Access control method and device, electronic equipment and storage medium

Abstract

The invention provides an access control method and device, electronic equipment and a storage medium, and the method comprises the steps: receiving an access request for a target resource, and enabling the access request to comprise a user identifier for requesting the target resource; at least one piece of role information associated with the user identifier, event information, a first permission set corresponding to each piece of role information and a second permission set corresponding to the event information are obtained, and each first permission in the first permission set corresponds to at least one resource; under the condition that the first permission set and / or the second permission set contains the target permission corresponding to the target resource, obtaining time strategy information corresponding to the target permission; according to the time strategy information and the current moment, determining whether the target permission is valid currently; and under the condition that the target permission is valid currently, allowing the user to access the target resource. According to the invention, more refined and more flexible automatic authority control can be realized, the efficiency and security of access control are improved, and the user experience is improved.

Description

Technical Field

[0001] The present application relates to the field of information security and data management, and in particular to an access control method, device, electronic device and storage medium. Background Art

[0002] With the development of information technology and the surge in the amount of enterprise data, data security and access control have become increasingly important. In addition, with the popularity of remote work and cross-regional collaboration, working hours and responsibilities within organizations have become more diverse, requiring a permission management system that can handle permission allocation issues in a more detailed and automated manner.

[0003] Traditional access control methods are usually implemented using a role-based access control (RBAC) model or an attribute-based access control (ABAC) model. The dimension of permission allocation is relatively single, which is not flexible enough when dealing with complex permission management needs. It cannot be applied to some cross-institutional and cross-regional scenarios, requires administrators to modify it manually, and has poor management accuracy for permission timeliness. Summary of the invention

[0004] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the first purpose of the present application is to propose an access control method, device, electronic device and storage medium to achieve automatic dynamic control of user access to resources under multiple granularity time strategies and permission allocation dimensions.

[0006] The second objective of the present application is to provide an access control device.

[0007] The third objective of the present application is to provide an electronic device.

[0008] A fourth objective of the present application is to provide a computer-readable storage medium.

[0009] A fifth object of the present application is to provide a computer program product.

[0010] To achieve the above-mentioned purpose, the first embodiment of the present application proposes an access control method, including:

[0011] Receiving an access request for a target resource, wherein the access request includes a user identifier requesting the target resource;

[0012] Acquire at least one role information and event information associated with the user identifier, a first permission set corresponding to each role information, and a second permission set corresponding to the event information, wherein each first permission in the first permission set corresponds to at least one resource;

[0013] In a case where the first permission set and / or the second permission set includes a target permission corresponding to the target resource, acquiring time policy information corresponding to the target permission;

[0014] Determine whether the target permission is currently valid according to the time policy information and the current time;

[0015] In the case that the target permission is currently valid, the user is allowed to access the target resource.

[0016] To achieve the above-mentioned purpose, a second embodiment of the present application proposes an access control device, including:

[0017] A receiving module, configured to receive an access request for a target resource, wherein the access request includes a user identifier requesting the target resource;

[0018] A first acquisition module is used to acquire at least one role information associated with the user identifier, event information, a first permission set corresponding to each role information, and a second permission set corresponding to the event information, wherein each first permission in the first permission set corresponds to at least one resource;

[0019] A second acquisition module, configured to acquire time policy information corresponding to the target permission when the first permission set and / or the second permission set includes a target permission corresponding to the target resource;

[0020] A judgment module, used to determine whether the target permission is currently valid according to the time policy information and the current time;

[0021] The control module is used to allow the user to access the target resource if the target permission is currently valid.

[0022] To achieve the above-mentioned purpose, the third aspect embodiment of the present application proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the access control method as described in the first aspect embodiment.

[0023] To achieve the above-mentioned purpose, the fourth aspect embodiment of the present application proposes a computer-readable storage medium, in which computer-readable storage medium is stored computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the access control method as described in the first aspect embodiment.

[0024] To achieve the above-mentioned purpose, the fifth aspect of the present application proposes a computer program product, including a computer program, which, when executed by a processor, implements the access control method as described in the first aspect of the embodiment.

[0025] The access control method, device, electronic device and storage medium provided in the present application determine whether a user currently has permission to access target resources based on the permissions corresponding to the user-associated role and the event, and the time strategy corresponding to the permissions, thereby implementing access control. This can achieve more refined and flexible automated permission control, improve the efficiency and security of access control, and enhance the user experience.

[0026] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0028] Figure 1 A flowchart of an access control method provided by an embodiment of the present application;

[0029] Figure 2 A schematic diagram of a permission allocation logic proposed in an embodiment of the present application;

[0030] Figure 3 A schematic diagram of a process for determining a permission set corresponding to role information provided in an embodiment of the present application;

[0031] Figure 4 It is a logical diagram of the composition of a permission set provided in an embodiment of the present application;

[0032] Figure 5 A flowchart of another access control method provided by an embodiment of the present application;

[0033] Figure 6 A flowchart of another access control method provided by an embodiment of the present application;

[0034] Figure 7 A schematic diagram of the structure of an access control device provided in an embodiment of the present application; and

[0035] Figure 8 It is a schematic diagram of the structure of an electronic device shown in an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0036] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0037] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0038] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0039] The access control method and device according to the embodiments of the present application are described below with reference to the accompanying drawings.

[0040] Figure 1 A flowchart of an access control method provided in an embodiment of the present application.

[0041] Step 101: Receive an access request for a target resource.

[0042] The access request includes a user identifier that requests the target resource.

[0043] It should be noted that the user ID is information that can uniquely identify the user. In the embodiment of the present application, it can be in any form, such as a combination of numbers, letters, and symbols. Through the user ID included in the access request, it is possible to quickly locate which permissions the user requesting the resource has, thereby implementing access control. The target resource can be any file, page, program, database data, service, etc.

[0044] Step 102: Obtain at least one role information and event information associated with the user identifier, a first permission set corresponding to each role information, and a second permission set corresponding to the event information.

[0045] Among them, role information is information describing a role (such as administrator, ordinary employee, visitor, etc.) from multiple dimensions such as working environment conditions (such as the name of the organization to which it belongs, geographical location and equipment type, etc.) and business content (such as module-level, page-level, process-level, user behavior-level or function-level operation objects) in scenarios such as enterprise management. In the embodiment of the present application, multiple roles can be set according to the needs of the actual business, and each role can construct its corresponding role information according to its prescribed working environment conditions and business content. Then, the user identification of the user can be associated with at least one role information according to the work needs of the user, and each role information can represent an identity of the user.

[0046] For example, user a can simultaneously serve as an administrator of organization A and a regular employee of organization B.

[0047] The first permission set is a set of all first permissions included in the corresponding role, and each first permission corresponds to at least one resource, which means that operations can be performed or accessed on the at least one resource. For example, the first permission may be the modification permission of resource A and resource B, or the copy permission of resource C, etc.

[0048] In the embodiment of the present application, the first permission set corresponding to the role information specifies the operations that the user can perform and the scope of resources that can be accessed in the system. Since the executable operations and accessible resource scopes corresponding to different roles are determined, the permission set corresponding to each role information can be constructed in advance, and then when performing access control, the first permission set can be directly obtained based on the role information associated with the user identifier.

[0049] Combine the following Figure 2 Describe the relationship between user IDs, roles, and permission sets. Figure 2 It is a schematic diagram of the logic of permission allocation.

[0050] Depend on Figure 2 It can be seen that different user IDs can be bound to the same role information, that is, a role can be bound to multiple user IDs such as user 1, user 2, ..., user N, so that at least one role information associated with each user ID can be determined. In addition, a permission set can be assigned to each role, and each role can be bound to a set containing multiple policies (such as Figure 2 A time policy set (i.e., the time policy information described below in this embodiment) of policy 1, policy 2, ... policy N) is used to control the activation and deactivation of the role at different times.

[0051] It should be noted that the validity period of the first permission corresponding to the role information is fixed, but due to the uncertainty of the working hours and content of the user as any role, such as overtime, work content adjustment, etc., the permissions included in the role need to be adjusted. Therefore, in this application, the event information related to the permission needs to be considered during access control, and the user is allowed to access resources at unconventional times or locations according to the permissions corresponding to the event information.

[0052] The event information is an event used to adjust the available permissions of the user, such as an overtime event initiated by the user, or a temporary task (such as a business trip) assigned to the user.

[0053] It should be noted that the event information may include the type of event, specific content, time period when the event occurred, etc., and this application does not limit this.

[0054] In the embodiment of the present application, the second permission sets corresponding to different event information are different. For example, when the event information is the overtime information of the user, each second permission in the second permission set corresponding to the event information should be the same as the permission that the user can call during normal working hours, and the effective time corresponding to the second permission set should be within the overtime time period applied by the user.

[0055] Optionally, the process of obtaining event information may include at least one of the following: obtaining event information associated with the user identifier in the current period from the management system of the organization associated with the role information; obtaining monitoring event information associated with the user identifier in the current period from the monitoring system of the organization associated with the role information.

[0056] For example, for enterprise employees, employees can submit overtime applications within a certain time period in the enterprise's management system. After receiving the employee's resource access request, event information associated with the employee ID in the current period can be obtained from the enterprise's management system (that is, whether the employee has submitted an overtime application or has not submitted an overtime application).

[0057] Alternatively, for on-duty monitoring personnel (such as a bank monitoring center, etc.), the monitoring system can monitor the on-duty status of each employee in real time. Therefore, after receiving the employee's resource access request, the monitoring system can obtain event information monitored for the employee ID during the current period (that is, the employee is on duty or the employee's shift is over). In this way, it is possible to grant highly sensitive permissions to employees during their shift and revoke the permissions after the shift is over.

[0058] In an embodiment of the present application, at least one role information and event information associated with the user identifier can be queried in the access control system based on the user identifier included in the access request, and then the first permission set corresponding to each role information and the second permission information corresponding to the event information are obtained.

[0059] Step 103: When the first permission set and / or the second permission set includes the target permission corresponding to the target resource, obtain time policy information corresponding to the target permission.

[0060] Among them, the time policy information is the rule information used to guide the access control system to calculate whether any time is a valid time, which can control the activation and deactivation of permissions.

[0061] In an embodiment of the present application, after obtaining the first permission set and the second permission set, the resources corresponding to each permission in the first permission set and the second permission set are matched with the target resources respectively, and the first permission and / or second permission that successfully matches are determined as the target permission.

[0062] It should be noted that, when a first permission and a second permission are respectively determined to correspond to the target resource in the first permission set and the second permission set, the time policy information corresponding to the first permission can be combined with the time period of the event information corresponding to the second permission to determine the time policy information corresponding to the target permission.

[0063] For example, the time policy information corresponding to the first permission is enabled from Monday to Friday, and the event information corresponding to the second permission is overtime on Saturday. The second permission is allowed to be enabled. Then, when the resources corresponding to the first permission and the second permission are both target resources, the first permission and the second permission are target permissions, and the corresponding time policy information is enabled from Monday to Saturday.

[0064] It should be noted that in this application, not only can the time limit management be performed on a single permission, but also the time limit management can be performed uniformly on all first permissions corresponding to a certain role information. Therefore, when obtaining the time policy information corresponding to the target permission, the time policy information bound to the target permission can be obtained, or the time policy information bound to the role information to which the target permission belongs (such as Figure 2 shown).

[0065] Step 104: Determine whether the target permission is currently valid based on the time policy information and the current time.

[0066] In an embodiment of the present application, access control lists (ACL) or similar mechanisms can be used according to the current time and time policy information, in conjunction with real-time computing services, to calculate the user's permissions and determine whether the user currently has the permission to perform a certain operation, that is, to determine whether the target permission is currently valid.

[0067] Step 105: If the target permission is currently valid, the user is allowed to access the target resource.

[0068] In the embodiment of the present application, the target permission is currently valid, that is, it can be determined that the user can currently call the permission and perform operations such as accessing the resources corresponding to the permission, then the access control system can allow the user to access the target resources.

[0069] It should be noted that when the target permission is currently invalid, a prompt message that the target resource is currently inaccessible can be sent to the user identified by the user, which helps diagnose access problems, facilitates maintenance and management, and improves user experience.

[0070] Optionally, in this application, the current time, the first permission set, the second permission set, and the access request result of the target resource can also be associated with the user ID and stored in the system log. Thus, the allocation of each permission and the result of the access attempt can be recorded through the log, providing a solid data foundation for tracking the permission change history, meeting compliance requirements, and conducting subsequent permission audits.

[0071] In this embodiment, first, an access request for a target resource is received, and at least one role information associated with a user identifier, event information, a first permission set corresponding to each role information, and a second permission set corresponding to the event information are obtained. Then, in the case where the first permission set and / or the second permission set contain a target permission corresponding to the target resource, the time policy information corresponding to the target permission is obtained, and then, based on the time policy information and the current time, it is determined whether the target permission is currently valid. Afterwards, if the target permission is currently valid, the user is allowed to access the target resource. Thus, by determining whether the user currently has the permission to access the target resource based on the permissions corresponding to the user-associated role and the event, and the time policy corresponding to the permission, and then implementing access control, a more refined and flexible automated permission control can be implemented, the efficiency and security of access control are improved, and the user experience is enhanced.

[0072] It should be noted that the permission set corresponding to each role information can be allocated in advance. In this application, how to determine the permission set corresponding to each role information and the composition logic of the permissions in each permission set can be combined with the following Figure 3 Provide explanation.

[0073] Figure 3 A schematic diagram of a process for determining a permission set corresponding to role information provided in an embodiment of the present application.

[0074] Step 301, obtaining role information of the permissions to be assigned.

[0075] The role information may include first attribute information and an operation object. The first attribute information is used to describe the working environment conditions corresponding to the role, and the operation object summarizes all the business content and scope of responsibility of the role.

[0076] In the embodiment of the present application, a variety of role information can be customized according to actual business needs, and then the permissions of each role information can be assigned respectively.

[0077] Optionally, the first attribute information may include at least one of the following: organization name, geographic location, and device type. Thus, the role information can be described from multiple dimensions, thereby allocating permissions based on the role information with higher accuracy.

[0078] It should be noted that in the present application, in order to meet the permission management scenarios across organizations, geographic locations, etc., the first attribute information of multiple organization names, geographic locations or device types may be included in one role information. For example, the organization name in the first attribute information may include organization A and organization B, and the geographic location may include geographic location a, geographic location b and geographic location d, etc. This allows the user bound to the role information to call the permission corresponding to the role information regardless of which organization he belongs to, where he is located, or what type of device he uses, as long as he meets the scope of the first attribute information. This is suitable for the needs of inter-institutional collaboration and cross-regional collaborative business.

[0079] Optionally, the operation object may include at least one of the following: module, page, process and control. Therefore, the work content of the role can be described more specifically from multiple levels of operation objects, and the permissions assigned based on the role information can be more accurate. Among them, each operation object is a unit that the role can modify, execute and other operations, and the role information can include one or more pages, one or more processes and / or one or more modules, etc.

[0080] For example, for different community grid workers, each community administrator role can be granted management authority over multiple communities and geographic locations (grids) in the form of a combination of data permissions.

[0081] Step 302: Generate at least one first candidate permission according to the accessible data resources corresponding to the first attribute information in the current business scenario.

[0082] The first candidate permission is a permission used to control access to data that a user can view. Each first candidate permission may correspond to at least one accessible data resource.

[0083] It is understandable that the content and scope of accessible data resources corresponding to different first attribute information are different due to the business scope of different institutions, the security of geographical locations, or the credibility of device types, etc. Therefore, at least one first candidate permission corresponding to the accessible data resource can be constructed based on the accessible data resource corresponding to the first attribute information in the current business scenario.

[0084] Step 303: Obtain at least one second candidate permission corresponding to the operation object.

[0085] Among them, the second candidate permission is used to control the permission to view, modify and perform other operations on modules, pages, processes and controls.

[0086] It is understandable that the permission operations that can be performed on each operation object, ie, page, process, or module, are fixed according to business needs, so at least one second candidate permission corresponding to each operation object can be directly obtained.

[0087] Step 304: Based on the relationship between the accessible data resources corresponding to the first candidate permission and the operation objects corresponding to the second candidate permission, the first candidate permission and the second candidate permission are merged to obtain a first permission set corresponding to the role information.

[0088] In the embodiment of the present application, since when an operation is performed on any operation object, the content of the operation is the data contained in the object, the user needs to have both specific data permissions and operation permissions to complete a task. Therefore, after obtaining the first candidate permission and the second candidate permission, the first candidate permission and the second candidate permission corresponding to each operation object can be merged according to the accessible data resources contained in each operation object, and at least one first permission can be constructed to obtain the first permission set corresponding to the role information.

[0089] For example, if the operation object page A includes accessible data resource a, the first candidate permission for accessible data resource a and the second candidate permission for page A can be spliced ​​or merged to obtain the first permission corresponding to the accessible data resource a in page A.

[0090] Combine the following Figure 4 Describe the composition logic of the permission set corresponding to a role information. Figure 4 It is a logical diagram of the composition of a permission set provided in an embodiment of the present application.

[0091] like Figure 4As shown, the first attribute information in the role information includes an organization group (organization 1, organization 2, ..., organization N), an asset / equipment type group (asset 1, asset 2, ..., asset N) and a region (i.e., geographic location) group (region 1, region 2, ..., region N), and an operation object includes a module / page / control group (page 1, page 2, ..., page N), a process group (process 1, process 2, ..., process N) and a user behavior control (scenario) group (behavior 1, behavior 2, ..., behavior N). The above N is a natural number, which can be 0, and the N value in each group can be different.

[0092] The information in the first attribute information can be combined to determine the scope of accessible data resources and obtain a data permission set (including at least one first candidate permission). And according to the executable operations corresponding to all operation objects, an operation permission set (including at least one second candidate permission) can be constructed. After that, the first candidate permission in the data permission set and the second candidate permission in the operation permission set can be merged to obtain the permission set corresponding to the role information.

[0093] In this embodiment, the role information of the permission to be assigned is first obtained, and the role information includes first attribute information and operation objects. Then, based on the accessible data resources corresponding to the first attribute information in the current business scenario, at least one first candidate permission is generated, and at least one second candidate permission corresponding to the operation object is obtained. After that, based on the relationship between the accessible data resources corresponding to the first candidate permission and the operation object corresponding to the second candidate permission, the first candidate permission and the second candidate permission are merged to obtain the first permission set corresponding to the role information. Thus, the permission combination corresponding to each role is configured through the multi-dimensional information corresponding to the role, and a more refined permission allocation rule is determined, which provides a basis for improving the accuracy and security of access control and can better adapt to changes in organizational structure and business processes in different business scenarios.

[0094] It should be noted that in this application, various time policy information can be set to determine whether the current time is a valid time for a certain permission, and then change the enabled or disabled status of the permission to achieve automated access control.

[0095] Combine the following Figure 5 To explain, Figure 5 A flowchart of an access control method provided in an embodiment of the present application.

[0096] Step 501: Receive an access request for a target resource.

[0097] Step 502: Obtain at least one role information and event information associated with the user identifier, a first permission set corresponding to each role information, and a second permission set corresponding to the event information.

[0098] For detailed description of the above steps 501 and 502, please refer to other embodiments of the present application and will not be repeated here.

[0099] Step 503: When the first permission set and / or the second permission information includes the target permission corresponding to the target resource, obtain time policy information corresponding to the target permission.

[0100] In the embodiment of the present application, the administrator can set the allowed calling time or the not allowed calling time of a certain permission or a certain role information in advance according to the work needs, so as to obtain the time policy information, so that the determined time policy information can be bound with the permission or role information and stored in the system. Therefore, after determining the target permission, the time policy information corresponding to the target permission in the first permission set can be directly obtained in the access control system.

[0101] It should be noted that the access control system of the present application can provide an interface for editing the time policy corresponding to each permission, so that the administrator can define and adjust the time policy more easily and intuitively.

[0102] Optionally, a time editing instruction for any first permission or any role information in the editing interface may be received.

[0103] The time editing instruction includes at least one effective time and cycle under a time granularity. The time granularity is the minimum time interval that describes the system operation cycle or the change of the permission status, which can be hours, days, years, etc., and the effective time can be a working day, a specific event (such as holidays), and a certain time period, etc. The cycle can include the number of cycles and the interval time. The number of cycles can be 0, that is, a one-time permission.

[0104] In the embodiment of the present application, the administrator is allowed to set the time policy according to the work calendar and specific events (such as holidays). After selecting a first permission or a role information in the editing page, the administrator can send the time editing instruction by dragging and dropping the calendar or inputting the time period. Then the back-end service of the access control system can receive the time editing instruction for any first permission or any role information, and generate the time policy executable by the access control system according to the instruction.

[0105] For example, the received time editing instruction may include 9:00 to 18:00 on workdays as the effective time, or statutory holidays in the next three years as the effective time, etc.

[0106] Then, time policy information associated with any first permission or any role information may be generated according to the effective time and period under at least one time granularity.

[0107] In the embodiment of the present application, the effective time and period under at least one time granularity may be combined to obtain the time policy information associated with any first permission or any role information.

[0108] It should be noted that in the present application, the priority corresponding to each group of valid time and period can be determined according to the size of each time granularity or the importance in enabling control authority, and then the time policy information can be obtained by combining them based on the priority.

[0109] For example, for monitoring personnel on duty (such as a bank monitoring center), the time policy corresponding to the high-sensitivity authority is the duty time. In this case, the high-sensitivity authority can be granted to the personnel during the duty period, and the authority can be revoked after the duty period ends.

[0110] Step 504: Determine whether the current time is a valid time according to the time policy information.

[0111] In an embodiment of the present application, it is possible to calculate whether the current moment is a valid time for the target permission, that is, the activation time of the target permission, based on the time policy information. This means that the user's permissions may change over time, thereby ensuring that a certain security level can be maintained in different situations.

[0112] It should be noted that the time policy information may include time policies set at multiple time granularities. These time policies may determine different permission activation and deactivation states at a certain moment. It is necessary to further determine whether to combine multiple time policies to determine whether the current moment is a valid time, or to select one time policy to determine it.

[0113] Optionally, when the time policy information includes multiple time granularities, it is determined whether the current moment is a valid time in each time granularity.

[0114] Then, when the current moment is a valid time in at least one time granularity and is not a valid time in the remaining time granularities, the priority corresponding to each time granularity can be obtained.

[0115] In the embodiment of the present application, the priority corresponding to each time granularity can be determined according to the order in which users need to perform work at different time granularities in actual business, or the importance of affecting the activation and deactivation status of permissions, etc. For example, for a certain Monday, when the Monday is a holiday, employees cannot call up work permissions, so it can be explained that the priority of holidays should be higher than the priority from 9:00 to 18:00 from Monday to Friday.

[0116] Afterwards, it can be determined whether the current time is a valid time based on the time granularity with the highest priority.

[0117] For example, the time policy information corresponding to target permission A includes policy 1 and policy 2. Policy 1 is valid from 9:00 to 18:00 every Monday to Friday, and policy 2 is valid on non-holidays. When the current time is 10:00 on a holiday (Tuesday), policy 1 can determine that the current time is valid, but policy 2 can determine that the current time is not valid. Since the priority of policy 2 is higher than that of policy 1, it can be determined that the current time is not valid.

[0118] Step 505: When the current time is a valid time, determine that the target permission is currently valid, and allow the user to access the target resource.

[0119] It should be noted that, when the current time is not a valid time, it is also possible to determine whether an application for extending the valid time submitted by the user with the user ID is received in the access control system. After receiving the application, it is possible to further determine whether the current time is a valid time based on the time period requested for extension in the application. For example, for employees working overtime in an enterprise, the system can automatically adjust the valid time of the permission based on the overtime application, so as to extend the time when the employee can call the target permission.

[0120] In this embodiment, by determining whether the current time is a valid time based on the time policy information, if the current time is a valid time, it is determined that the target permission is currently valid, allowing the user to access the target resource, so that the access control system can query the time policy information and automatically control the activation and deactivation of a certain permission, thereby improving the security of permission calls.

[0121] It should be noted that each role information can correspond to multiple attribute information. When a user applies for permission, the current access environment may not be within the applicable scope of the role information, so if access is allowed at this time, it may cause the risk of data leakage. Therefore, the attribute information contained in the access request can be combined to control the activation and deactivation of each role bound to the user, and then dynamically allocate permissions. Figure 6 Provide explanation.

[0122] Figure 6 A flowchart of an access control method provided in an embodiment of the present application.

[0123] Step 601: Receive an access request for a target resource, wherein the access request includes second attribute information.

[0124] The second attribute information refers to information such as the user's current geographical location and the type of device used when sending an access request.

[0125] Step 602: Obtain at least one role information and event information associated with the user identifier, a first permission set corresponding to each role information, and a second permission set corresponding to the event information.

[0126] For detailed description of the above steps 601 and 602, please refer to other embodiments of the present application and will not be repeated here.

[0127] Step 603: Match the second attribute information in the access request with the first attribute information of each role information respectively, and determine the available role information corresponding to the second attribute information.

[0128] In an embodiment of the present application, the second attribute information can be matched with the first attribute information in at least one role information bound to the user identifier, and the role information whose second attribute information is not within the scope defined by the first attribute information can be deleted to obtain available role information matching the second attribute information.

[0129] For example, although a user's identity is bound to role A, the device types applicable to role A include device a, device b, and device c. Since the device type from which the user sends the request is device d, which may have a higher data risk and lower security, the user is currently unable to invoke the permissions corresponding to the role even though he is bound to role A.

[0130] Step 604: Determine whether the first permission set and / or the second permission set corresponding to the available role information includes the target permission corresponding to the target resource.

[0131] Step 605: When the first permission set and / or the second permission set includes the target permission corresponding to the target resource, obtain time policy information corresponding to the target permission.

[0132] Step 606: Determine whether the target permission is currently valid based on the time policy information and the current time.

[0133] Step 607: If the target permission is currently valid, allow the user to access the target resource.

[0134] For detailed descriptions of the above steps 604 to 607, please refer to other embodiments of the present application and will not be repeated here.

[0135] In this embodiment, by matching the second attribute information in the access request with the first attribute information of each role information, the available role information corresponding to the second attribute information is determined, and then based on the first permission set corresponding to the available role information, it is determined whether the first permission set contains the target permission corresponding to the target resource. This can avoid the problem of illegally calling role information permissions due to requests outside the prescribed scope, further improve the accuracy and reliability of access control, and ensure resource security.

[0136] It can be seen from the above embodiments that the system for implementing the access control method proposed in this application can be divided into four functional modules, namely, a data input module, a rule processing module, a permission decision module and an audit output module.

[0137] The data input module is responsible for collecting the time policies set by the administrator and the multi-dimensional role information used to allocate permission sets, as well as the resource access requests initiated by users. The rule processing module analyzes and processes the input data, converting the time policies and multi-dimensional role information into a unified internal format of the system. The permission decision module decides whether to grant the user the corresponding permission based on the results of the rule processing module when the user requests a resource. And the audit output module records all permission-related activities (such as calls, modifications, etc.) and provides an audit window.

[0138] In order to implement the above embodiment, the present application also proposes an access control device.

[0139] Figure 7 A schematic diagram of the structure of an access control device provided in an embodiment of the present application.

[0140] like Figure 7 As shown, the access control device 700 includes:

[0141] The receiving module 701 is used to receive an access request for a target resource, wherein the access request includes a user identifier for requesting the target resource;

[0142] A first acquisition module 702 is used to acquire at least one role information associated with the user identifier, event information, a first permission set corresponding to each role information, and a second permission set corresponding to the event information, wherein each first permission in the first permission set corresponds to at least one resource;

[0143] The second acquisition module 703 is used to acquire time policy information corresponding to the target permission when the first permission set and / or the second permission set includes the target permission corresponding to the target resource;

[0144] The judgment module 704 is used to determine whether the target permission is currently valid according to the time policy information and the current time;

[0145] The control module 705 is used to allow the user to access the target resource when the target permission is currently valid.

[0146] Furthermore, the first acquisition module 702 may also be used to:

[0147] Obtaining role information of the to-be-assigned permissions, wherein the role information includes first attribute information and an operation object;

[0148] Generate at least one first candidate permission according to the accessible data resources corresponding to the first attribute information in the current business scenario;

[0149] Obtain at least one second candidate permission corresponding to the operation object;

[0150] Based on the relationship between the accessible data resources corresponding to the first candidate permission and the operation objects corresponding to the second candidate permission, the first candidate permission and the second candidate permission are merged to obtain a first permission set corresponding to the role information.

[0151] Furthermore, the first attribute information includes at least one of the following: organization name, geographic location, and device type.

[0152] Furthermore, the operation object includes at least one of the following: a module, a page, a process, and a control.

[0153] Furthermore, the second acquisition module 703 may also be used for:

[0154] Receiving a time editing instruction for any first permission or any role information in the editing interface, wherein the time editing instruction includes a valid time and period under at least one time granularity;

[0155] Time policy information associated with any first permission or any role information is generated according to the effective time and period under at least one time granularity.

[0156] Furthermore, the determination module 704 may be specifically used for:

[0157] According to the time policy information, determine whether the current time is a valid time;

[0158] When the current time is the effective time, it is determined that the target permission is currently effective.

[0159] Furthermore, the determination module 704 may be specifically used for:

[0160] When the time policy information includes multiple time granularities, determining whether the current time is a valid time in each time granularity respectively;

[0161] When the current time is a valid time in at least one time granularity and is not a valid time in the remaining time granularities, obtain the priority corresponding to each time granularity;

[0162] Based on the time granularity with the highest priority, determine whether the current time is a valid time.

[0163] Furthermore, the second acquisition module 703 may also be used for:

[0164] Matching the second attribute information in the access request with the first attribute information of each role information respectively, and determining the available role information corresponding to the second attribute information;

[0165] Determine whether the first permission set and / or the second permission set corresponding to the available role information includes a target permission corresponding to the target resource.

[0166] Furthermore, the access control device 700 further includes:

[0167] The storage module is used to associate the current time, the first permission set, the second permission set and the access request result of the target resource with the user identification and store them in the system log.

[0168] In the embodiment of the present application, the permissions corresponding to the user-bound role and the time policy corresponding to the permissions are used to determine whether the user currently has the permission to access the target resource, thereby implementing access control. This can achieve more refined automated permission control, improve the efficiency and security of access control, and enhance the user experience.

[0169] In order to implement the above embodiments, the present application also proposes an electronic device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the access control method provided by the above embodiments.

[0170] As an example, Figure 8 is a schematic diagram of the structure of an electronic device shown in an exemplary embodiment of the present disclosure, such as Figure 8 As shown, the electronic device 800 may further include:

[0171] The memory 810 and the processor 820, a bus 830 connecting different components (including the memory 810 and the processor 820), the memory 810 stores a computer program, and when the processor 820 executes the program, the business data processing method of the embodiment of the present disclosure is implemented.

[0172] Bus 830 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0173] The electronic device 800 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by the electronic device 800, including volatile and non-volatile media, removable and non-removable media.

[0174] The memory 810 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 860 and / or cache memory 850. The electronic device 800 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 860 may be used to read and write non-removable, non-volatile magnetic media ( Figure 8 not shown, usually called a "hard drive"). Although Figure 8 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 830 via one or more data medium interfaces. The memory 810 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0175] A program / utility 880 having a set (at least one) of program modules 870 may be stored, for example, in the memory 810, such program modules 870 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 870 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0176] The electronic device 800 may also communicate with one or more external devices 890 (e.g., keyboard, pointing device, display 891, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 800, and / or may communicate with any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via an input / output (I / O) interface 892. Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) via a network adapter 893. As shown, the network adapter 893 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0177] The processor 820 executes various functional applications and data processing by running the programs stored in the memory 810 .

[0178] It should be noted that the implementation process and technical principles of the electronic device of this embodiment refer to the aforementioned explanation of the content recommendation method of the embodiment of the present disclosure, and will not be repeated here.

[0179] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the access control method provided by the above embodiments.

[0180] In order to implement the above embodiments, the present application also proposes a computer program product, including a computer program, which implements the access control method provided by the above embodiments when executed by a processor.

[0181] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0182] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0183] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0184] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0185] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0186] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0187] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0188] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0189] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0190] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0191] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. An access control method, characterized in that: include: Receiving an access request for a target resource, wherein the access request includes a user identifier requesting the target resource; Acquire at least one role information and event information associated with the user identifier, a first permission set corresponding to each role information, and a second permission set corresponding to the event information, wherein each first permission in the first permission set corresponds to at least one resource; In a case where the first permission set and / or the second permission set includes a target permission corresponding to the target resource, acquiring time policy information corresponding to the target permission; Determine whether the target permission is currently valid according to the time policy information and the current time; In the case that the target permission is currently valid, the user is allowed to access the target resource.

2. The method according to claim 1, characterized in that The process of obtaining the event information includes at least one of the following: Acquiring event information associated with the user identifier in a current period from a management system of an organization associated with the role information; The monitoring event information associated with the user identification in the current time period is obtained from the monitoring system of the organization associated with the role information.

3. The method according to claim 1, characterized in that Before acquiring at least one role information associated with the user identifier, the method further includes: Acquire role information of the to-be-assigned authority, wherein the role information includes first attribute information and an operation object; Generate at least one first candidate permission according to the accessible data resources corresponding to the first attribute information in the current business scenario; Obtain at least one second candidate permission corresponding to the operation object; Based on the relationship between the accessible data resources corresponding to the first candidate permission and the operation objects corresponding to the second candidate permission, the first candidate permission and the second candidate permission are merged to obtain a first permission set corresponding to the role information.

4. The method according to claim 3, characterized in that The first attribute information includes at least one of the following: organization name, geographic location, and device type.

5. The method according to claim 3, characterized in that The operation object includes at least one of the following: a module, a page, a process, and a control.

6. The method according to claim 1, characterized in that Before obtaining the time policy information corresponding to the target authority, it also includes Receiving a time editing instruction for any first permission or any role information in the editing interface, wherein the time editing instruction includes a valid time and period under at least one time granularity; According to the effective time and period under the at least one time granularity, time policy information associated with any first permission or any role information is generated.

7. The method according to claim 6, characterized in that The determining, based on the time policy information and the current time, whether the target permission is currently valid includes: Determine whether the current time is a valid time according to the time policy information; In a case where the current time is a valid time, it is determined that the target permission is currently valid.

8. The method according to claim 7, characterized in that The determining, according to the time policy information, whether the current time is a valid time includes: In the case where the time policy information includes multiple time granularities, determining whether the current moment is a valid time at each time granularity respectively; When the current moment is a valid time in at least one of the time granularities and is not a valid time in the remaining time granularities, obtaining a priority corresponding to each of the time granularities; Based on the time granularity with the highest priority, determine whether the current moment is a valid time.

9. The method according to claim 1, characterized in that The access request also includes second attribute information, and after obtaining at least one role information and event information associated with the user identifier, a first permission set corresponding to each role information and a second permission set corresponding to the event information, further includes: Matching the second attribute information in the access request with the first attribute information of each role information respectively, and determining the available role information corresponding to the second attribute information; Determine whether the first permission set and / or the second permission set corresponding to the available role information includes a target permission corresponding to the target resource.

10. The method according to any one of claims 1 to 9, characterized in that: Also includes: The current time, the first permission set, the second permission set, and the access request result of the target resource are associated with the user identifier and stored in a system log.

11. An access control device, characterized in that: include: A receiving module, configured to receive an access request for a target resource, wherein the access request includes a user identifier for requesting the target resource; A first acquisition module is used to acquire at least one role information associated with the user identifier, event information, a first permission set corresponding to each role information, and a second permission set corresponding to the event information, wherein each first permission in the first permission set corresponds to at least one resource; A second acquisition module, configured to acquire time policy information corresponding to the target permission when the first permission set and / or the second permission set includes a target permission corresponding to the target resource; A judgment module, used to determine whether the target permission is currently valid according to the time policy information and the current time; The control module is used to allow the user to access the target resource if the target permission is currently valid.

12. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the access control method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the access control method according to any one of claims 1 to 10 when executed by a processor.

14. A computer program product, characterized in that The invention comprises a computer program, which implements the access control method according to any one of claims 1 to 10 when executed by a processor.

Images