User permission management method and device across systems and computer device

Abstract

This application relates to a method, apparatus, and computer device for cross-system user access control. The method includes: acquiring system access control information of each system, system connectivity architecture information between systems, and current access authentication information of a user on a target system; identifying the authentication requirements of each system and the corresponding access scope information for each authentication requirement; identifying access association information between systems based on the system connectivity architecture information, and identifying access requirement information corresponding to each access scope in each system; identifying the user's current access permissions in the target system and the user's associated access permissions in each actual associated system, thereby performing cross-system access permission control processing. This method can improve the accuracy of cross-system user access control.

Description

Technical Field

[0001] This application relates to the field of financial and insurance service technology, and in particular to a cross-system user access control method, apparatus and computer equipment. Background Technology

[0002] This document addresses access control and authentication technologies for multiple systems and modules within complex enterprise environments. As enterprises become increasingly information-driven, data sharing and interaction between different business systems have become commonplace. Efficiently and securely managing user permissions within these systems, and ensuring the legality and security of data access, has become a pressing technical challenge.

[0003] In existing technical solutions, some third-party permission management platforms have implemented permission control over third-party platforms. However, the permission control of these platforms focuses on single sign-on (SSO) functionality and lacks support for fine-grained permission control (such as module-level and function-level permissions). This makes it difficult to accurately identify permissions across systems, resulting in poor accuracy in cross-system user permission control. Summary of the Invention

[0004] Therefore, it is necessary to provide a cross-system user access control method, device, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems.

[0005] Firstly, this application provides a cross-system user permission management method, including:

[0006] Obtain system permission control information of each system, system communication architecture information between each system, and current access authentication information of the user to the target system. Based on the system permission control information of each system, identify the authentication requirements of each system and the permission scope information corresponding to each authentication requirement of each system.

[0007] Based on the system communication architecture information between the systems, the permission association information between the systems is identified, and based on the permission authentication requirements of each system and the permission scope information corresponding to the permission authentication requirements of each system, the access requirement information corresponding to each permission scope of each system is identified.

[0008] Based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system, the user's current user access permission information in the target system is identified. Based on the user's current user access permission information in the target system and the permission association information between the systems, the user's user association permission information for each of the actual associated systems is identified.

[0009] Based on the user's current user access permission information in the target system and the user's user association permission information in each of the actual associated systems, cross-system access permission management is performed on the user.

[0010] Optionally, the step of identifying the authentication requirements of each system and the corresponding permission scope information based on the system permission control information of each system includes:

[0011] For each system, based on the system permission control information of the system, the system permission scope of the system and the permission restriction conditions of the system permission scope are identified, and the system permission scope of the system is divided into sub-permission scopes of each permission restriction condition;

[0012] Based on each of the aforementioned permission restriction conditions, identify the permission restriction information corresponding to each permission restriction condition, and query the permission restriction types contained in each permission restriction information and the permission authentication range of each permission restriction type corresponding to each permission restriction information in the permission management database of the system.

[0013] The permission authentication range of each permission restriction type corresponding to each permission restriction information is taken as each permission authentication requirement, and the sub-permission range of each permission restriction condition is taken as the permission range information corresponding to each permission authentication requirement.

[0014] Optionally, identifying permission association information between the systems based on the system communication architecture information between the systems includes:

[0015] Based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with association relationship and the associated permission content between the associated systems are identified.

[0016] Based on the associated permission content between the associated systems, a system permission association graph is constructed between the associated systems, and based on the system permission association graph between the associated systems, the actual associated systems corresponding to each system are identified;

[0017] Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

[0018] Optionally, the step of identifying access requirement information corresponding to each permission scope of each system based on the authentication requirements of each system and the permission scope information corresponding to each authentication requirements of each system includes:

[0019] For each system, based on the permission authentication range of each permission restriction type corresponding to each sub-permission range of the system, query the user identity type corresponding to each permission restriction type in the permission restriction database, and based on the permission authentication range of each permission restriction type, query the user identity range of the user identity type corresponding to the permission authentication range of each permission restriction type in the permission restriction database;

[0020] The user identity range of each of the aforementioned user identity types is used as the access requirement information for the sub-permission range.

[0021] Optionally, identifying the user's current user access permission information in the target system based on the current access authentication information and the access request information corresponding to each permission scope of the target system includes:

[0022] Based on the current access authentication information, the user's user identity information is identified, and based on the user identity information, the current user access permission information for each user identity type and the access permission range requested by the user are queried in the target system database.

[0023] Based on the current user access permission information of each user identity type of the user, in the user identity range of each user identity type corresponding to each sub-permission range of the target system, adapt each target sub-permission range that the user can access, and filter the current user access permission information of the user in the target system based on the access permission range requested by the user and each target sub-permission range that the user can access.

[0024] Optionally, the step of identifying the user's associated user permission information for each of the actual associated systems based on the user's current user access permission information in the target system and the permission association information between the systems includes:

[0025] Based on the user's user identity information and the access requirement information corresponding to each permission range of each actual associated system of the target system, identify the associated target sub-permission range of each actual associated system that the user can access.

[0026] Based on the target sub-permission ranges that the user can access and the associated target sub-permission ranges of each actual associated system that the user can access, the current associated access permissions of the user in each actual associated system corresponding to the target system are identified in the target system and each actual associated system corresponding to the target system.

[0027] Based on the target association permission content between the target system and each actual associated system corresponding to the target system, and the current association permission content of the user in each actual associated system corresponding to the target system, the current actual association permission content of the user in each actual associated system corresponding to the target system is identified through the permission scope limitation strategy.

[0028] The current actual associated access permissions of the user in each actual associated system corresponding to the target system shall be used as the user's user associated access permissions information for each actual associated system.

[0029] Secondly, this application also provides a cross-system user access control device, including:

[0030] The acquisition module is used to acquire system permission control information of each system, system communication architecture information between each system, and the current access authentication information of the user to the target system, and based on the system permission control information of each system, to identify the permission authentication requirements of each system and the permission scope information corresponding to each permission authentication requirement of each system.

[0031] The first identification module is used to identify the permission association information between the systems based on the system communication architecture information between the systems, and to identify the access requirement information corresponding to each permission scope of each system based on the permission authentication requirements of each system and the permission scope information corresponding to each permission authentication requirements of each system.

[0032] The second identification module is used to identify the user's current user access permission information in the target system based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system, and to identify the user's user association permission information for each of the actual associated systems based on the user's current user access permission information in the target system and the permission association information between the systems.

[0033] The management module is used to perform cross-system access control processing on the user based on the user's current user access permission information in the target system and the user's user association permission information in each of the actual associated systems.

[0034] Optionally, the acquisition module is specifically used for:

[0035] For each system, based on the system permission control information of the system, the system permission scope of the system and the permission restriction conditions of the system permission scope are identified, and the system permission scope of the system is divided into sub-permission scopes of each permission restriction condition;

[0036] Based on each of the aforementioned permission restriction conditions, identify the permission restriction information corresponding to each permission restriction condition, and query the permission restriction types contained in each permission restriction information and the permission authentication range of each permission restriction type corresponding to each permission restriction information in the permission management database of the system.

[0037] The permission authentication range of each permission restriction type corresponding to each permission restriction information is taken as each permission authentication requirement, and the sub-permission range of each permission restriction condition is taken as the permission range information corresponding to each permission authentication requirement.

[0038] Optionally, the first identification module is specifically used for:

[0039] Based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with association relationship and the associated permission content between the associated systems are identified.

[0040] Based on the associated permission content between the associated systems, a system permission association graph is constructed between the associated systems, and based on the system permission association graph between the associated systems, the actual associated systems corresponding to each system are identified;

[0041] Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

[0042] Optionally, the first identification module is specifically used for:

[0043] For each system, based on the permission authentication range of each permission restriction type corresponding to each sub-permission range of the system, query the user identity type corresponding to each permission restriction type in the permission restriction database, and based on the permission authentication range of each permission restriction type, query the user identity range of the user identity type corresponding to the permission authentication range of each permission restriction type in the permission restriction database;

[0044] The user identity range of each of the aforementioned user identity types is used as the access requirement information for the sub-permission range.

[0045] Optionally, the second identification module is specifically used for:

[0046] Based on the current access authentication information, the user's user identity information is identified, and based on the user identity information, the current user access permission information for each user identity type and the access permission range requested by the user are queried in the target system database.

[0047] Based on the current user access permission information of each user identity type of the user, in the user identity range of each user identity type corresponding to each sub-permission range of the target system, adapt each target sub-permission range that the user can access, and filter the current user access permission information of the user in the target system based on the access permission range requested by the user and each target sub-permission range that the user can access.

[0048] Optionally, the second identification module is specifically used for:

[0049] Based on the user's user identity information and the access requirement information corresponding to each permission range of each actual associated system of the target system, identify the associated target sub-permission range of each actual associated system that the user can access.

[0050] Based on the target sub-permission ranges that the user can access and the associated target sub-permission ranges of each actual associated system that the user can access, the current associated access permissions of the user in each actual associated system corresponding to the target system are identified in the target system and each actual associated system corresponding to the target system.

[0051] Based on the target association permission content between the target system and each actual associated system corresponding to the target system, and the current association permission content of the user in each actual associated system corresponding to the target system, the current actual association permission content of the user in each actual associated system corresponding to the target system is identified through the permission scope limitation strategy.

[0052] The current actual associated access permissions of the user in each actual associated system corresponding to the target system shall be used as the user's user associated access permissions information for each actual associated system.

[0053] Thirdly, this application provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method described in any one of the first aspects.

[0054] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0055] Fifthly, this application provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0056] The aforementioned cross-system user access control method, apparatus, and computer equipment acquire system access control information of each system, system communication architecture information between the systems, and the user's current access authentication information to the target system. Based on the system access control information of each system, they identify the authentication requirements of each system and the corresponding permission scope information for each authentication requirement. Based on the system communication architecture information between the systems, they identify permission association information between the systems. Based on the authentication requirements of each system and the corresponding permission scope information for each authentication requirement, they identify the access requirement information corresponding to each permission scope of each system. Based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system, they identify the user's current access permission information in the target system. Based on the user's current access permission information in the target system and the permission association information between the systems, they identify the user's associated user permission information to each of the actual associated systems. Based on the user's current access permission information in the target system and the user's associated user permission information to each of the actual associated systems, they perform cross-system access permission control processing on the user. This solution analyzes the permission scope information corresponding to the authentication requirements of each system from the system permission control information of each system. Then, based on the system communication architecture information between the systems, it identifies the permission association information between the systems. Thus, when a user accesses a single system, it can identify the user's current user access permissions in the target system and the user's associated permissions in the actual related systems. This allows for simultaneous synchronous control of access permissions across multiple systems, enabling users to access all business systems actually associated with the target system with only one login, and synchronous access permission control for each of the actual related business systems. This avoids the problem that third-party control platforms can only control at a single point and cannot accurately identify cross-system permissions, thus comprehensively improving the accuracy of cross-system user permission control. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a flowchart illustrating a cross-system user permission control method in one embodiment;

[0059] Figure 2 This is a schematic diagram of the interface interaction between the systems in one embodiment;

[0060] Figure 3 This is a system authorization association diagram in one embodiment;

[0061] Figure 4 This is a flowchart illustrating a cross-system user permission management example in one embodiment;

[0062] Figure 5 This is a structural block diagram of a cross-system user access control device in one embodiment;

[0063] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0065] The cross-system user permission management method provided in this application embodiment can be applied to cross-system user permission management application environments. This method can be applied to terminals, servers, or systems including both terminals and servers, and is implemented through interaction between the terminal and server. Terminals can be, but are not limited to, various personal computers, laptops, mid-range computers, etc. The terminal analyzes the permission scope information corresponding to each system's permission authentication requirements from the system permission management information of each system, and then identifies the permission association information between systems based on the system communication architecture information. Thus, when a user accesses a single system, it can identify the user-related permission information of each actually associated system corresponding to the user's current user access permission information at the target system, based on the permission association information between systems. This allows for simultaneous synchronous management of permission access across multiple systems, enabling users to access all business systems actually associated with the target system with only one login, and synchronously managing access permissions for each actually associated business system. This avoids the problem that third-party management platforms can only manage single points and cannot accurately identify cross-system permissions, comprehensively improving the accuracy of cross-system user permission management.

[0066] In one exemplary embodiment, such as Figure 1 As shown, a cross-system user permission management method is provided. Taking the application of this method to a terminal as an example, the method includes the following steps S101 to S103. Wherein:

[0067] Step S101: Obtain system permission control information of each system, system communication architecture information between each system, and current access authentication information of the user to the target system. Based on the system permission control information of each system, identify the permission authentication requirements of each system and the permission scope information corresponding to each permission authentication requirement of each system.

[0068] In this embodiment, the terminal queries the system permission control information of each system in the system permission database of each system. The system permission control information includes the permission scope of each system and the permission restrictions for each permission scope. These restriction conditions are information that limits user access to the system, and they correspond to the user identity scope for each user's identity type. The specific process for identifying the user identity scope will be explained in detail later. Each system refers to your system communication architecture information and the system inter-system access permission scope information. The system inter-system access permission scope information includes the hierarchical relationship between each system, the permission limitation scope between each system, and the content of the inter-system access permissions. Then, based on the system permission control information of each system, the terminal identifies the authentication requirements of each system and the corresponding permission scope information for each system's authentication requirements. The specific identification process will be explained in detail later. For example, Figure 2 As shown, inter-system communication between systems is achieved through standardized API interfaces provided by each business system, as well as unified implementation functions for terminal access control and data acquisition for each system.

[0069] Step S102: Based on the system communication architecture information between the systems, identify the permission association information between the systems, and based on the permission authentication requirements of each system and the permission scope information corresponding to the permission authentication requirements of each system, identify the access requirement information corresponding to each permission scope of each system.

[0070] In this embodiment, the terminal identifies the permission association information between systems based on the system communication architecture information between the systems, and identifies the access requirement information corresponding to each permission scope of each system based on the authentication requirements of each system and the permission scope information corresponding to each authentication requirements of each system. The access requirement information corresponding to each permission scope of each system refers to the user permission requirement information for each permission scope. The specific identification process will be explained in detail later.

[0071] Step S103: Based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system, identify the user's current user access permission information in the target system, and based on the user's current user access permission information in the target system and the permission association information between each system, identify the user's associated user permission information for each actual associated system.

[0072] In this embodiment, the terminal identifies the user's current access permission information in the target system based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system. The current user access permission information refers to the permission scope that the user can access in the target system. The specific identification process will be described in detail later. The terminal identifies the user's associated user permission information for each actually associated system based on the user's current access permission information in the target system and the permission association information between systems. Each actually associated system includes systems directly associated with the target system, or systems indirectly associated with the target system and with interconnected permission content. The specific identification process for the actually associated systems will be described in detail later. Specifically, when identifying the target system accessed by the user, the terminal uses methods such as... Figure 3 The system authorization association diagram shown illustrates how, after a user authenticates their current access to the target system by uploading their authentication information to the authentication center, the terminal obtains the user's current access authentication information and then identifies the target system accessed by the user through various permission interfaces.

[0073] Step S104: Based on the user's current user access permission information in the target system and the user's associated user permission information in each actual associated system, perform cross-system access permission control processing for the user.

[0074] In this embodiment, the terminal performs cross-system access control processing on the user based on the user's current access permission information in the target system and the user's associated access permission information in each actual associated system. Specifically, when performing cross-system access control processing, a role-based access control (RBAC) model is used to monitor the user's access scope in real time. When the user needs to access other systems, it is determined whether the system is an actual associated system of the target system. If it is an actual associated system, the user does not need to log in and the user's associated access permission information for that system is directly granted. However, if it is not an actual associated system, the process returns to step S103 for permission authentication.

[0075] Based on the above solution, by analyzing the system permission control information of each system, the permission scope information corresponding to the authentication requirements of each system is analyzed. Then, based on the system communication architecture information between the systems, the permission association information between the systems is identified. Thus, when a user accesses a single system, the permission association information between the systems can be used to identify the user's current user access permissions in the target system and the user's associated permission information in each of the actual related systems. This allows for simultaneous synchronous control of access permissions across multiple systems, while enabling users to access all business systems actually associated with the target system with only one login. Synchronous access permission control can be performed on each of the actual related business systems, avoiding the problem that third-party control platforms can only control at a single point and cannot accurately identify cross-system permissions. This comprehensively improves the accuracy of cross-system user permission control.

[0076] Optionally, based on the system permission control information of each system, identify the permission authentication requirements of each system and the permission scope information corresponding to each permission authentication requirement of each system. This includes: for each system, based on the system permission control information, identifying the system permission scope and the permission restriction conditions of the system permission scope, and dividing the system permission scope into sub-permission scopes of each permission restriction condition; based on each permission restriction condition, identifying the permission restriction information corresponding to each permission restriction condition, querying the permission restriction type contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information in the system's permission control database; using the permission authentication scope of each permission restriction type corresponding to each permission restriction information as each permission authentication requirement, and using the sub-permission scopes of each permission restriction condition as the permission scope information corresponding to each permission authentication requirement.

[0077] In this embodiment, for each system, the terminal identifies the system permission scope and its restriction conditions based on the system's system permission control information, and divides the system permission scope into sub-permission scopes for each restriction condition. The system permission control information specifies the restriction conditions for each sub-permission scope within the system's permission scope. These restriction conditions limit user access to each sub-permission scope of the system. For example, if system A is a database system, and its permission scope is query permission for the entire database, and this database contains five sub-databases (a, b, c, d, and e), each corresponding to a database type, then the database system's permission scope is the permission scope of these five sub-databases, with each sub-database corresponding to a sub-permission scope. Each restriction condition corresponds to a restriction information item, and each restriction information item contains one or more restriction types. The restriction information pertains to user permissions, while the restriction types correspond to different user identity types. The specific process for identifying the correspondence between restriction information and user identity types will be explained in detail later.

[0078] Based on various permission restrictions, the terminal identifies the permission restriction information corresponding to each restriction condition. In the system's permission management database, it queries the permission restriction types included in each permission restriction information, as well as the permission authentication range for each permission restriction type. The permission authentication range characterizes the scope of authentication information allowed to be accessed by each permission restriction type. This scope corresponds to the identity range of each user's identity type. The specific process for identifying the correspondence between each permission authentication range and the identity range of each user identity type will be explained in detail later.

[0079] Finally, the terminal uses the permission authentication range of each permission restriction type corresponding to each permission restriction information as each permission authentication requirement, and uses the sub-permission range of each permission restriction condition as the permission range information corresponding to each permission authentication requirement.

[0080] Based on the above scheme, by dividing the system's permission scope into sub-permission scopes, the sub-permission scopes analyze the system's permission authentication requirements and permission scope information, thereby improving the comprehensiveness and precision of the identification.

[0081] Optionally, based on the system connectivity architecture information between systems, the permission association information between systems is identified, including: based on the system connectivity architecture information between systems, identifying the system permission association relationships between systems, and based on the system permission association relationships of each system, identifying the associated systems with relationships, as well as the associated permission content between the associated systems; based on the associated permission content between the associated systems, constructing a system permission association graph between the associated systems, and based on the system permission association graph between the associated systems, identifying the actual associated systems corresponding to each system; based on the associated permission content between the associated systems, identifying the target associated permission content between each system and the actual associated systems corresponding to each system, and using the target associated permission content between each system and the actual associated systems corresponding to each system as the permission association information between systems.

[0082] In this embodiment, the terminal identifies the system permission relationships between systems based on the system communication architecture information between each system, and identifies the associated systems and the associated permission content between them based on the system permission relationships of each system. The system permission relationships include, but are not limited to, subordinate relationships, inclusion relationships, and link index relationships, and the associated systems are those systems with a direct relationship to each other.

[0083] Then, based on the associated permission content between each associated system, the terminal constructs a system permission association map between the associated systems, and identifies the actual associated systems corresponding to each system based on the system permission association map. The actual associated systems are those systems that have direct or indirect relationships. For example, if system A is associated with system B, and system B is associated with system C, and the permission scope of system A is the same as, overlaps with, or contains the permission scope of system C, then system A and system C have an indirect relationship.

[0084] Next, based on the associated permission content between each associated system, the terminal identifies the target associated permission content between each system and its corresponding actual associated systems, and uses this target associated permission content as the permission association information between the systems. The associated permission content refers to the content corresponding to the same, overlapping, or contained permission ranges within the sub-permission ranges of the two systems.

[0085] Based on the above scheme, by constructing an association graph, the indirect associations between each system are identified, thereby improving the comprehensiveness of the identification of the existing associations.

[0086] Optionally, based on the authentication requirements of each system and the corresponding permission scope information of each system's authentication requirements, the access requirement information corresponding to each permission scope of each system is identified, including: for each system, based on the authentication scope of each permission restriction type corresponding to each sub-permission scope of the system, querying the user identity type corresponding to each permission restriction type in the permission restriction database, and based on the authentication scope of each permission restriction type, querying the user identity scope of the user identity type corresponding to the authentication scope of each permission restriction type in the permission restriction database; and using the user identity scope of each user identity type as the access requirement information of the sub-permission scope.

[0087] In this embodiment, for each system, the terminal queries the permission restriction database for the user identity type corresponding to each permission restriction type, based on the permission authentication range of each permission restriction type corresponding to each sub-permission scope of the system. Then, based on the permission authentication range of each permission restriction type, the terminal queries the permission restriction database for the user identity range of the user identity type corresponding to the permission authentication range of each permission restriction type. The permission restriction database includes the correspondence between each permission restriction type and the user identity type. The user identity type includes, but is not limited to, user job title, user length of service, user performance, user rank, and user gender. The permission restriction database also includes the correspondence between the permission authentication range of each permission restriction type and the user identity range of the user identity type. By querying the above correspondence, the terminal can obtain the user identity range of each user identity type corresponding to the permission restriction range of each permission restriction type.

[0088] Finally, the terminal uses the user identity range of each user identity type as the access requirement information for the sub-permission range.

[0089] Based on the above scheme, the access requirement information of each sub-permission scope is identified by querying the corresponding relationship, which improves the comprehensiveness and accuracy of the identification of the access requirement information of each sub-permission scope.

[0090] Optionally, based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system, the user's current user access permission information in the target system is identified, including: based on the current access authentication information, identifying the user's user identity information, and based on the user identity information, querying the current user access permission information for each user identity type and the access permission scope requested by the user in the target system database; based on the current user access permission information for each user identity type, adapting each target sub-permission scope that the user can access within the user identity scope corresponding to each sub-permission scope of the target system, and filtering the user's current user access permission information in the target system based on the access permission scope requested by the user and the target sub-permission scope that the user can access.

[0091] In this embodiment, the terminal identifies the user's identity information based on the current access authentication information, and then queries the target system database based on the user's identity information to find the current user access permissions for each user identity type, as well as the scope of access permissions requested by the user. The user identity information may include, but is not limited to, user ID, user security identification code, user authentication information, and other identity identifiers.

[0092] Then, based on the user's current user access permission information for each user identity type, the terminal adapts the target sub-permission ranges that the user can access within the user identity ranges corresponding to each sub-permission range in the target system. Finally, based on the access permission range requested by the user and the target sub-permission ranges that the user can access, the terminal filters the user's current user access permission information in the target system. The user's current user access permission information in the target system constitutes the permission content of each target sub-permission range that the user can access.

[0093] Based on the above scheme, by identifying, authenticating, and limiting permissions, the scope of user access permissions can be efficiently limited, thereby improving the accuracy of permission scope limitation.

[0094] Optionally, based on the user's current user access permission information in the target system and the permission association information between various systems, the user's associated user permission information for each actual associated system is identified, including: based on the user's user identity information and the access requirement information corresponding to each permission scope of each actual associated system corresponding to the target system, identifying the associated target sub-permission scope that the user can access in each actual associated system; based on the target sub-permission scope that the user can access and the associated target sub-permission scope of each actual associated system that the user can access, identifying the user's current access permission content in the target system and the user's current associated access permission content in each actual associated system corresponding to the target system in the target system and in each actual associated system corresponding to the target system; based on the target associated permission content between the target system and each actual associated system corresponding to the target system, the user's current access permission content in the target system, and the user's current associated access permission content in each actual associated system corresponding to the target system, identifying the user's current actual associated access permission content in each actual associated system corresponding to the target system through a permission scope limitation strategy; and using the user's current actual associated access permission content in each actual associated system corresponding to the target system as the user's associated user permission information for each actual associated system.

[0095] In this embodiment, the terminal identifies the associated target sub-permission ranges of each actual associated system that the user can access, based on the user's identity information and the access request information corresponding to the permission ranges of each actual associated system corresponding to the target system. Specifically, the terminal needs to filter each actual associated system corresponding to the target system accessed by the user within each system. Then, the terminal identifies the access request information corresponding to the permission ranges of each actual associated system and queries the permission ranges that the user can access in each actual associated system, thus obtaining the associated target sub-permission ranges of each actual associated system that the user can access. If the user's identity information and access permission related information are entered in the actual associated system, the terminal can query the permission ranges that the user can access in each actual associated system. If the user's identity information and access permission related information are not entered in the actual associated system, then the permission range that the user can access in that actual associated system is 0.

[0096] Then, based on the target sub-permission ranges that the user can access, and the associated target sub-permission ranges of each actual associated system that the user can access, the terminal identifies the user's current access permissions in the target system and the associated access permissions in each actual associated system corresponding to the target system. Since the association information between the target system and its corresponding actual associated systems includes permission content association information between the systems, the terminal identifies the permission content of each system corresponding to the target sub-permission range that the user can access in the target system by querying the permission content association information. This permission content is the first permission content that the user can access, while the permission content corresponding to each associated target sub-permission range of each actual associated system that the user can access is the second permission content.

[0097] Finally, based on the target system and its corresponding associated systems' target permission content, the user's current access permissions in the target system, and the user's current associated access permissions in each of the corresponding associated systems, the terminal identifies the user's current actual associated access permissions in each of the corresponding associated systems through a permission scope limitation strategy. This current actual associated access permissions are then used as the user's associated permission information for each of the corresponding associated systems. Specifically, if the first permission content is greater than the second permission content, the current actual associated access permissions for each associated system the user can access are considered the first permission content; otherwise, if the first permission content is not greater than the second permission content, the current actual associated access permissions for each associated system the user can access are considered the second permission content.

[0098] Based on the above scheme, by identifying the content of the first permission and the content of the second permission, the accuracy and comprehensiveness of the identification of user-related permission information of each actual related system can be determined.

[0099] This application also provides an example of cross-system user permission management, such as... Figure 4 As shown, the specific processing procedure includes the following steps:

[0100] Step S401: Obtain system permission control information for each system, system communication architecture information between each system, and current access authentication information of the user to the target system.

[0101] Step S402: For each system, based on the system's system permission control information, identify the system's system permission scope and the permission restriction conditions of the system permission scope, and divide the system's system permission scope into sub-permission scopes of each permission restriction condition.

[0102] Step S403: Based on each permission restriction condition, identify the permission restriction information corresponding to each permission restriction condition, and query the permission restriction types contained in each permission restriction information and the permission authentication range of each permission restriction type corresponding to each permission restriction information in the system's permission control database.

[0103] Step S404: Take the permission authentication range of each permission restriction type corresponding to each permission restriction information as each permission authentication requirement, and take the sub-permission range of each permission restriction condition as the permission range information corresponding to each permission authentication requirement.

[0104] Step S405: Based on the system communication architecture information between each system, identify the system permission association relationship between each system, and based on the system permission association relationship of each system, identify the associated systems with association relationships, as well as the associated permission content between each associated system.

[0105] Step S406: Based on the associated permission content between each associated system, construct a system permission association map between each associated system, and based on the system permission association map between each associated system, identify each actual associated system corresponding to each system.

[0106] Step S407: Based on the associated permission content between each associated system, identify the target associated permission content between each system and each actual associated system corresponding to each system, and use the target associated permission content between each system and each actual associated system corresponding to each system as the permission association information between each system.

[0107] Step S408: For each system, based on the permission authentication range of each permission restriction type corresponding to each sub-permission range of the system, query the user identity type corresponding to each permission restriction type in the permission restriction database, and based on the permission authentication range of each permission restriction type, query the user identity range of the user identity type corresponding to the permission authentication range of each permission restriction type in the permission restriction database.

[0108] Step S409: Use the user identity range of each user identity type as the access requirement information of the sub-permission range.

[0109] Step S410: Based on the current access authentication information, identify the user's user identity information, and based on the user identity information, query the target system database for the current user access permission information for each user identity type, as well as the access permission range requested by the user.

[0110] Step S411: Based on the current user access permission information of each user identity type, adapt the target sub-permission ranges that the user can access within the user identity ranges of each user identity type corresponding to each sub-permission range of the target system, and filter the current user access permission information of the user in the target system based on the access permission range requested by the user and the target sub-permission ranges that the user can access.

[0111] Step S412: Based on the user's user identity information and the access requirement information corresponding to each permission scope of each actual associated system corresponding to the target system, identify the associated target sub-permission scope of each actual associated system that the user can access.

[0112] Step S413: Based on the target sub-permission ranges that the user can access and the associated target sub-permission ranges of each actual associated system that the user can access, identify the current associated access permissions of the user in each actual associated system corresponding to the target system in the target system and each actual associated system corresponding to the target system.

[0113] Step S414: Based on the target association permission content between the target system and each actual associated system corresponding to the target system, and the user's current association access permission content in each actual associated system corresponding to the target system, the user's current actual association access permission content in each actual associated system corresponding to the target system is identified through the permission scope limitation strategy.

[0114] Step S415: The user's current actual associated access permissions in each actual associated system corresponding to the target system are used as the user's associated access permission information for each actual associated system.

[0115] Step S416: Based on the user's current user access permission information in the target system and the user's associated user permission information in each actual associated system, perform cross-system access permission control processing for the user.

[0116] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0117] Based on the same inventive concept, this application also provides a cross-system user permission management device for implementing the cross-system user permission management method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more cross-system user permission management device embodiments provided below can be found in the limitations of the cross-system user permission management method described above, and will not be repeated here.

[0118] In one exemplary embodiment, such as Figure 5 As shown, a cross-system user access control device is provided, comprising: an acquisition module 510, a first identification module 520, a second identification module 530, and a control module 540, wherein:

[0119] The acquisition module 510 is used to acquire system permission control information of each system, system communication architecture information between each system, and current access authentication information of the user to the target system, and based on the system permission control information of each system, to identify the permission authentication requirements of each system and the permission scope information corresponding to each permission authentication requirement of each system.

[0120] The first identification module 520 is used to identify the permission association information between the systems based on the system communication architecture information between the systems, and to identify the access requirement information corresponding to each permission range of each system based on the permission authentication requirements of each system and the permission range information corresponding to each permission authentication requirements of each system.

[0121] The second identification module 530 is used to identify the user's current user access permission information in the target system based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system, and to identify the user's user association permission information for each of the actual associated systems based on the user's current user access permission information in the target system and the permission association information between each system.

[0122] The management module 540 is used to perform cross-system access control processing on the user based on the user's current user access permission information in the target system and the user's user association permission information in each of the actual associated systems.

[0123] Optionally, the acquisition module 510 is specifically used for:

[0124] For each system, based on the system permission control information of the system, the system permission scope of the system and the permission restriction conditions of the system permission scope are identified, and the system permission scope of the system is divided into sub-permission scopes of each permission restriction condition;

[0125] Based on each of the aforementioned permission restriction conditions, identify the permission restriction information corresponding to each permission restriction condition, and query the permission restriction types contained in each permission restriction information and the permission authentication range of each permission restriction type corresponding to each permission restriction information in the permission management database of the system.

[0126] The permission authentication range of each permission restriction type corresponding to each permission restriction information is taken as each permission authentication requirement, and the sub-permission range of each permission restriction condition is taken as the permission range information corresponding to each permission authentication requirement.

[0127] Optionally, the first identification module 520 is specifically used for:

[0128] Based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with association relationship and the associated permission content between the associated systems are identified.

[0129] Based on the associated permission content between the associated systems, a system permission association graph is constructed between the associated systems, and based on the system permission association graph between the associated systems, the actual associated systems corresponding to each system are identified;

[0130] Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

[0131] Optionally, the first identification module 520 is specifically used for:

[0132] For each system, based on the permission authentication range of each permission restriction type corresponding to each sub-permission range of the system, query the user identity type corresponding to each permission restriction type in the permission restriction database, and based on the permission authentication range of each permission restriction type, query the user identity range of the user identity type corresponding to the permission authentication range of each permission restriction type in the permission restriction database;

[0133] The user identity range of each of the aforementioned user identity types is used as the access requirement information for the sub-permission range.

[0134] Optionally, the second identification module 530 is specifically used for:

[0135] Based on the current access authentication information, the user's user identity information is identified, and based on the user identity information, the current user access permission information for each user identity type and the access permission range requested by the user are queried in the target system database.

[0136] Based on the current user access permission information of each user identity type of the user, in the user identity range of each user identity type corresponding to each sub-permission range of the target system, adapt each target sub-permission range that the user can access, and filter the current user access permission information of the user in the target system based on the access permission range requested by the user and each target sub-permission range that the user can access.

[0137] Optionally, the second identification module 530 is specifically used for:

[0138] Based on the user's user identity information and the access requirement information corresponding to each permission range of each actual associated system of the target system, identify the associated target sub-permission range of each actual associated system that the user can access.

[0139] Based on the target sub-permission ranges that the user can access and the associated target sub-permission ranges of each actual associated system that the user can access, the current associated access permissions of the user in each actual associated system corresponding to the target system are identified in the target system and each actual associated system corresponding to the target system.

[0140] Based on the target association permission content between the target system and each actual associated system corresponding to the target system, and the current association permission content of the user in each actual associated system corresponding to the target system, the current actual association permission content of the user in each actual associated system corresponding to the target system is identified through the permission scope limitation strategy.

[0141] The current actual associated access permissions of the user in each actual associated system corresponding to the target system shall be used as the user's user associated access permissions information for each actual associated system.

[0142] Each module in the aforementioned cross-system user access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0143] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a cross-system user access control method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0144] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0145] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement steps of a cross-system user rights management method.

[0146] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program implementing steps of a cross-system user access control method when executed by a processor.

[0147] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements steps of a cross-system user rights management method.

[0148] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0149] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0150] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0151] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A cross-system user access control method, characterized in that, The method includes: Obtain system permission control information of each system, system communication architecture information between the systems, and the current access authentication information of the user to the target system; For each system, based on the system permission control information of the system, the system permission scope of the system and the permission restriction conditions of the system permission scope are identified, and the system permission scope of the system is divided into sub-permission scopes of each permission restriction condition; Based on each of the aforementioned permission restriction conditions, identify the permission restriction information corresponding to each permission restriction condition, and query the permission restriction types contained in each permission restriction information and the permission authentication range of each permission restriction type corresponding to each permission restriction information in the permission management database of the system. The permission authentication range of each permission restriction type corresponding to each permission restriction information is taken as each permission authentication requirement, and the sub-permission range of each permission restriction condition is taken as the permission range information corresponding to each permission authentication requirement. Based on the system communication architecture information between the systems, the permission association information between the systems is identified, and based on the permission authentication requirements of each system and the permission scope information corresponding to the permission authentication requirements of each system, the access requirement information corresponding to each permission scope of each system is identified. Based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system, the user's current user access permission information in the target system is identified. Based on the user's current user access permission information in the target system and the permission association information between the systems, the user's user association permission information for each actual associated system is identified. Based on the user's current user access permission information in the target system and the user's user association permission information in each of the actual associated systems, cross-system access permission management is performed on the user.

2. The method according to claim 1, characterized in that, The method of identifying permission association information between the systems based on the system connectivity architecture information includes: Based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with association relationship and the associated permission content between the associated systems are identified. Based on the associated permission content between the associated systems, a system permission association graph is constructed between the associated systems, and based on the system permission association graph between the associated systems, the actual associated systems corresponding to each system are identified; Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

3. The method according to claim 1, characterized in that, The method of identifying access requirement information corresponding to each permission scope of each system based on the authentication requirements of each system and the permission scope information corresponding to each authentication requirements of each system includes: For each system, based on the permission authentication range of each permission restriction type corresponding to each sub-permission range of the system, query the user identity type corresponding to each permission restriction type in the permission restriction database, and based on the permission authentication range of each permission restriction type, query the user identity range of the user identity type corresponding to the permission authentication range of each permission restriction type in the permission restriction database; The user identity range of each of the aforementioned user identity types is used as the access requirement information for the sub-permission range.

4. The method according to claim 3, characterized in that, The step of identifying the user's current user access permission information in the target system based on the current access authentication information and the access request information corresponding to each permission scope of the target system includes: Based on the current access authentication information, the user's user identity information is identified, and based on the user identity information, the current user access permission information for each user identity type and the access permission range requested by the user are queried in the target system database. Based on the current user access permission information of each user identity type of the user, in the user identity range of each user identity type corresponding to each sub-permission range of the target system, adapt each target sub-permission range that the user can access, and filter the current user access permission information of the user in the target system based on the access permission range requested by the user and each target sub-permission range that the user can access.

5. The method according to claim 2, characterized in that, The step of identifying the user's associated user permission information for each of the actual associated systems based on the user's current user access permission information in the target system and the permission association information between the systems includes: Based on the user's user identity information and the access requirement information corresponding to each permission range of each actual associated system of the target system, identify the associated target sub-permission range of each actual associated system that the user can access. Based on the target sub-permission ranges that the user can access and the associated target sub-permission ranges of each actual associated system that the user can access, the current associated access permissions of the user in each actual associated system corresponding to the target system are identified in the target system and each actual associated system corresponding to the target system. Based on the target association permission content between the target system and each actual associated system corresponding to the target system, and the current association permission content of the user in each actual associated system corresponding to the target system, the current actual association permission content of the user in each actual associated system corresponding to the target system is identified through the permission scope limitation strategy. The current actual associated access permissions of the user in each actual associated system corresponding to the target system shall be used as the user's user associated access permissions information for each actual associated system.

6. A cross-system user access control device, characterized in that, The device includes: The acquisition module is used to acquire system permission control information of each system, system communication architecture information between the systems, and the user's current access authentication information to the target system; for each system, based on the system permission control information, it identifies the system permission scope and the permission restriction conditions of the system permission scope, and divides the system permission scope into sub-permission scopes of each permission restriction condition; based on each permission restriction condition, it identifies the permission restriction information corresponding to each permission restriction condition, and queries the permission control database of the system to find the permission restriction types contained in each permission restriction information and the permission authentication scope of each permission restriction type corresponding to each permission restriction information; it uses the permission authentication scope of each permission restriction type corresponding to each permission restriction information as each permission authentication requirement, and uses the sub-permission scopes of each permission restriction condition as the permission scope information corresponding to each permission authentication requirement; The first identification module is used to identify the permission association information between the systems based on the system communication architecture information between the systems, and to identify the access requirement information corresponding to each permission scope of each system based on the permission authentication requirements of each system and the permission scope information corresponding to each permission authentication requirements of each system. The second identification module is used to identify the user's current user access permission information in the target system based on the current access authentication information and the access requirement information corresponding to each permission scope of the target system, and to identify the user's user association permission information for each actual associated system based on the user's current user access permission information in the target system and the permission association information between each system. The management module is used to perform cross-system access control processing on the user based on the user's current user access permission information in the target system and the user's user association permission information in each of the actual associated systems.

7. The apparatus according to claim 6, characterized in that, The first identification module is specifically used for: Based on the system communication architecture information between the systems, the system permission association relationship between the systems is identified, and based on the system permission association relationship of each system, the associated systems with association relationship and the associated permission content between the associated systems are identified. Based on the associated permission content between the associated systems, a system permission association graph is constructed between the associated systems, and based on the system permission association graph between the associated systems, the actual associated systems corresponding to each system are identified; Based on the associated permission content between each of the associated systems, the target associated permission content between each system and each actual associated system corresponding to each system is identified, and the target associated permission content between each system and each actual associated system corresponding to each system is used as the permission association information between each of the systems.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images