Cross-system user permission control method and device and computer equipment

Abstract

The invention relates to a cross-system user permission control method and device and computer equipment. The method comprises the following steps: acquiring system authority control information of each system, system communication architecture information among the systems, and current access authentication information of a user to a target system, and identifying each authority authentication demand of each system and authority range information corresponding to each authority authentication demand; based on the system communication architecture information between the systems, identifying permission association information between the systems, and identifying access demand information corresponding to each permission range of each system; the current user access permission information of the user in the target system and the user association permission information of the user to each actual association system are identified, so that cross-system access permission management and control processing is performed on the user. By adopting the method, the accuracy of cross-system user permission control can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of financial insurance services, and in particular to a method, apparatus and computer device for cross-system user authority management and control. Background Art

[0002] It is aimed at the permission management and authentication technology between multiple systems and modules in complex enterprise environments. With the deepening of enterprise informatization, data sharing and interaction between different business systems have become the norm. How to efficiently and securely manage user permissions in these systems and ensure the legitimacy and security of data access has become a technical problem that needs to be solved urgently.

[0003] Among the existing technical solutions, some third-party permission management platforms have been used to control permissions on third-party platforms. However, the permission control of third-party control platforms focuses on the single sign-on (SSO) function, and lacks support for fine-grained permission control (such as module-level and function-level permissions). It is difficult to accurately identify permissions across systems, resulting in poor accuracy in cross-system user permission control. Summary of the invention

[0004] Based on this, it is necessary to provide a cross-system user authority management method, apparatus, computer equipment, computer-readable storage medium and computer program product to address the above technical issues.

[0005] In a first aspect, the present application provides a method for cross-system user rights management and control, including:

[0006] Obtaining system authority management and control information of each system, system communication architecture information between the systems, and current access authentication information of the user to the target system, and based on the system authority management and control information of the systems, identifying each authority authentication requirement of each system and authority scope information corresponding to each authority authentication requirement of each system;

[0007] Based on the system communication architecture information between the systems, the permission association information between the systems is identified, and based on the permission authentication requirements of each system and the permission range information corresponding to the permission authentication requirements of each system, the access requirement information corresponding to the permission range of each system is identified;

[0008] Based on the current access authentication information and the access requirement information corresponding to each permission range of the target system, identify the current user access permission information of the user in the target system, and based on the current user access permission information of the user in the target system and the permission association information between the systems, identify the user associated permission information of the user for each of the actually associated systems;

[0009] Based on the current user access permission information of the user in the target system and the user associated permission information of the user to each of the actually associated systems, cross-system access permission management and control processing is performed on the user.

[0010] Optionally, the identifying, based on the system authority control information of each of the systems, each authority authentication requirement of each system and authority scope information corresponding to each authority authentication requirement of each system includes:

[0011] For each system, based on the system authority management and control information of the system, identify the system authority scope of the system and the authority restriction conditions of the system authority scope, and divide the system authority scope of the system into sub-authority scopes of each authority restriction condition;

[0012] Based on each of the permission restriction conditions, identifying the permission restriction information corresponding to each permission restriction condition, and querying the permission restriction types contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information in the permission control database of the system;

[0013] The permission authentication scope of each permission restriction type corresponding to each permission restriction information is used as each permission authentication requirement, and the sub-permission scope of each permission restriction condition is used as the permission scope information corresponding to each permission authentication requirement.

[0014] Optionally, the identifying the permission association information between the systems based on the system communication architecture information between the systems includes:

[0015] Based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with an association relationship and the associated permission content between the associated systems are identified;

[0016] Based on the associated permission contents between the associated systems, a system permission association map between the associated systems is constructed, and based on the system permission association map between the associated systems, actual associated systems corresponding to each system are identified;

[0017] Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

[0018] Optionally, the identifying access requirement information corresponding to each permission range of each system based on each permission authentication requirement of each system and permission range information corresponding to each permission authentication requirement of each system includes:

[0019] For each system, based on the authority authentication scope of each authority restriction type corresponding to each sub-authority scope of the system, query the user identity type corresponding to each authority restriction type in the authority restriction database, and based on the authority authentication scope of each authority restriction type, query the user identity scope of the user identity type corresponding to the authority authentication scope of each authority restriction type in the authority restriction database;

[0020] The user identity range of each user identity type is used as the access requirement information of the sub-authority range.

[0021] Optionally, the identifying current user access permission information of the user in the target system based on the current access authentication information and access requirement information corresponding to each permission range of the target system includes:

[0022] Based on the current access authentication information, identify the user identity information of the user, and based on the user identity information, query the target system database for current user access permission information of each user identity type of the user and the scope of the access permission requested by the user;

[0023] Based on the current user access permission information of each user identity type of the user, in the user identity range of each user identity type corresponding to each sub-authority range of the target system, the target sub-authority ranges that the user can access are adapted; and based on the access permission range requested by the user and the target sub-authority ranges that the user can access, the current user access permission information of the user in the target system is filtered.

[0024] Optionally, the identifying the user associated permission information of the user for each of the actually associated systems based on the current user access permission information of the user in the target system and the permission association information between the systems includes:

[0025] Based on the user identity information of the user and the access requirement information corresponding to the authority ranges of each actual associated system corresponding to the target system, identifying the associated target sub-authority ranges of each actual associated system that the user can access;

[0026] Based on each target sub-authority range accessible to the user and each associated target sub-authority range of each actually associated system accessible to the user, in the target system and each actually associated system corresponding to the target system, identifying the current associated access permission content of the user in each actually associated system corresponding to the target system;

[0027] Based on the target association permission content between the target system and each actual association system corresponding to the target system, and the current association access permission content of the user in each actual association system corresponding to the target system, identifying the current actual association access permission content of the user in each actual association system corresponding to the target system through the permission range limitation strategy;

[0028] The current actually associated access permission content of the user in each actually associated system corresponding to the target system is used as the user associated permission information of the user to each of the actually associated systems.

[0029] In a second aspect, the present application also provides a cross-system user rights management device, including:

[0030] An acquisition module is used to acquire system authority management and control information of each system, system communication architecture information between the systems, and current access authentication information of the user to the target system, and based on the system authority management and control information of the systems, identify each authority authentication requirement of each system and authority scope information corresponding to each authority authentication requirement of each system;

[0031] A first identification module is used to identify the permission association information between the systems based on the system communication architecture information between the systems, and to identify the access requirement information corresponding to each permission range of each system based on each permission authentication requirement of each system and the permission range information corresponding to each permission authentication requirement of each system;

[0032] A second identification module is used to identify the current user access permission information of the user in the target system based on the current access authentication information and the access requirement information corresponding to each permission range of the target system, and to identify the user associated permission information of the user for each of the actually associated systems based on the current user access permission information of the user in the target system and the permission association information between the systems;

[0033] The control module is used to perform cross-system access rights control on the user based on the current user access rights information of the user in the target system and the user associated permission information of the user to each of the actually associated systems.

[0034] Optionally, the acquisition module is specifically used to:

[0035] For each system, based on the system authority management and control information of the system, identify the system authority scope of the system and the authority restriction conditions of the system authority scope, and divide the system authority scope of the system into sub-authority scopes of each authority restriction condition;

[0036] Based on each of the permission restriction conditions, identifying the permission restriction information corresponding to each permission restriction condition, and querying the permission restriction types contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information in the permission control database of the system;

[0037] The permission authentication scope of each permission restriction type corresponding to each permission restriction information is used as each permission authentication requirement, and the sub-permission scope of each permission restriction condition is used as the permission scope information corresponding to each permission authentication requirement.

[0038] Optionally, the first identification module is specifically used to:

[0039] Based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with an association relationship and the associated permission content between the associated systems are identified;

[0040] Based on the associated permission contents between the associated systems, a system permission association map between the associated systems is constructed, and based on the system permission association map between the associated systems, actual associated systems corresponding to each system are identified;

[0041] Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

[0042] Optionally, the first identification module is specifically used to:

[0043] For each system, based on the authority authentication scope of each authority restriction type corresponding to each sub-authority scope of the system, query the user identity type corresponding to each authority restriction type in the authority restriction database, and based on the authority authentication scope of each authority restriction type, query the user identity scope of the user identity type corresponding to the authority authentication scope of each authority restriction type in the authority restriction database;

[0044] The user identity range of each user identity type is used as the access requirement information of the sub-authority range.

[0045] Optionally, the second identification module is specifically used to:

[0046] Based on the current access authentication information, identify the user identity information of the user, and based on the user identity information, query the target system database for current user access permission information of each user identity type of the user and the scope of the access permission requested by the user;

[0047] Based on the current user access permission information of each user identity type of the user, in the user identity range of each user identity type corresponding to each sub-authority range of the target system, the target sub-authority ranges that the user can access are adapted; and based on the access permission range requested by the user and the target sub-authority ranges that the user can access, the current user access permission information of the user in the target system is filtered.

[0048] Optionally, the second identification module is specifically used to:

[0049] Based on the user identity information of the user and the access requirement information corresponding to the authority ranges of each actual associated system corresponding to the target system, identifying the associated target sub-authority ranges of each actual associated system that the user can access;

[0050] Based on each target sub-authority range accessible to the user and each associated target sub-authority range of each actually associated system accessible to the user, in the target system and each actually associated system corresponding to the target system, identifying the current associated access permission content of the user in each actually associated system corresponding to the target system;

[0051] Based on the target association permission content between the target system and each actual association system corresponding to the target system, and the current association access permission content of the user in each actual association system corresponding to the target system, identifying the current actual association access permission content of the user in each actual association system corresponding to the target system through the permission range limitation strategy;

[0052] The current actually associated access permission content of the user in each actually associated system corresponding to the target system is used as the user associated permission information of the user to each of the actually associated systems.

[0053] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0054] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0055] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0056] The above-mentioned cross-system user authority control method, device and computer equipment obtain the system authority control information of each system, the system communication architecture information between each system, and the current access authentication information of the user to the target system, and identify the authority authentication requirements of each system and the authority range information corresponding to the authority authentication requirements of each system based on the system authority control information of each system; identify the authority association information between each system based on the system communication architecture information between each system, and identify the access requirement information corresponding to each authority range of each system based on the authority authentication requirements of each system and the authority range information corresponding to the authority authentication requirements of each system; identify the current user access authority information of the user in the target system based on the current access authentication information and the access requirement information corresponding to the authority range of the target system, and identify the user-associated authority information of the user for each of the actually associated systems based on the current user access authority information of the user in the target system and the authority association information between each system; perform cross-system access authority control processing on the user based on the current user access authority information of the user in the target system and the user-associated authority information of the user for each of the actually associated systems. This solution analyzes the permission range information corresponding to each permission authentication requirement of each system from the system permission management information of each system, and then identifies the permission association information between the systems based on the system communication architecture information between the systems. Therefore, when a user accesses a single system, the user-associated permission information of each actually associated system that has an actual association with the target system can be identified based on the permission association information between the systems. This makes it possible to simultaneously control the permission access of multiple systems, while enabling users to access all business systems that are actually associated with the target system with just one login, and to perform synchronous access permission management for each actually associated business system, thus avoiding the problem that the third-party management and control platform can only perform single-point management and control and cannot accurately identify cross-system permissions, and comprehensively improves the accuracy of cross-system user permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A schematic diagram of a process flow of a method for cross-system user authority management and control in one embodiment;

[0059] Figure 2 A schematic diagram of interface interaction between systems in an embodiment;

[0060] Figure 3 A system authorization association diagram in one embodiment;

[0061] Figure 4 A flowchart of an example of cross-system user rights management and control in one embodiment;

[0062] Figure 5 A structural block diagram of a cross-system user authority management and control device in one embodiment;

[0063] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] The cross-system user authority control method provided in the embodiment of the present application can be applied to the application environment of cross-system user authority control. Among them, the method can be applied to a terminal, can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be, but is not limited to, various personal computers, laptops, medium-sized computers, etc. Among them, the terminal analyzes the authority range information corresponding to each authority authentication requirement of each system from the system authority control information of each system, and then identifies the authority association information between the systems based on the system communication architecture information between the systems, so that when a user accesses a single system, it can identify the user association authority information of each actual associated system corresponding to the current user access authority information of the target and the actual association with the target system according to the authority association information between the systems, so that it is possible to simultaneously control the authority access of multiple systems, and realize that the user can access all business systems actually associated with the target system with only one login, and can perform synchronous access authority control on each business system actually associated, avoiding the problem that the third-party control platform can only control at a single point and cannot realize the accurate identification of cross-system authority, and comprehensively improves the accuracy of cross-system user authority control.

[0066] In an exemplary embodiment, Figure 1 As shown, a cross-system user rights management method is provided, which is described by taking the method applied to a terminal as an example, and includes the following steps S101 to S103. Among them:

[0067] Step S101, obtain the system authority management information of each system, the system communication architecture information between each system, and the user's current access authentication information to the target system, and based on the system authority management information of each system, identify the authority authentication requirements of each system and the authority scope information corresponding to the authority authentication requirements of each system.

[0068] In this embodiment, the terminal queries the system permission management information of each system in the system permission database of each system. Among them, each system permission management information includes the permission scope contained in each system and the permission restriction conditions of each permission scope, wherein the permission restriction conditions are condition information that restricts users from accessing the system, and the condition information corresponds to the user identity scope of each user identity type of each user. Specifically, the user identity scope identification process will be described in detail later. Among them, each system refers to your system communication architecture information, which is the system mutual access permission scope information between each system, wherein the system mutual access permission scope information between each system includes the subordinate relationship between each system, the permission limitation scope between each system, and the mutual access permission content between each system. Then, based on the system permission management information of each system, the terminal identifies the permission authentication requirements of each system and the permission scope information corresponding to the permission authentication requirements of each system. The specific identification process will be described in detail later. Among them, such as Figure 2 As shown, the system inter-access between systems is achieved through standardized API interfaces provided by each business system, thereby realizing the inter-access between systems, as well as the terminal's authority control over each system and the unified implementation function of data acquisition.

[0069] Step S102, based on the system communication architecture information between the systems, identify the permission association information between the systems, and based on the permission authentication requirements of each system and the permission scope information corresponding to the permission authentication requirements of each system, identify the access requirement information corresponding to the permission scope of each system.

[0070] In this embodiment, the terminal identifies the permission association information between the systems based on the system communication architecture information between the systems, and identifies the access requirement information corresponding to each permission range of each system based on the permission authentication requirements of each system and the permission range information corresponding to each permission authentication requirement of each system. Among them, the access requirement information corresponding to each permission range of each system is the requirement information for user permissions for each permission range. The specific identification process will be described in detail later.

[0071] Step S103, based on the current access authentication information and the access requirement information corresponding to each permission range of the target system, identify the current user access permission information of the user in the target system, and based on the current user access permission information of the user in the target system and the permission association information between the systems, identify the user's user associated permission information for each actually associated system.

[0072] In this embodiment, the terminal identifies the current user access permission information of the user in the target system based on the current access authentication information and the access requirement information corresponding to each permission range of the target system. Among them, the current user access permission information is the permission range that the user can access in the target system. The specific identification process will be described in detail later. The terminal identifies the user's user-associated permission information for each actually associated system based on the user's current user access permission information in the target system and the permission association information between the systems. Among them, each actually associated system includes a system that is directly associated with the target system, or a system that is indirectly associated with the target system and has interconnected permission content. The specific identification process of the actual associated system will be described in detail later. Among them, when identifying the target system accessed by the user, the terminal uses the following method: Figure 3 As shown in the system authorization association diagram, after the user's current access authentication information of the target system is accessed and authenticated, the terminal obtains the user's current access authentication information and then identifies the target system accessed by the user through various permission interfaces.

[0073] Step S104 , based on the current user access permission information of the user in the target system and the user associated permission information of the user to each actually associated system, cross-system access permission management and control processing is performed on the user.

[0074] In this embodiment, the terminal performs cross-system access rights management and control on the user based on the current user access rights information of the user in the target system and the user associated rights information of the user to each actually associated system. When performing cross-system access rights management and control on the user, it is necessary to monitor the user's access scope in real time through the role-based access control (RBAC) model, and when the user needs to jump to access other systems, it is determined whether the system is the actual associated system of the target system. If it is the actual associated system, the user does not need to log in, and the user associated rights information of the actual associated system is directly opened to the user. If it is not the actual associated system, it is necessary to return to step S103 for authority authentication.

[0075] Based on the above scheme, by analyzing the permission range information corresponding to each permission authentication requirement of each system from the system permission management information of each system, and then identifying the permission association information between the systems based on the system communication architecture information between the systems, when the user accesses a single system, the user association permission information of each actually associated system that has an actual association with the target system corresponding to the user's current user access permission information at the target can be identified based on the permission association information between the systems. This makes it possible to simultaneously perform synchronous management of permission access to multiple systems, while enabling users to access all business systems that are actually associated with the target system with only one login, and to perform synchronous access permission management for each actually associated business system, thereby avoiding the problem that the third-party management and control platform can only perform single-point management and control and cannot accurately identify cross-system permissions, and comprehensively improves the accuracy of cross-system user permission management.

[0076] Optionally, based on the system permission management and control information of each system, each permission authentication requirement of each system and the permission scope information corresponding to each permission authentication requirement of each system are identified, including: for each system, based on the system permission management and control information of the system, the system permission scope of the system and the permission restriction conditions of the system permission scope are identified, and the system permission scope of the system is divided into sub-permission scopes of each permission restriction condition; based on each permission restriction condition, the permission restriction information corresponding to each permission restriction condition is identified, and in the permission management and control database of the system, each permission restriction type contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information are queried; the permission authentication scope of each permission restriction type corresponding to each permission restriction information is used as each permission authentication requirement, and the sub-permission scope of each permission restriction condition is used as the permission scope information corresponding to each permission authentication requirement.

[0077] In this embodiment, the terminal identifies the system authority scope of the system and the authority restriction conditions of the system authority scope for each system based on the system authority control information of the system, and divides the system authority scope of the system into sub-authority scopes of each authority restriction condition. Among them, the system authority control information of the system is the authority restriction conditions of each system for each sub-authority scope of the authority scope contained in the system, and the authority restriction conditions are used to restrict the user from accessing each sub-authority scope of the system. Among them, the sub-authority scopes of the authority scope of the system are, for example, system A is a database system, and the authority scope of system A is the query authority of the entire database, wherein the database contains a, b, c, d, e, 5 sub-databases, each sub-database corresponds to a database type, then the authority scope of the database system is the authority scope of 5 sub-databases, wherein each sub-database corresponds to a sub-authority scope. The authority restriction condition corresponds to an authority restriction information, each authority restriction information contains one or more authority restriction types, wherein the authority restriction information is the authority restriction information for the user, and the authority restriction type corresponds to each user identity type of the user. The specific authority restriction information and user identity type correspondence identification process will be described in detail later.

[0078] Based on each permission restriction condition, the terminal identifies the permission restriction information corresponding to each permission restriction condition, and queries the permission restriction types contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information in the permission control database of the system. The permission authentication scope is used to characterize the scope of authentication information allowed to be accessed by each permission restriction type, and the scope of the authentication information corresponds to the identity scope of each user identity type of the user. Specifically, the identification process of the corresponding relationship between each permission authentication scope and the identity scope of the user identity type will be described in detail later.

[0079] Finally, the terminal uses the permission authentication scope of each permission restriction type corresponding to each permission restriction information as each permission authentication requirement, and uses the sub-permission scope of each permission restriction condition as the permission scope information corresponding to each permission authentication requirement.

[0080] Based on the above solution, by splitting the system's authority scope into sub-authority scopes, the molecular authority scopes are used to analyze the system's authority authentication requirements and authority scope information, thereby improving the comprehensiveness and precision of identification.

[0081] Optionally, based on the system communication architecture information between the systems, the permission association information between the systems is identified, including: based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with an association relationship and the associated permission content between the associated systems are identified; based on the associated permission content between the associated systems, a system permission association map between the associated systems is constructed, and based on the system permission association map between the associated systems, the actual associated systems corresponding to each system are identified; based on the associated permission content between the associated systems, the target associated permission content between each system and the actual associated systems corresponding to each system is identified, and the target associated permission content between each system and the actual associated systems corresponding to each system is used as the permission association information between the systems.

[0082] In this embodiment, the terminal identifies the system permission association relationship between the systems based on the system communication architecture information between the systems, and identifies the associated systems with an association relationship and the associated permission content between the associated systems based on the system permission association relationship of each system. Among them, the system permission association relationship includes but is not limited to a subordinate relationship, a containment relationship, a link index relationship, etc., and the associated systems with an association relationship are systems between the systems, and the two systems have a direct association relationship.

[0083] Then, the terminal constructs a system permission association map between the associated systems based on the associated permission content between the associated systems, and identifies the actual associated systems corresponding to each system based on the system permission association map between the associated systems. The actual associated system is a system in which two systems have a direct association relationship and an indirect association relationship. For example, an indirect association relationship is that system A is associated with system B, and system B is associated with system C. If the permission range in system A is the same as, overlaps with, or includes the permission range between system C, then there is an indirect association relationship between system A and system C.

[0084] Then, based on the associated permission contents between the associated systems, the terminal identifies the target associated permission contents between each system and the actual associated systems corresponding to each system, and uses the target associated permission contents between each system and the actual associated systems corresponding to each system as the permission association information between the systems. The associated permission contents are the contents corresponding to the permission scopes that are the same, overlapped, or included in the sub-permission scopes of the two systems.

[0085] Based on the above solution, by constructing a correlation map, the indirect correlation between each system is identified, thereby improving the comprehensiveness of the identification of each existing correlation.

[0086] Optionally, based on the permission authentication requirements of each system and the permission scope information corresponding to the permission authentication requirements of each system, access requirement information corresponding to each permission scope of each system is identified, including: for each system, based on the permission authentication scope of each permission restriction type corresponding to each sub-permission scope of the system, querying the user identity type corresponding to each permission restriction type in the permission restriction database, and based on the permission authentication scope of each permission restriction type, querying the user identity scope of the user identity type corresponding to the permission authentication scope of each permission restriction type in the permission restriction database; using the user identity scope of each user identity type as the access requirement information of the sub-permission scope.

[0087] In this embodiment, for each system, the terminal queries the user identity type corresponding to each permission restriction type in the permission restriction database based on the permission authentication scope of each permission restriction type corresponding to each sub-permission scope of the system, and queries the user identity scope of the user identity type corresponding to the permission authentication scope of each permission restriction type in the permission restriction database based on the permission authentication scope of each permission restriction type. Among them, the permission restriction database includes the corresponding relationship between each permission restriction type and the user identity type, and the user identity type includes but is not limited to user position type, user length of service type, user performance type, user rank type, user gender type and other user identity types. The permission restriction database also includes the corresponding relationship between the permission authentication scope of each permission restriction type and the user identity scope of the user identity type. The terminal queries the above correspondence to obtain the user identity scope of each user identity type corresponding to the permission restriction scope of each permission restriction type.

[0088] Finally, the terminal uses the user identity range of each user identity type as access requirement information of the sub-authority range.

[0089] Based on the above solution, the access requirement information of each sub-authority scope is identified by means of corresponding relationship query, thereby improving the comprehensiveness and accuracy of the identification of the access requirement information of each sub-authority scope.

[0090] Optionally, based on current access authentication information and access requirement information corresponding to each permission scope of the target system, current user access permission information of the user in the target system is identified, including: based on the current access authentication information, user identity information of the user is identified, and based on the user identity information, in the target system database, current user access permission information of each user identity type of the user and the access permission scope requested by the user to access are queried; based on the current user access permission information of each user identity type of the user, within the user identity scope of each user identity type corresponding to each sub-permission scope of the target system, each target sub-permission scope accessible to the user is adapted, and based on the access permission scope requested by the user and each target sub-permission scope accessible to the user, the current user access permission information of the user in the target system is filtered.

[0091] In this embodiment, the terminal identifies the user's user identity information based on the current access authentication information, and based on the user identity information, queries the target system database for the current user access rights information of each user identity type and the scope of the access rights requested by the user. The user identity information may be, but is not limited to, user ID, user security identification code, user identity verification information and other identity identifications.

[0092] Then, based on the current user access permission information of each user identity type of the user, the terminal adapts each target sub-authority range that the user can access in the user identity range of each user identity type corresponding to each sub-authority range of the target system. Finally, based on the access permission range requested by the user and each target sub-authority range that the user can access, the terminal filters the current user access permission information of the user in the target system. Among them, the current user access permission information of the user in the target system is the permission content of each target sub-authority range that the user can access.

[0093] Based on the above solution, through permission identification, permission authentication, and permission limitation, the user's access rights can be effectively limited, thereby improving the accuracy of permission scope limitation.

[0094] Optionally, based on the current user access permission information of the user in the target system and the permission association information between the systems, the user-associated permission information of the user for each actual associated system is identified, including: based on the user identity information of the user and the access requirement information corresponding to each permission scope of each actual associated system corresponding to the target system, identifying each associated target sub-permission scope of each actual associated system that the user can access; based on each target sub-permission scope that the user can access and each associated target sub-permission scope of each actual associated system that the user can access, in the target system and each actual associated system corresponding to the target system, identifying the current access permission content of the user in the target system and the current associated access permission content of the user in each actual associated system corresponding to the target system; based on the target associated permission content between the target system and each actual associated system corresponding to the target system, the current access permission content of the user in the target system and the current associated access permission content of the user in each actual associated system corresponding to the target system, identifying the current actual associated access permission content of the user in each actual associated system corresponding to the target system through a permission scope limitation strategy; using the current actual associated access permission content of the user in each actual associated system corresponding to the target system as the user-associated permission information of the user for each actual associated system.

[0095] In this embodiment, the terminal identifies each associated target sub-authority range of each actual associated system that the user can access based on the user identity information of the user and the access requirement information corresponding to each authority range of each actual associated system corresponding to the target system. The terminal needs to screen each actual associated system corresponding to the target system accessed by the user in each system, and then the terminal identifies the access requirement information corresponding to each authority range of each actual associated system, queries the authority range that the user can access in each actual associated system, and obtains each associated target sub-authority range of each actual associated system that the user can access. If the user's identity information and information related to access rights are entered in the actual associated system, the terminal can query the authority range that the user can access in each actual associated system, and if the user's share information and information related to access rights are not entered in the actual associated system, the authority range that the user can access in the actual associated system is 0.

[0096] Then, based on each target sub-authority range that the user can access and each associated target sub-authority range of each actually associated system that the user can access, the terminal identifies the current access permission content of the user in the target system and the current associated access permission content of the user in each actually associated system corresponding to the target system in the target system and each actually associated system corresponding to the target system. Since the association information between the target system and each actually associated system corresponding to the target system includes the permission content association information between the systems, the terminal identifies the permission content of each system corresponding to the target sub-authority range that the user can access in the target system by querying the permission content association information. The permission content is the first permission content that the user can access, and the permission content corresponding to each associated target sub-authority range of each actually associated system that the user can access is the second permission content.

[0097] Finally, based on the target associated permission content between the target system and each actual associated system corresponding to the target system, the current access permission content of the user in the target system, and the current associated access permission content of the user in each actual associated system corresponding to the target system, the terminal identifies the current actual associated access permission content of the user in each actual associated system corresponding to the target system through the permission range limitation strategy; and uses the current actual associated access permission content of the user in each actual associated system corresponding to the target system as the user associated permission information of the user for each actual associated system. Specifically, when the first permission content is greater than the second permission content, the current actual associated access permission content of each actual associated system that the user can access is the first permission content, and when the first permission content is not greater than the second permission content, the current actual associated access permission content of each actual associated system that the user can access is the second permission content.

[0098] Based on the above solution, by identifying the first permission content and the second permission content, the user's identification accuracy and comprehensiveness of the user's associated permission information of each actually associated system can be determined.

[0099] This application also provides an example of cross-system user permission management, such as Figure 4 As shown, the specific processing process includes the following steps:

[0100] Step S401, obtaining system authority management information of each system, system communication architecture information between systems, and user's current access authentication information to the target system.

[0101] Step S402, for each system, based on the system authority management and control information of the system, identify the system authority scope of the system and the authority restriction conditions of the system authority scope, and divide the system authority scope of the system into sub-authority scopes of each authority restriction condition.

[0102] Step S403, based on each permission restriction condition, identify the permission restriction information corresponding to each permission restriction condition, and query the permission restriction types contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information in the system's permission management and control database.

[0103] Step S404, taking the permission authentication scope of each permission restriction type corresponding to each permission restriction information as each permission authentication requirement, and taking the sub-permission scope of each permission restriction condition as the permission scope information corresponding to each permission authentication requirement.

[0104] Step S405, based on the system communication architecture information between the systems, identify the system permission association relationship between the systems, and based on the system permission association relationship of each system, identify the associated systems with an associated relationship and the associated permission content between the associated systems.

[0105] Step S406, based on the associated permission contents between the associated systems, a system permission association map between the associated systems is constructed, and based on the system permission association map between the associated systems, actual associated systems corresponding to each system are identified.

[0106] Step S407, based on the associated permission content between each associated system, identify the target associated permission content between each system and each actual associated system corresponding to each system, and use the target associated permission content between each system and each actual associated system corresponding to each system as the permission association information between each system.

[0107] Step S408, for each system, based on the authority authentication scope of each authority restriction type corresponding to each sub-authority scope of the system, query the user identity type corresponding to each authority restriction type in the authority restriction database, and based on the authority authentication scope of each authority restriction type, query the user identity scope of the user identity type corresponding to the authority authentication scope of each authority restriction type in the authority restriction database.

[0108] Step S409: Using the user identity range of each user identity type as access requirement information of the sub-authority range.

[0109] Step S410, based on the current access authentication information, the user's user identity information is identified, and based on the user identity information, the current user access permission information of each user identity type and the scope of the access permission requested by the user are queried in the target system database.

[0110] Step S411, based on the current user access permission information of each user identity type of the user, adapt the target sub-authority ranges that the user can access in the user identity range of each user identity type corresponding to each sub-authority range of the target system, and filter the current user access permission information of the user in the target system based on the access permission range requested by the user and the target sub-authority ranges that the user can access.

[0111] Step S412, based on the user identity information of the user and the access requirement information corresponding to the authority scopes of each actual associated system corresponding to the target system, identifying the associated target sub-authority scopes of each actual associated system that the user can access.

[0112] Step S413, based on each target sub-authority range that the user can access and each associated target sub-authority range of each actual associated system that the user can access, in the target system and each actual associated system corresponding to the target system, identify the current associated access permission content of the user in each actual associated system corresponding to the target system.

[0113] Step S414, based on the target associated permission content between the target system and the actual associated systems corresponding to the target system, and the current associated access permission content of the user in the actual associated systems corresponding to the target system, the current actual associated access permission content of the user in the actual associated systems corresponding to the target system is identified through the permission range limitation strategy.

[0114] Step S415: The current actual associated access permission content of the user in each actual associated system corresponding to the target system is used as the user associated permission information of the user to each actual associated system.

[0115] Step S416: Based on the current user access permission information of the user in the target system and the user associated permission information of the user to each actually associated system, cross-system access permission management and control processing is performed on the user.

[0116] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0117] Based on the same inventive concept, the embodiment of the present application also provides a cross-system user rights control device for implementing the cross-system user rights control method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more cross-system user rights control devices provided below can refer to the limitations of the cross-system user rights control method above, and will not be repeated here.

[0118] In an exemplary embodiment, Figure 5 As shown, a cross-system user authority management device is provided, including: an acquisition module 510, a first identification module 520, a second identification module 530 and a management module 540, wherein:

[0119] The acquisition module 510 is used to acquire the system authority control information of each system, the system communication architecture information between the systems, and the current access authentication information of the user to the target system, and identify the authority authentication requirements of each system and the authority scope information corresponding to the authority authentication requirements of each system based on the system authority control information of each system;

[0120] The first identification module 520 is used to identify the permission association information between the systems based on the system communication architecture information between the systems, and to identify the access requirement information corresponding to each permission range of each system based on each permission authentication requirement of each system and the permission range information corresponding to each permission authentication requirement of each system;

[0121] A second identification module 530 is used to identify the current user access permission information of the user in the target system based on the current access authentication information and the access requirement information corresponding to each permission range of the target system, and to identify the user associated permission information of the user for each of the actually associated systems based on the current user access permission information of the user in the target system and the permission association information between the systems;

[0122] The control module 540 is used to perform cross-system access rights control on the user based on the current user access rights information of the user in the target system and the user associated permission information of the user to each of the actually associated systems.

[0123] Optionally, the acquisition module 510 is specifically configured to:

[0124] For each system, based on the system authority management and control information of the system, identify the system authority scope of the system and the authority restriction conditions of the system authority scope, and divide the system authority scope of the system into sub-authority scopes of each authority restriction condition;

[0125] Based on each of the permission restriction conditions, identifying the permission restriction information corresponding to each permission restriction condition, and querying the permission restriction types contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information in the permission control database of the system;

[0126] The permission authentication scope of each permission restriction type corresponding to each permission restriction information is used as each permission authentication requirement, and the sub-permission scope of each permission restriction condition is used as the permission scope information corresponding to each permission authentication requirement.

[0127] Optionally, the first identification module 520 is specifically configured to:

[0128] Based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with an association relationship and the associated permission content between the associated systems are identified;

[0129] Based on the associated permission contents between the associated systems, a system permission association map between the associated systems is constructed, and based on the system permission association map between the associated systems, actual associated systems corresponding to each system are identified;

[0130] Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

[0131] Optionally, the first identification module 520 is specifically configured to:

[0132] For each system, based on the authority authentication scope of each authority restriction type corresponding to each sub-authority scope of the system, query the user identity type corresponding to each authority restriction type in the authority restriction database, and based on the authority authentication scope of each authority restriction type, query the user identity scope of the user identity type corresponding to the authority authentication scope of each authority restriction type in the authority restriction database;

[0133] The user identity range of each user identity type is used as the access requirement information of the sub-authority range.

[0134] Optionally, the second identification module 530 is specifically configured to:

[0135] Based on the current access authentication information, identify the user identity information of the user, and based on the user identity information, query the target system database for current user access permission information of each user identity type of the user and the scope of the access permission requested by the user;

[0136] Based on the current user access permission information of each user identity type of the user, in the user identity range of each user identity type corresponding to each sub-authority range of the target system, the target sub-authority ranges that the user can access are adapted; and based on the access permission range requested by the user and the target sub-authority ranges that the user can access, the current user access permission information of the user in the target system is filtered.

[0137] Optionally, the second identification module 530 is specifically configured to:

[0138] Based on the user identity information of the user and the access requirement information corresponding to the authority ranges of each actual associated system corresponding to the target system, identifying the associated target sub-authority ranges of each actual associated system that the user can access;

[0139] Based on each target sub-authority range accessible to the user and each associated target sub-authority range of each actually associated system accessible to the user, in the target system and each actually associated system corresponding to the target system, identifying the current associated access permission content of the user in each actually associated system corresponding to the target system;

[0140] Based on the target association permission content between the target system and each actual association system corresponding to the target system, and the current association access permission content of the user in each actual association system corresponding to the target system, identifying the current actual association access permission content of the user in each actual association system corresponding to the target system through the permission range limitation strategy;

[0141] The current actually associated access permission content of the user in each actually associated system corresponding to the target system is used as the user associated permission information of the user to each of the actually associated systems.

[0142] Each module in the above-mentioned cross-system user rights control device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0143] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for user authority management across the system is realized. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0144] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0145] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of a cross-system user authority management method when executing the computer program.

[0146] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of a method for cross-system user authority management and control are implemented.

[0147] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of a cross-system user authority management method when executed by a processor.

[0148] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0149] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0150] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0151] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A cross-system user rights management method, characterized in that: The method comprises: Obtaining system authority management and control information of each system, system communication architecture information between the systems, and current access authentication information of the user to the target system, and based on the system authority management and control information of the systems, identifying each authority authentication requirement of each system and authority scope information corresponding to each authority authentication requirement of each system; Based on the system communication architecture information between the systems, the permission association information between the systems is identified, and based on the permission authentication requirements of each system and the permission range information corresponding to the permission authentication requirements of each system, the access requirement information corresponding to the permission range of each system is identified; Based on the current access authentication information and the access requirement information corresponding to each permission range of the target system, identify the current user access permission information of the user in the target system, and based on the current user access permission information of the user in the target system and the permission association information between the systems, identify the user associated permission information of the user for each actually associated system; Based on the current user access permission information of the user in the target system and the user associated permission information of the user to each of the actually associated systems, cross-system access permission management and control processing is performed on the user.

2. The method according to claim 1, characterized in that The system authority control information based on each of the systems, identifying each authority authentication requirement of each system, and authority scope information corresponding to each authority authentication requirement of each system, includes: For each system, based on the system authority control information of the system, identify the system authority scope of the system and the authority restriction conditions of the system authority scope, and divide the system authority scope of the system into sub-authority scopes of each authority restriction condition; Based on each of the permission restriction conditions, identifying the permission restriction information corresponding to each permission restriction condition, and querying the permission restriction types contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information in the permission control database of the system; The permission authentication scope of each permission restriction type corresponding to each permission restriction information is used as each permission authentication requirement, and the sub-permission scope of each permission restriction condition is used as the permission scope information corresponding to each permission authentication requirement.

3. The method according to claim 1, characterized in that The identifying the authority association information between the systems based on the system communication architecture information between the systems includes: Based on the system communication architecture information between the systems, the system authority association relationship between the systems is identified, and based on the system authority association relationship of each system, the associated systems with an association relationship and the associated authority content between the associated systems are identified; Based on the associated permission contents between the associated systems, a system permission association map between the associated systems is constructed, and based on the system permission association map between the associated systems, actual associated systems corresponding to each system are identified; Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

4. The method according to claim 2, characterized in that: The identifying access requirement information corresponding to each permission range of each system based on each permission authentication requirement of each system and the permission range information corresponding to each permission authentication requirement of each system includes: For each system, based on the authority authentication scope of each authority restriction type corresponding to each sub-authority scope of the system, query the user identity type corresponding to each authority restriction type in the authority restriction database, and based on the authority authentication scope of each authority restriction type, query the user identity scope of the user identity type corresponding to the authority authentication scope of each authority restriction type in the authority restriction database; The user identity range of each user identity type is used as the access requirement information of the sub-authority range.

5. The method according to claim 4, characterized in that The identifying the current user access permission information of the user in the target system based on the current access authentication information and the access requirement information corresponding to each permission range of the target system includes: Based on the current access authentication information, identify the user identity information of the user, and based on the user identity information, query the target system database for current user access permission information of each user identity type of the user and the scope of the access permission requested by the user; Based on the current user access permission information of each user identity type of the user, in the user identity range of each user identity type corresponding to each sub-authority range of the target system, the target sub-authority ranges that the user can access are adapted; and based on the access permission range requested by the user and the target sub-authority ranges that the user can access, the current user access permission information of the user in the target system is filtered.

6. The method according to claim 3, characterized in that The identifying the user associated permission information of the user for each of the actually associated systems based on the current user access permission information of the user in the target system and the permission association information between the systems includes: Based on the user identity information of the user and the access requirement information corresponding to the authority ranges of each actual associated system corresponding to the target system, identifying the associated target sub-authority ranges of each actual associated system that the user can access; Based on each target sub-authority range accessible to the user and each associated target sub-authority range of each actually associated system accessible to the user, in the target system and each actually associated system corresponding to the target system, identifying the current associated access permission content of the user in each actually associated system corresponding to the target system; Based on the target association permission content between the target system and each actual association system corresponding to the target system, and the current association access permission content of the user in each actual association system corresponding to the target system, identifying the current actual association access permission content of the user in each actual association system corresponding to the target system through the permission range limitation strategy; The current actually associated access permission content of the user in each actually associated system corresponding to the target system is used as the user associated permission information of the user to each of the actually associated systems.

7. A cross-system user authority management and control device, characterized in that: The device comprises: An acquisition module is used to acquire system authority management and control information of each system, system communication architecture information between the systems, and current access authentication information of the user to the target system, and based on the system authority management and control information of the systems, identify each authority authentication requirement of each system and authority scope information corresponding to each authority authentication requirement of each system; A first identification module is used to identify the permission association information between the systems based on the system communication architecture information between the systems, and to identify the access requirement information corresponding to each permission range of each system based on each permission authentication requirement of each system and the permission range information corresponding to each permission authentication requirement of each system; A second identification module is used to identify the current user access permission information of the user in the target system based on the current access authentication information and the access requirement information corresponding to each permission range of the target system, and to identify the user associated permission information of the user for each actually associated system based on the current user access permission information of the user in the target system and the permission association information between each of the systems; The control module is used to perform cross-system access rights control on the user based on the current user access rights information of the user in the target system and the user associated permission information of the user to each of the actually associated systems.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images