRules($user, $action):

[0088] if($permissions->contains($action)&&$dynamicRulePass){

[0089] return $next($request);

[0090] }

[0091] abort(403,'Unauthorized action.');

[0092] }.

[0093] It should be noted that data permission verification implements model proxy through model aspects. Before calling the data model to perform query and write operations, the system automatically calls the rule engine to verify data permissions and is not coupled with the business code.

[0094] The audit module is used to record all operations of permission allocation, adjustment and use, ensure the traceability of permission use, and return the results to the user operation module. The audit module supports refined logging to facilitate problem tracking and compliance management.

[0095] The user operation module is used to implement user behavior permission verification and execution based on the return results of all operations of permission allocation, adjustment and use.

[0096] Currently, most systems on the market use hard-coded systems, which tightly couple data permission logic with business code in the form of if / else, and are scattered throughout the system. As the system is constantly modified, vulnerabilities gradually increase. This application centralizes the permission logic and sets and parses it by a professional rule engine module. The business logic calls the rule engine to obtain the permission result, which not only decouples the permission and business logic, but also solves the problem that data permissions cannot be freely controlled and expanded by enterprises.

[0097] In traditional permission management systems, users need to log in to an administrator account or have an administrator role if they need to temporarily access administrator functions. This application can grant users a certain permission temporarily through temporary rules, which is implemented by granting roles or permissions with a time limit; soft coding of data permissions to reduce coupling with business systems; dynamic handover and allocation mechanism of data permissions through rule engines; and permission isolation mechanism (the same user has different roles and permissions in different projects / modules).

[0098] This application introduces dynamic permission rules to support dynamic adjustment of permissions based on time, user, customer or task. A hierarchical permission model (system level, module level, data level) is proposed to control permissions in a more refined manner. Refined low-coupling data permission control is introduced to support data permission control at all data levels of addition, deletion, modification and query. Combined with the rule engine module, the definition of data permissions is more flexible and scalable. The audit and tracking functions of permission operations are enhanced to make the use of permissions more transparent and support compliance and auditing. Combining the RBAC model with Policy, the system's ability to adapt to complex business scenarios is improved.

[0099] The present application provides a message management system with multi-level permissions based on dynamic permission rules. A complete message management system usually includes elements such as users, roles, resources, and permissions. Through these elements and models, the permission management system can achieve flexible permission allocation and management to ensure the security and efficient operation of the system. It aims to solve the problems of insufficient granularity, lack of dynamism, and excessive coupling between permission logic and business code in permission management in the prior art, and to achieve efficient, secure, and flexible permission allocation and management. The present application proposes a dynamic permission rule engine that supports real-time permission adjustment based on policy triggers. A low-coupling data permission verification mechanism is implemented to support flexible data-level permission definitions. Through the integrated audit module, real-time linkage with permission operations is achieved to ensure transparent permission usage.

[0100] refer to Figure 2 As shown, a permission control method for a message management system disclosed in an embodiment of the present application is provided. The permission control method for the message management system mainly includes the following steps:

[0101] S201: In response to a user requesting a permission operation, query the user role and the corresponding permissions of the permission operation requested by the user through a pre-designed hierarchical permission model and a role-based access control model; wherein the hierarchical permission model is determined by a role table, a permission table, a role permission table, a user role table and a dynamic rule table.

[0102] The specific process of designing a hierarchical permission model is shown in A1-A5.

[0103] A1: Define all roles in the message management system to complete the design of the role table.

[0104] A2: Define the permission operations corresponding to all roles to complete the design of the permission table.

[0105] A3: Define a many-to-many mapping between all roles and permissions to complete the design of the role permission table.

[0106] A4: Define a many-to-many mapping between all roles and users to complete the design of the user role table.

[0107] A5: Define and store dynamic permission rules to complete the design of the dynamic rule table.

[0108] S202: Dynamically assign permissions to user roles through dynamic permission rules and permissions; wherein the dynamic permission rules are determined by a permission policy set; the permission policy set is a dynamic permission triggering policy set predefined by the message management system.

[0109] In S202, the permission available time and the number of allowed accesses of the permission corresponding to the permission operation requested by the access user are obtained, and permissions are dynamically allocated to the user role according to the rule engine, the permission available time and the number of allowed accesses.

[0110] Optionally, assign permissions to user roles through static permission rules.

[0111] S203: Performing permission verification on the assigned permissions.

[0112] In S203, the assigned permissions are checked by the middleware; wherein the permission check at least includes a functional permission check and a dynamic permission rule check.

[0113] The execution process and execution principle of S201-S203 are similar to those in the above embodiment. Figure 1 The execution process and execution principle of the public message management system are consistent, which can be used as a reference and will not be repeated here.

[0114] Beneficial effects of the embodiments of the present application: The present application introduces dynamic permission rules, refined low-coupled data permission control, a rule engine, and audit and tracking functions for permission operations. Because dynamic permission rules support dynamic adjustment of permissions based on time, users, customers, or tasks. Refined low-coupled data permission control supports data permission control at all data levels for adding, deleting, modifying, and checking, and combined with the rule engine, the definition of data permissions is more flexible and scalable, thereby improving the flexibility of permission control processing in the permission management system. In addition, this solution enhances the audit and tracking functions of permission operations, making the use of permissions more transparent, supporting compliance and auditing, and combining the hierarchical permission model, the role-based access control model, and the policy model to improve the system's ability to adapt to complex business scenarios and achieve the purpose of quickly responding to business changes in the permission management system.

[0115] Based on the permission control method of a message management system disclosed in the above embodiment, the embodiment of the present application also discloses a permission control device of a message management system, such as Figure 3 As shown, the authority control device of the message management system includes:

[0116] The response query unit 301 is used to query the user role and the corresponding permission of the user request permission operation through the pre-designed hierarchical permission model and the role-based access control model in response to the user request permission operation; wherein the hierarchical permission model is determined by the role table, the permission table, the role permission table, the user role table and the dynamic rule table;

[0117] The dynamic allocation unit 302 is used to dynamically allocate permissions to the user role through dynamic permission rules and the permissions; wherein the dynamic permission rules are determined by a permission policy set; the permission policy set is a dynamic permission triggering policy set predefined by the message management system;

[0118] The permission checking unit 303 is used to perform permission checking on the allocated permissions.

[0119] Furthermore, a response query unit of the hierarchical permission model is designed, including:

[0120] The first definition module is used to define all roles in the message management system to complete the design of the role table;

[0121] The second definition module is used to define the permission operations corresponding to all roles to complete the design of the permission table;

[0122] The third definition module is used to define the many-to-many mapping of all roles and permissions to complete the design of the role permission table;

[0123] The fourth definition module is used to define the many-to-many mapping between all roles and users to complete the design of the user role table;

[0124] The fifth definition module is used to define and store dynamic permission rules to complete the design of the dynamic rule table.

[0125] Furthermore, the dynamic allocation authority unit 302 includes:

[0126] An acquisition module is used to obtain the permission availability time and the number of allowed access times of the corresponding permission of the access user requesting the permission operation;

[0127] The allocation module is used to dynamically allocate permissions to user roles based on the rule engine, the length of time the permissions are available, and the number of allowed accesses.

[0128] Furthermore, the permission verification unit 303 is specifically used to perform permission verification on the allocated permissions through the middleware; wherein the permission verification at least includes functional permission verification and dynamic permission rule verification.

[0129] Furthermore, it also includes:

[0130] Customization unit, used to customize data permissions of roles and / or functional permissions through the role management interface.

[0131] Beneficial effects of the embodiments of the present application: The present application introduces dynamic permission rules, refined low-coupled data permission control, a rule engine, and audit and tracking functions for permission operations. Because dynamic permission rules support dynamic adjustment of permissions based on time, users, customers, or tasks. Refined low-coupled data permission control supports data permission control at all data levels for adding, deleting, modifying, and checking, and combined with the rule engine, the definition of data permissions is more flexible and scalable, thereby improving the flexibility of permission control processing in the permission management system. In addition, this solution enhances the audit and tracking functions of permission operations, making the use of permissions more transparent, supporting compliance and auditing, and combining the hierarchical permission model, the role-based access control model, and the policy model to improve the system's ability to adapt to complex business scenarios and achieve the purpose of quickly responding to business changes in the permission management system.

[0132] An embodiment of the present application further provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the permission control method of the message management system as described above.

[0133] The present application also provides an electronic device, whose structural diagram is as follows: Figure 4 As shown, it specifically includes a memory 401 and one or more instructions 402, wherein the one or more instructions 402 are stored in the memory 401 and are configured to be executed by one or more processors 403 to execute the one or more instructions 402 to execute the permission control method of the above-mentioned message management system.

[0134] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0135] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0136] The steps in the methods of the embodiments of the present application can be adjusted in order, combined, and deleted according to actual needs.

[0137] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0138] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0139] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for controlling authority of a message management system, characterized in that: The method comprises: In response to a user requesting a permission operation, query the user role and the corresponding permission of the user requesting the permission operation through a pre-designed hierarchical permission model and a role-based access control model; wherein the hierarchical permission model is determined by a role table, a permission table, a role permission table, a user role table, and a dynamic rule table; Dynamically assign permissions to the user role through dynamic permission rules and the permissions; wherein the dynamic permission rules are determined by a permission policy set; the permission policy set is a dynamic permission triggering policy set predefined by the message management system; Perform permission verification on the assigned permissions.

2. The method according to claim 1, characterized in that The process of designing a hierarchical permissions model includes: Define all roles within the message management system to complete the design of the role table; Define the permission operations corresponding to all roles to complete the design of the permission table; Define the many-to-many mapping of all roles and permissions to complete the design of the role permission table; Define a many-to-many mapping between all roles and users to complete the design of the user role table; Define and store dynamic permission rules to complete the design of the dynamic rule table.

3. The method according to claim 1, characterized in that The dynamically allocating permissions to the user role through the dynamic permission rules and the belonging permissions includes: Obtain the available time and number of allowed accesses of the permission corresponding to the permission operation requested by the access user; Permissions are dynamically allocated to the user role based on a rule engine, the length of time the permissions are available, and the number of allowed accesses.

4. The method according to claim 1, characterized in that: The permission verification of the allocated permissions includes: The assigned permissions are checked through the middleware; wherein the permission check includes at least functional permission check and dynamic permission rule check.

5. The method according to claim 1, characterized in that: Also includes: Customize data permissions for roles and / or functional permissions through the role management interface.

6. A permission control device for a message management system, characterized in that: The device comprises: A response query unit, used to query the user role and the corresponding permissions of the permission operation requested by the user in response to the user requesting the permission operation through a pre-designed hierarchical permission model and a role-based access control model; wherein the hierarchical permission model is determined by a role table, a permission table, a role permission table, a user role table and a dynamic rule table; A dynamic allocation unit, used to dynamically allocate permissions to the user role through dynamic permission rules and the belonging permissions; wherein the dynamic permission rules are determined by a permission policy set; the permission policy set is a dynamic permission triggering policy set predefined by the message management system; The permission verification unit is used to verify the permissions after allocation.

7. The device according to claim 6, characterized in that Design a response query unit for the hierarchical permission model, including: The first definition module is used to define all roles in the message management system to complete the design of the role table; The second definition module is used to define the permission operations corresponding to all roles to complete the design of the permission table; The third definition module is used to define the many-to-many mapping of all roles and permissions to complete the design of the role permission table; The fourth definition module is used to define the many-to-many mapping between all roles and users to complete the design of the user role table; The fifth definition module is used to define and store dynamic permission rules to complete the design of the dynamic rule table.

8. The device according to claim 6, characterized in that The dynamically allocating permissions to the user role through the dynamic permission rules and the belonging permissions includes: An acquisition module is used to obtain the permission availability time and the number of allowed access times of the corresponding permission of the access user requesting the permission operation; The allocation module is used to dynamically allocate permissions to the user role based on the rule engine, the duration of the permission availability and the number of allowed accesses.

9. A storage medium, characterized in that: The storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the permission control method of the message management system according to any one of claims 1 to 5.

10. An electronic device, characterized in that: It comprises a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors to perform the permission control method of the message management system as described in any one of claims 1 to 5.

Images