A method and related device for access control based on B-tree

Abstract

The present application discloses a method and related device for access control based on B-tree, and relates to the technical field of access management. The method comprises: obtaining a data access request of a target user, determining a target node to be accessed by the data access request, wherein the data access request is used to request access to data stored in a target business system using a B-tree, and the target node belongs to a node in the B-tree; determining at least one target identity attribute associated with the target user; for each target identity attribute, determining the permission configuration information corresponding to the target identity attribute, wherein the permission configuration information comprises: permission control information of at least one reference node in the B-tree that is accessible to the target identity attribute; based on the permission control information of at least one reference node corresponding to each target identity attribute, determining the access permission information of the target user to the target node. The scheme of the present application can reasonably perform access permission control on data in a business system based on the B-tree.

Description

Technical Field

[0001] The present application relates to the technical field of permission control, and in particular to a B-tree-based permission control method and related devices. Background Art

[0002] B-tree is a multi-way balanced search tree and a common data structure. Using B-tree to store data can significantly reduce the intermediate process of locating data and speed up data access.

[0003] In a B-tree-based business system, in order to improve data security, it is necessary to perform permission management on the data in the business system. Therefore, how to reasonably perform data permission management on a B-tree-based business system is a technical problem that technical personnel in this field need to solve. Summary of the invention

[0004] In view of the above problems, the present application provides a B-tree-based access permission control method and related devices to more reasonably control the access permission of data in a B-tree-based business system.

[0005] On the one hand, the present application provides an access rights control method based on a B-tree, comprising:

[0006] Obtaining a data access request of a target user, and determining a target node to be accessed by the data access request, wherein the data access request is used to request access to data stored in a B-tree in a target business system, and the target node belongs to a node in the B-tree;

[0007] Determining at least one target identity attribute associated with the target user;

[0008] For each of the target identity attributes, determining permission configuration information corresponding to the target identity attribute, the permission configuration information comprising: permission control information of at least one reference node in the B-tree that is accessible to the target identity attribute;

[0009] Based on the permission control information of at least one reference node corresponding to each target identity attribute, the access permission information of the target user to the target node is determined.

[0010] In a possible implementation, determining the access permission information of the target user to the target node based on the permission control information of at least one reference node corresponding to each target identity attribute includes:

[0011] Based on the authority control information of at least one reference node corresponding to each target identity attribute, the target sub-nodes under the target node to which the target user has access authority and the operation authority information of the target user on the target sub-nodes are determined.

[0012] In another possible implementation, the determining, based on the permission control information of at least one reference node corresponding to each target identity attribute, the target subnode to which the target user has access rights under the target node and the operation permission information of the target user on the target subnode includes:

[0013] For each target identity attribute, determining the permission control information of the target identity attribute on the target node based on the permission control information of at least one reference node corresponding to the target identity attribute;

[0014] Based on the permission control information of the target identity attribute on the target node, determine the candidate child nodes under the target node that are accessible to the target identity attribute and the operation permission information of the candidate child nodes;

[0015] Based on the candidate subnodes corresponding to each target identity attribute and the operation authority information of the candidate subnodes, each target subnode under the target node to which the target user has access authority and the operation authority information of each target subnode are determined.

[0016] In yet another possible implementation manner, before determining the authority control information of the target identity attribute on the target node, the method further includes:

[0017] Determine the attribute category to which each target identity attribute belongs respectively, each of the attribute categories including at least one target identity attribute;

[0018] According to the priorities corresponding to the attribute categories to which the target identity attributes belong, determine the target attribute categories that have not been processed and are currently to be processed from the attribute categories to which the target identity attributes belong;

[0019] The determining, for each target identity attribute, the authority control information of the target identity attribute on the target node based on the authority control information of at least one reference node corresponding to the target identity attribute, includes:

[0020] For at least one target identity attribute belonging to the target attribute category, determining the permission control information of the at least one target identity attribute on the target node based on the permission control information of at least one reference node corresponding to each of the at least one target identity attribute;

[0021] The determining, based on the permission control information of the target identity attribute on the target node, candidate child nodes accessible to the target identity attribute under the target node and operation permission information of the candidate child nodes includes:

[0022] Based on the permission control information of the at least one target identity attribute on the target node, determining, from the unmarked child nodes under the target node, candidate child nodes accessible to the at least one target identity attribute and operation permission information of the candidate child nodes, and marking the candidate child nodes as candidate child nodes accessible to the target user;

[0023] If there are still unmarked child nodes under the target node and there are still unprocessed attribute categories in the attribute categories to which the target identity attributes belong, return to execute the operation of determining the target attribute categories that have not been processed and are currently to be processed from the attribute categories to which the target identity attributes belong;

[0024] The determining, based on the candidate subnodes corresponding to the target identity attributes and the operation authority information of the candidate subnodes, each target subnode under the target node to which the target user has access rights and the operation authority information of each target subnode includes:

[0025] If there are no unmarked child nodes under the target node or there are no unprocessed attribute categories in the attribute categories to which the target identity attributes belong, the candidate child nodes marked under the target node are determined as the target child nodes under the target node to which the target user has access rights, and the operation permission information of each candidate child node is determined as the operation permission information of each target child node.

[0026] In yet another possible implementation manner, after determining the access permission information of the target user to the target node, the method further includes:

[0027] Based on the access permission information of the target user to the target node, a request response result of the data access request is determined, and the request response result is returned to the terminal of the target user.

[0028] In yet another possible implementation, the method further includes:

[0029] Obtaining an attribute modification instruction for the target user, wherein the attribute modification instruction indicates that there are target identity attributes to be added or deleted for the target user;

[0030] Based on the attribute modification instruction, the target identity attribute associated with the target user is adjusted.

[0031] In yet another possible implementation, the method further includes:

[0032] Obtaining a permission configuration instruction, wherein the permission configuration instruction is used to indicate the identity attribute to be configured and the target permission configuration information required to be configured for the identity attribute to be configured;

[0033] The correspondence between the identity attribute to be configured and the target authority configuration information is stored.

[0034] On the other hand, the present application also provides an access rights control device based on a B-tree, comprising:

[0035] A node determination unit, configured to obtain a data access request from a target user and determine a target node to be accessed by the data access request, wherein the data access request is used to request access to data stored in a B-tree in a target business system, and the target node belongs to a node in the B-tree;

[0036] an attribute determination unit, configured to determine at least one target identity attribute associated with the target user;

[0037] A configuration determination unit, configured to determine, for each of the target identity attributes, permission configuration information corresponding to the target identity attribute, the permission configuration information comprising: permission control information of at least one reference node in the B-tree that is accessible to the target identity attribute;

[0038] The authority determination unit is used to determine the access permission information of the target user to the target node based on the authority control information of at least one reference node corresponding to each target identity attribute.

[0039] On the other hand, the present application also provides a computer program product, including computer-readable instructions, which, when executed on an electronic device, enable the electronic device to implement any of the B-tree-based access permission control methods described above.

[0040] In another aspect, the present application further provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0041] The memory is used to store computer programs;

[0042] The processor is used to execute the computer program so that the electronic device can implement the B-tree-based access permission control method as described in any one of the above.

[0043] From the above content, it can be seen that in this application, after obtaining the data access request of the target user, the target node to be accessed by the data access request can be determined, and at least one target identity attribute associated with the target user can be determined. On this basis, combined with the permission configuration information corresponding to each target identity attribute, the access permission information of the target user for the target node in the B-tree can be determined, so that the access permission information of the target user for the target node can be determined from multiple dimensions in combination with each target identity attribute associated with the target user, thereby realizing a more reasonable access permission control of the data stored in the B-tree in the target business system. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0045] Figure 1 A flow chart of a B-tree-based access rights control method provided in this application;

[0046] Figure 2 A schematic diagram of another flow chart of the access permission control method based on B-tree provided in this application;

[0047] Figure 3 A schematic diagram of an implementation framework of the B-tree-based access rights control method provided in this application;

[0048] Figure 4 An example diagram showing how to determine the access permission information of a target user to a target node based on the permission configuration information corresponding to the target identity attributes of four attribute categories in this application;

[0049] Figure 5 A schematic diagram of the structure of a B-tree-based access control device provided by the present application;

[0050] Figure 6 A schematic diagram of the composition architecture of an electronic device provided in this application. DETAILED DESCRIPTION

[0051] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation mode of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application. It is known to those skilled in the art that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0052] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0053] like Figure 1 , showing a flow chart of the B-tree-based access permission control method provided by the present application. The method of this embodiment can be applied to a target business system that uses a B-tree to store data. The target business system can be any business system that uses a B-tree to store data. For example, the target business system can be an office business system of an enterprise or institution, etc., without limitation.

[0054] This embodiment may include:

[0055] S101, obtaining a data access request of a target user, and determining a target node to be accessed by the data access request.

[0056] The data access request is used to request access to data stored in a target business system using a B-tree, and the target node belongs to a node in the B-tree.

[0057] It is understandable that a B-tree is a multi-way search tree, and when a B-tree is used to store data, accessing the data is actually accessing a node in the B-tree. In this application, for ease of distinction, the node where the data to be accessed is located is referred to as a target node.

[0058] S102: Determine at least one target identity attribute associated with the target user.

[0059] For example, the present application may pre-store the association relationship between different users and at least one identity attribute, and on this basis, at least one target identity attribute associated with the target user may be queried.

[0060] The identity attribute is used to represent the identity used to access the target business system.

[0061] In the target business system, identity attributes can be divided into multiple attribute categories, and there can be one or more identity attributes under each attribute category.

[0062] For example, the attribute categories of identity attributes include, but are not limited to, branches, departments, roles, and private identities. Among them, branches refer to the branches divided by the enterprise or unit to which the target business system belongs. For example, the identity attributes under the branch attribute category may include: branch A, branch B, and branch C. Department refers to a specific business department or project department under a branch. Depending on the specific business of each branch associated with the target business system, the specific departments involved under the department attribute category will also be different. A role can be a user's role in a company, branch, or department. For example, a role can be a person in charge, a manager, a project developer, or a project tester. Private identity refers to the identity of a user. The private identity can be the identity represented by the user's name, or the identity represented by the user's position, etc. There is no restriction on this.

[0063] In the present application, the identity attributes associated with each user of the target business system can be configured according to actual needs. Among them, a user can be associated with identity attributes of one or more attribute categories. Moreover, for the same attribute category, the user can be associated with one or several identity attributes under this attribute category. For example, in terms of the attribute category of department, the same user may participate in multiple projects, then the user can belong to the departments corresponding to these multiple projects, and therefore, the attribute category of department associated with the user can include the departments corresponding to these multiple projects.

[0064] For the sake of distinction, this application refers to each identity attribute associated with a target user as a target identity attribute.

[0065] S103: for each target identity attribute, determine the authority configuration information corresponding to the target identity attribute.

[0066] For example, based on pre-configured permission configuration information corresponding to different identity attributes, the permission configuration information corresponding to the target identity attribute is determined.

[0067] The permission configuration information corresponding to the target identity attribute includes: permission control information of at least one reference node in the B-tree that is accessible to the target identity attribute. The reference node is a node in the B-tree. For the sake of easy distinction, the node to which the target identity attribute has access rights is called a reference node.

[0068] The permission control information of the reference node may include information for determining the access rights related to the reference node. For example, the permission control information of the reference node may include, but is not limited to, information about the child nodes under the reference node that are accessible to the target identity attribute, the operation rights of the target identity attribute for the child nodes under the reference node, whether the target identity attribute is open to the access rights to the parent node of the reference node, and whether the target identity attribute is open to the access rights to the data under some or all child nodes of the reference node.

[0069] The operation authority of the target identity attribute on the sub-node under the reference node refers to the operations that a user with the target identity attribute can perform on the sub-node. For example, the operation authority of the user on the sub-node may include but is not limited to: editing, deleting or modifying the sub-node.

[0070] Opening the access rights of the parent node of the reference node means allowing the user with the target identity attribute to access the parent node of the reference node. If the access rights of the parent node of the reference node are opened, it can be determined that the user with the target identity attribute has the access rights to access the parent node of the reference node. Similarly, opening the access rights of the data under the child node of the reference node means allowing the user with the target identity attribute to access the data of each child node under the child node of the reference node.

[0071] Of course, other information for controlling data access rights may be configured in the permission configuration information of the identity attributes according to actual needs, without any specific limitation.

[0072] It is understandable that the user's personal identity, department or subsidiary will often change. If the permission configuration information corresponding to the user is set separately, then once the user's identity attribute changes, the user's permission configuration information needs to be reconfigured. Moreover, if the branch or department's access rights to the data in the target business system change, then the permission configuration information of all users under the branch or department needs to be reconfigured, resulting in high complexity of permission management.

[0073] The attribute categories of the identity attributes involved in the target business system and the identity attributes under each attribute category are usually relatively fixed, so that the identity attributes change relatively rarely. Based on this, when configuring permission configuration information for each identity attribute, if the identity attributes such as the department or branch to which a user belongs change, it is only necessary to change the identity attribute associated with the user without adjusting the permission configuration information of the identity attribute information. If the permission configuration information of a certain identity attribute changes, it is only necessary to adjust the permission configuration information corresponding to the identity attribute, without adjusting the permission configuration information of all users with the identity attribute, thereby reducing the complexity of permission management.

[0074] In addition, this application is equivalent to configuring permission configuration information for users. It can determine the user's access rights in multiple dimensions according to actual needs, thereby achieving more fine-grained access rights management.

[0075] S104: Determine access permission information of the target user to the target node based on the permission control information of at least one reference node corresponding to each target identity attribute.

[0076] The target user's access permission information for the target node is at least used to indicate whether the target user has access permission to the target node. Of course, the access permission information can also indicate which subnodes under the target node the target user has access permission to and the type of access permission to the subnodes.

[0077] It can be understood that since the permission control information of each reference node corresponding to the target identity attribute can not only define whether the target identity attribute has access rights to the reference node, the parent node of the reference node and the child node of the reference node, but also define the operation rights of the target identity attribute for the reference node, the parent node of the reference node or the child node, therefore, combined with the permission control information of each reference node corresponding to each target identity attribute, it can be determined whether the target user has the access right to access the target node when having each target identity attribute, as well as the type of access right of the target user to the target node.

[0078] It can be understood that after determining the target user's access permission information for the target node, the present application can also determine the request response result of the data access request based on the target user's access permission information for the target node, and return the request response result to the target user's terminal.

[0079] For example, if the determined access permission information indicates that the target user does not have access permission to access the target node, the target business system determines that the request response result is prompt information of not having access permission, and returns prompt information of not having access permission to the terminal of the target user.

[0080] If the target user has access rights to the target node, information about the subnodes that the target user can view under the target node can be determined based on the access rights information, and information about each subnode under the target node that the target user has access rights to is returned to the target user's terminal.

[0081] From the above content, it can be seen that in this application, after obtaining the data access request of the target user, the target node to be accessed by the data access request can be determined, and at least one target identity attribute associated with the target user can be determined. On this basis, combined with the permission configuration information corresponding to each target identity attribute, the access permission information of the target user for the target node in the B-tree can be determined, so that the access permission information of the target user for the target node can be determined from multiple dimensions in combination with each target identity attribute associated with the target user, thereby realizing a more reasonable access permission control of the data on the B-tree in the target business system.

[0082] It is understandable that in the present application, there may be many possibilities for the target user's access permission information to the target node.

[0083] In one possible implementation, the present application can determine the target subnodes under the target node to which the target user has access rights and the target user's operation permission information for each target subnode based on the permission control information of at least one reference node corresponding to each target identity attribute.

[0084] The user's operation permission information for the target sub-node may be at least one of the following permissions: edit, delete, and read-only.

[0085] It is understandable that, because different target identity attributes correspond to different permission configuration information, the target user's access rights to the target node will also be different under different target identity attributes. Based on this, the present application can first determine the target user's access rights information to the target node under different target identity attributes, and then combine the target user's access rights information to the target node under different target identity attributes to determine the target user's access rights information to each sub-node under the target node.

[0086] Specifically, for each target identity attribute, based on the permission control information of at least one reference node corresponding to the target identity attribute, the permission control information of the target identity attribute on the target node is determined. The permission control information of the target identity attribute on the target node can be used to determine the relevant policy information of the target identity attribute's access rights to the target node. For example, the permission control information of the target identity attribute on the target node may be that the target identity attribute can access all child nodes on the target node, has editing rights for all child nodes, and has deletion rights for certain child nodes.

[0087] On this basis, based on the permission control information of the target identity attribute on the target node, the candidate subnodes under the target node that are accessible to the target identity attribute and the operation permission information of each candidate subnode can be determined. Correspondingly, based on the candidate subnodes corresponding to each target identity attribute and the operation permission information of each candidate subnode, the target subnodes under the target node that the target user has access rights to and the operation permission information of each target subnode can be determined.

[0088] For example, the candidate child nodes corresponding to each target identity attribute are all determined as target child nodes. For the same candidate child node, the operation permission information of the candidate child node under different target identity attributes can be used as the operation permission information of the target child node corresponding to the candidate child node, or the operation permission information of the candidate child node under different target identity attributes can be determined as the operation permission information of the target child node corresponding to the candidate child node.

[0089] It is understandable that in actual applications, there may be conflicts between the permission control information of the target node for identity attributes of different attribute categories. For example, if the user's personal identity level is high, the user may have the right to edit and delete all subnodes under the target node. If the user also belongs to a department, but the department's permission control information for the target node only supports viewing all subnodes under the target node, but does not support editing and deleting subnodes, then a permission conflict may occur. Based on this, in order to reduce the inability to reasonably determine the target user's access rights to the target node due to permission conflicts, the present application can also pre-determine the priorities of different attribute categories, and determine the target user's permission control information for the target node based on the target identity attributes under each attribute category in combination with the priorities of each attribute category.

[0090] Combine the following Figure 2 For explanation. Figure 2 , shows another flow chart of the B-tree-based access control method provided by the present application. The method of this embodiment is applied to a target business system. The method of this embodiment may include:

[0091] S201, obtaining a data access request of a target user, and determining a target node to be accessed by the data access request.

[0092] The data access request is used to request access to data stored in a target business system using a B-tree. The target node is a node in the B-tree.

[0093] S202: Determine at least one target identity attribute associated with the target user.

[0094] The above two steps can be referred to the related introduction of the previous embodiment, which will not be repeated here.

[0095] S203, respectively determine the attribute category to which each target identity attribute belongs.

[0096] Among them, the attribute category to which the target identity attribute belongs is the category to which the target identity attribute belongs. For the specific division of the attribute category, please refer to the previous related introduction, which will not be repeated here.

[0097] It is understandable that among at least one target identity attribute associated with the target user, there may be two or more target identity attributes belonging to the same attribute category. For example, the target identity attributes associated with the target user may include department A and department B, and both department A and department B belong to the attribute category of department. Of course, there may also be a situation where different target identity attributes belong to different attribute categories.

[0098] Based on this, it can be known that each attribute category determined in step S203 may include at least one target identity attribute.

[0099] S204: According to the priorities corresponding to the attribute categories to which the target identity attributes belong, determine the target attribute categories that have not been processed and are currently to be processed from the attribute categories to which the target identity attributes belong.

[0100] The priority level corresponding to each attribute can be pre-configured, and different attribute categories have different priorities.

[0101] In this application, among the attribute categories corresponding to the target identity attributes, the attribute category with the highest priority and for which the corresponding authority control information has not yet been determined is referred to as the target attribute category. For the determined target attribute category, the operation of step S205 can be performed.

[0102] S205: For at least one target identity attribute belonging to the target attribute category, based on the authority control information of at least one reference node corresponding to each of the at least one target identity attribute, determine the authority control information of the at least one target identity attribute on the target node.

[0103] For example, based on the permission control information of at least one reference node corresponding to each target identity attribute belonging to the target attribute category, the permission control information related to the target node can be screened out to obtain the permission control information of each target identity attribute belonging to the target attribute category on the target node.

[0104] For example, assume that the permission control information of at least one reference node corresponding to the target identity attribute stipulates: open access rights to child nodes B1 and B2 under node B, and have the permission to delete and modify child node B1; and open access rights to the parent node corresponding to node B (i.e., node A). Then, if the target node is node B, the permission control information of node B that can be determined includes: having access rights to child nodes B1 and B2 under node B, and the permission to delete and modify child node B1, but not having the permission to delete, edit, and modify child node B2. If the target node is node A, then the permission control information of the target node determined is: having access rights to each child node under the target node, but not having the permission to edit, modify, or delete each child node under the target node.

[0105] S206, based on the permission control information of the at least one target identity attribute on the target node, determine the candidate child nodes accessible to the at least one target identity attribute and the operation permission information of each candidate child node from the child nodes under the target node that have not yet been marked, and mark each candidate child node as a candidate child node accessible to the target user.

[0106] It can be understood that the permission control information of the at least one target identity attribute on the target node may include specific access rights to each sub-node under the target node, so that the operation permission information of each sub-node can be classified.

[0107] Of course, the permission control information of at least one target identity attribute in the target node may also indicate that the user does not have the permission to access the target node. In this case, there is no candidate child node accessible to the at least one target identity attribute under the target node, that is, the candidate child node is empty, so there is no need to perform a marking operation to mark the candidate child node.

[0108] S207, determining whether there are still unmarked child nodes under the target node and whether there are still unprocessed attribute categories in the attribute categories to which each target identity attribute belongs. If yes, return to step S204; if not, execute step S208.

[0109] It is understandable that if there are still unmarked child nodes on the target node and there are still unprocessed attribute categories, it means that the unmarked child nodes on the target node may belong to the child nodes accessible by the target identity attributes under the attribute categories that have not been processed. Then it is necessary to return to step S204 to further determine whether there are still child nodes in the target node to which the target identity attributes of other attribute categories have access rights.

[0110] S208, determining each candidate sub-node marked under the target node as each target sub-node under the target node for which the target user has access rights, and determining the operation permission information of each candidate sub-node as the operation permission information of each target sub-node.

[0111] It is understandable that if there are no unmarked child nodes under the target node, it means that the child nodes under the target node are all child nodes to which the target user has access rights, and therefore, there is no need to determine the target user's access rights to each child node under the target node based on other target identity attributes. Alternatively, if there are no unprocessed attribute categories in the attribute categories to which each target identity attribute belongs, it means that the unmarked child nodes in the target node are all child nodes to which the target user does not have access rights, and therefore, the currently marked candidate child nodes are all child nodes to which the target user has access rights.

[0112] It is understandable that after step S208, the present application can determine the request response result of the data access request based on the target sub-nodes to which the target user has access rights and the operation permission information of each target sub-node, and return the request response result to the terminal of the target user.

[0113] For example, based on the target subnodes under the target node to which the target user has access rights and the operation authority information of each target subnode, the target business system can determine the data that can be returned to the target user's terminal and return the corresponding data to the target user's terminal without any specific restrictions.

[0114] It is understandable that in any of the above embodiments of the present application, in order to effectively manage the permissions of the data stored in the target business system using the B-tree, the present application can add a permission control program in the target business system. In the present application, the permission control program can be divided into a permission trigger subroutine and a permission arbitrator subroutine, and the permission arbitration subroutine can include permission interpreter subroutines corresponding to different attribute categories. On this basis, the permission control program can process the data access request received by the target business system to determine the specific access rights of the target user who initiated the data access request to the target node to be accessed.

[0115] For example, combined Figure 3 A brief explanation:

[0116] For ease of description, Figure 3 In the text, the permission trigger subroutine, the permission arbitrator subroutine and the permission interpreter subroutine are referred to as permission trigger, permission arbitrator and permission interpreter respectively.

[0117] Depend on Figure 3It can be seen that after detecting that the target business system obtains a data access request, the permission trigger obtains the data of the target node requested by the data access request, such as the data of the target node may include the name of the target node and the information of each sub-node under the target node. In addition, the permission trigger determines at least one target identity attribute associated with the target user who initiated the data access request, and obtains the permission configuration information corresponding to each target identity attribute.

[0118] After the permission controller transmits the permission configuration information corresponding to each target identity attribute and the data of the target node to the permission arbitrator, the permission arbitrator can determine the permission interpreter required for processing the permission configuration information corresponding to each target identity attribute. Among them, for the permission configuration information corresponding to each target identity attribute belonging to the same attribute category, the same permission interpreter corresponding to the attribute category needs to be used for synchronous processing.

[0119] Based on this, the permission arbitrator determines the target attribute category currently being processed based on the priority of the attribute category corresponding to each target identity attribute, and calls the permission interpreter of the target attribute category.

[0120] The permission interpreter of the target attribute category determines the permission control information of at least one target identity attribute on the target node based on the permission configuration information corresponding to each of the at least one target identity attributes belonging to the target attribute category, and based on the determined permission control information, marks each candidate child node accessible to the at least one target identity attribute under the target node and the operation permission information of each candidate child node.

[0121] The permission interpreter returns the marked candidate child nodes and the operation permission information of each candidate child node to the permission arbitrator. The permission arbitrator determines whether there are still unmarked child nodes in the target node and there are still attribute categories that have not been processed. If so, it determines that it is necessary to continue to execute the permission interpreter of the next target attribute category to be processed; if not, it obtains the candidate child nodes marked as having access rights under the target node and the operation permission information of each candidate child node.

[0122] For ease of understanding, the target user is associated with target identity attributes under four attribute categories as an example. Assume that the target user is associated with a private identity attribute corresponding to the private identity category, a department identity attribute corresponding to the department attribute category, a role identity attribute corresponding to the role attribute category, and a zone identity attribute corresponding to the zone attribute category as an example. Among them, the zone identity attribute under the zone attribute category can be used to represent the branch company to which the user belongs, or can be other forms of identity information, without limitation.

[0123] Assume that the priority of these four attribute categories is from high to low: private attribute category, department attribute category, role attribute category, and zone attribute category. Then the permission arbitrator can call and execute the permission interpreters of these four attribute categories in turn. Figure 4 , shows an example diagram of determining the target user's access permission information for the target node based on the permission configuration information corresponding to the target identity attributes of these four attribute categories in this application.

[0124] Depend on Figure 4 It can be seen that the permission arbitrator will first call the private permission interpreter corresponding to the private attribute category. Based on the permission configuration information corresponding to the private identity attribute associated with the target user, the private permission interpreter will determine the target subnodes under the target node that are accessible to the private identity attribute and the operation permission information of the target subnodes, add private permission tags to the determined target subnodes, and return the marked target subnodes and the operation permission information corresponding to each target subnode to the permission arbitrator.

[0125] If all child nodes under the target node are marked with private permissions, the permission arbitrator determines that there is no need to execute the department permission interpreter corresponding to the department attribute category. If there are still child nodes on the target node that have not been marked, the data of the child nodes on the target node that have not been marked can be sent to the department permission interpreter. The department permission interpreter determines the target child nodes that can be accessed by the department identity attributes associated with the target user and the operation permission information of the corresponding target child nodes from the child nodes that have not been marked, and marks the department permission mark for the determined target child nodes.

[0126] Similarly, the authority arbitrator determines that there are still subnodes under the target node that have not been marked by the department authority interpreter, and inputs the data of the subnodes that have not been marked into the role authority interpreter. The role authority interpreter determines the target subnodes that are accessible to the role identity attribute associated with the target user and the operation authority information of the target subnodes from the subnodes that have not been marked, and adds the role authority mark to the determined target subnodes.

[0127] On this basis, if there are still unmarked subnodes in the target node, the permission arbitrator inputs the data of the remaining subnodes on the target subnode that are not marked by the role permission into the zone permission interpreter. The zone permission interpreter determines the target subnodes that are accessible to the zone identity attribute associated with the target user and the operation permission information of the target subnodes from the unmarked subnodes under the target node, and adds the zone permission mark to the determined subnodes.

[0128] On the basis of the above, Figure 3 and Figure 4It can be seen that the authority arbitrator can finally determine the target sub-nodes and the operation authority information of each target sub-node that are accessible to each identity attribute associated with the target user under the target node. Then, the authority arbitrator can return each target sub-node marked as in the target node and the operation authority information of each target sub-node to the target business system through the authority trigger, so that the target business system returns the corresponding data to the terminal of the target user based on the operation authority information of each target sub-node under the target node.

[0129] It is understandable that in any of the above embodiments, if the identity attribute of the target user changes, the staff of the target business system can also modify the identity attribute associated with the target user in the target business system. Based on this, in a possible implementation, the present application can also obtain an attribute modification instruction for the target user, and the attribute modification instruction indicates that there are target identity attributes to be added or deleted for the target user. Accordingly, the target identity attribute associated with the target user can be adjusted based on the attribute modification instruction.

[0130] In another possible implementation, in any of the above embodiments, the present application may also obtain a permission configuration instruction, which is used to indicate the identity attribute to be configured and the target permission configuration information required to be configured for the identity attribute to be configured. Accordingly, the target business system in the present application may store the correspondence between the identity attribute to be configured and the target permission configuration information.

[0131] On the other hand, corresponding to a B-tree-based access permission control method of the present application, the present application also provides a B-tree-based access permission control device. Figure 5 , shows a schematic diagram of a composition structure of a B-tree-based access control device provided in an embodiment of the present application. The device of this embodiment may include:

[0132] A node determination unit 501 is used to obtain a data access request of a target user and determine a target node to be accessed by the data access request, wherein the data access request is used to request access to data stored in a B-tree in a target business system, and the target node belongs to a node in the B-tree;

[0133] An attribute determination unit 502, configured to determine at least one target identity attribute associated with the target user;

[0134] The configuration determination unit 503 is used to determine, for each of the target identity attributes, permission configuration information corresponding to the target identity attribute, wherein the permission configuration information includes: permission control information of at least one reference node in the B-tree that is accessible to the target identity attribute;

[0135] The authority determination unit 504 is configured to determine the access authority information of the target user to the target node based on the authority control information of at least one reference node corresponding to each target identity attribute.

[0136] In another possible implementation, the permission determination unit is specifically used to determine the target sub-nodes under the target node to which the target user has access rights and the operation permission information of the target user on the target sub-nodes based on the permission control information of at least one reference node corresponding to each target identity attribute.

[0137] In yet another possible implementation, the authority determination unit includes:

[0138] A first determining subunit is configured to determine, for each target identity attribute, the authority control information of the target identity attribute on the target node based on the authority control information of at least one reference node corresponding to the target identity attribute;

[0139] A second determining sub-unit is used to determine, based on the authority control information of the target identity attribute on the target node, candidate child nodes under the target node that are accessible to the target identity attribute and operation authority information of the candidate child nodes;

[0140] The third determination subunit is used to determine each target subnode under the target node to which the target user has access rights and the operation authority information of each target subnode based on the candidate subnodes corresponding to each target identity attribute and the operation authority information of the candidate subnodes.

[0141] In another possible implementation, the device further includes: an attribute classification subunit, configured to respectively determine the attribute categories to which each target identity attribute belongs before the first determination subunit determines the authority control information of the target identity attribute on the target node, each of the attribute categories including at least one target identity attribute;

[0142] A category determination subunit, for determining, according to the priority corresponding to the attribute category to which each target identity attribute belongs, the target attribute category that has not been processed and is currently to be processed from the attribute categories to which each target identity attribute belongs;

[0143] Correspondingly, the first determining subunit is specifically configured to determine, for at least one target identity attribute belonging to the target attribute category, permission control information of the at least one target identity attribute on the target node based on permission control information of at least one reference node corresponding to each of the at least one target identity attribute;

[0144] The second determining subunit includes:

[0145] a node marking subunit, configured to determine, from the unmarked child nodes under the target node, candidate child nodes accessible to the at least one target identity attribute and operation permission information of the candidate child nodes based on the permission control information of the at least one target identity attribute on the target node, and mark the candidate child nodes as candidate child nodes accessible to the target user;

[0146] The control subunit is configured to return to the operation of determining the target attribute categories that have not been processed and are currently to be processed from the attribute categories to which the target identity attributes belong, if there are still unmarked child nodes under the target node and there are still unprocessed attribute categories in the attribute categories to which the target identity attributes belong;

[0147] The third determination sub-unit is specifically used to determine each candidate sub-node marked under the target node as each target sub-node to which the target user has access permission under the target node, and determine the operation permission information of each candidate sub-node as the operation permission information of each target sub-node, if there is no unmarked sub-node under the target node or there is no unprocessed attribute category in the attribute category to which the target identity attributes belong.

[0148] In another possible implementation, the device also includes: a response returning unit, which is used to determine the request response result of the data access request based on the target user's access permission information for the target node after the permission determination unit determines the target user's access permission information for the target node, and return the request response result to the target user's terminal.

[0149] In yet another possible implementation, the device further includes:

[0150] An attribute instruction obtaining unit, used to obtain an attribute modification instruction for the target user, wherein the attribute modification instruction indicates that there are target identity attributes to be added or deleted for the target user;

[0151] The associated attribute adjustment unit is used to adjust the target identity attribute associated with the target user based on the attribute modification instruction.

[0152] In yet another possible implementation, the device further includes:

[0153] A configuration instruction obtaining unit, used to obtain a permission configuration instruction, wherein the permission configuration instruction is used to indicate the identity attribute to be configured and the target permission configuration information required to be configured for the identity attribute to be configured;

[0154] The relationship storage unit is used to store the corresponding relationship between the identity attribute to be configured and the target authority configuration information.

[0155] On the other hand, the present application also provides a computer program product, characterized in that it includes computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the B-tree-based access permission control method as described in any one of the above.

[0156] In another aspect, an electronic device is provided in an embodiment of the present application. Figure 6 As shown, it shows a schematic diagram of a composition structure of the electronic device, and the electronic device at least includes at least one processor 601 and a memory 602 connected to the processor;

[0157] The memory 602 is used to store computer programs;

[0158] The processor 601 is used to execute the computer program so that the electronic device can implement any one of the B-tree-based access permission control methods described above.

[0159] It can be understood that the electronic device may further include a display unit 603 and an input unit 604 .

[0160] Of course, the electronic device may also have Figure 6 There may be more or fewer components, without limitation.

[0161] On the other hand, an embodiment of the present application further provides a computer-readable storage medium, which carries one or more computer programs. When one or more computer programs are executed by an electronic device, the electronic device can implement any B-tree-based access permission control method provided in the embodiment of the present application.

[0162] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0163] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0164] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0165] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for access rights control based on B-tree, characterized in that: include: Obtaining a data access request of a target user, and determining a target node to be accessed by the data access request, wherein the data access request is used to request access to data stored in a B-tree in a target business system, and the target node belongs to a node in the B-tree; Determining at least one target identity attribute associated with the target user; For each of the target identity attributes, determining permission configuration information corresponding to the target identity attribute, the permission configuration information comprising: permission control information of at least one reference node in the B-tree that is accessible to the target identity attribute; Based on the permission control information of at least one reference node corresponding to each target identity attribute, the access permission information of the target user to the target node is determined.

2. The B-tree-based access rights control method according to claim 1, characterized in that: Determining access permission information of the target user to the target node based on permission control information of at least one reference node corresponding to each target identity attribute includes: Based on the permission control information of at least one reference node corresponding to each target identity attribute, the target sub-nodes under the target node to which the target user has access permissions and the operation permission information of the target user on the target sub-nodes are determined.

3. The B-tree-based access rights control method according to claim 1, characterized in that: The determining, based on the permission control information of at least one reference node corresponding to each target identity attribute, a target subnode under the target node to which the target user has access rights and operation permission information of the target user on the target subnode includes: For each target identity attribute, determining the permission control information of the target identity attribute on the target node based on the permission control information of at least one reference node corresponding to the target identity attribute; Based on the permission control information of the target identity attribute on the target node, determine the candidate child nodes under the target node that are accessible to the target identity attribute and the operation permission information of the candidate child nodes; Based on the candidate subnodes corresponding to each target identity attribute and the operation authority information of the candidate subnodes, each target subnode under the target node to which the target user has access authority and the operation authority information of each target subnode are determined.

4. The B-tree-based access rights control method according to claim 3, characterized in that: Before determining the authority control information of the target identity attribute on the target node, the method further includes: Determine the attribute category to which each target identity attribute belongs respectively, each of the attribute categories including at least one target identity attribute; According to the priorities corresponding to the attribute categories to which the target identity attributes belong, determine the target attribute categories that have not been processed and are currently to be processed from the attribute categories to which the target identity attributes belong; The determining, for each target identity attribute, the authority control information of the target identity attribute on the target node based on the authority control information of at least one reference node corresponding to the target identity attribute, includes: For at least one target identity attribute belonging to the target attribute category, determining the permission control information of the at least one target identity attribute on the target node based on the permission control information of at least one reference node corresponding to each of the at least one target identity attribute; The determining, based on the permission control information of the target identity attribute on the target node, candidate child nodes under the target node that are accessible to the target identity attribute and operation permission information of the candidate child nodes includes: Based on the permission control information of the at least one target identity attribute on the target node, determining, from the unmarked child nodes under the target node, candidate child nodes accessible to the at least one target identity attribute and operation permission information of the candidate child nodes, and marking the candidate child nodes as candidate child nodes accessible to the target user; If there are still unmarked child nodes under the target node and there are still unprocessed attribute categories in the attribute categories to which the target identity attributes belong, return to execute the operation of determining the target attribute categories that have not been processed and are currently to be processed from the attribute categories to which the target identity attributes belong; The determining, based on the candidate subnodes corresponding to the target identity attributes and the operation authority information of the candidate subnodes, each target subnode under the target node to which the target user has access rights and the operation authority information of each target subnode includes: If there are no unmarked child nodes under the target node or there are no unprocessed attribute categories in the attribute categories to which the target identity attributes belong, the candidate child nodes marked under the target node are determined as the target child nodes under the target node to which the target user has access rights, and the operation permission information of each candidate child node is determined as the operation permission information of each target child node.

5. The B-tree-based access rights control method according to claim 1, characterized in that: After determining the access permission information of the target user to the target node, the method further includes: Based on the access permission information of the target user to the target node, a request response result of the data access request is determined, and the request response result is returned to the terminal of the target user.

6. The B-tree-based access rights control method according to claim 1, characterized in that: Also includes: Obtaining an attribute modification instruction for the target user, wherein the attribute modification instruction indicates that there are target identity attributes to be added or deleted for the target user; Based on the attribute modification instruction, the target identity attribute associated with the target user is adjusted.

7. The B-tree-based access rights control method according to claim 1, characterized in that: Also includes: Obtaining a permission configuration instruction, wherein the permission configuration instruction is used to indicate the identity attribute to be configured and the target permission configuration information required to be configured for the identity attribute to be configured; The correspondence between the identity attribute to be configured and the target authority configuration information is stored.

8. A B-tree-based access rights control device, characterized in that: include: A node determination unit, configured to obtain a data access request from a target user and determine a target node to be accessed by the data access request, wherein the data access request is used to request access to data stored in a B-tree in a target business system, and the target node belongs to a node in the B-tree; an attribute determination unit, configured to determine at least one target identity attribute associated with the target user; A configuration determination unit, configured to determine, for each of the target identity attributes, permission configuration information corresponding to the target identity attribute, the permission configuration information comprising: permission control information of at least one reference node in the B-tree that is accessible to the target identity attribute; The authority determination unit is used to determine the access permission information of the target user to the target node based on the authority control information of at least one reference node corresponding to each target identity attribute.

9. A computer program product, characterized in that It comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the B-tree-based access permission control method as claimed in any one of claims 1 to 7.

10. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the B-tree-based access permission control method as described in any one of claims 1 to 7.

Images