Project file access method and electronic device

Abstract

The embodiments of the present disclosure disclose a project file access method and an electronic device. The method comprises the following steps: in response to a request for accessing a target project file, verifying a first access permission of an access object; based on a verification result of the first access permission, sending the target project file to a target application; configuring a second access permission for the access object; obtaining permission information corresponding to the second access permission; sending the permission information to the target application, so that the target application sends a request for allowing to access the target project file according to the permission information; in response to the request for allowing to access the target project file, providing an access service of the target project file within a permission information range to the access object, effectively avoiding the risk of leakage of the target project file, thereby improving the security and stability of accessing the target project file.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a project file access method and electronic device. Background Art

[0002] In practical applications, project file access is an indispensable part of engineering applications. Related technologies primarily rely on reading project files stored in local directories. However, this method requires external tools to load external files, resulting in a lack of security during transmission. Furthermore, the process of verifying permissions on external files complicates and cumbersome file access operations, leading to low file access efficiency. Summary of the Invention

[0003] The following is an overview of the subject matter described in detail in this disclosure. This overview is not intended to limit the scope of the claims.

[0004] The embodiments of the present disclosure provide a project file access method, which effectively avoids the risk of leakage of target project files, thereby improving the security and stability of accessing the target project files.

[0005] In one aspect, an embodiment of the present disclosure provides a project file access method, comprising:

[0006] In response to a request to access a target project file, verifying a first access permission of an access object, wherein the access request operation of the access object is performed in a target application;

[0007] sending the target project file to the target application based on a verification result of the first access permission;

[0008] Configuring a second access permission for the access object, obtaining permission information corresponding to the second access permission, and sending the permission information to the target application so that the target application sends a request for allowing access to the target project file according to the permission information;

[0009] In response to the request for permission to access the target project file, an access service to the target project file within the scope of the permission information is provided to the access object.

[0010] On the other hand, an embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned project file access method when executing the computer program.

[0011] The embodiments of the present disclosure at least have the following beneficial effects: in response to a request for accessing a target project file, verifying a first access permission of an access object to ensure that the access object has the permission to access the target project file, sending the target project file to a target application based on a verification result of the first access permission, configuring a second access permission for the access object, obtaining permission information corresponding to the second access permission, sending the permission information to the target application to enable the target application to send a request for allowing access to the target project file according to the permission information, performing fine-grained permission control on the target project file based on the second access permission, ensuring that the target project file can only be accessed by an authorized access object, in response to the request for allowing access to the target project file, providing an access service of the target project file within the permission information range to the access object, effectively avoiding the risk of leakage of the target project file, thereby improving the security and stability of accessing the target project file.

[0012] Other features and advantages of the present disclosure will be described in the following description, and some will become apparent from the description, or will be learned through implementation of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0013] The accompanying drawings are used to provide a further understanding of the technical solutions of the present disclosure, and constitute a part of the specification, and are used to explain the technical solutions of the present disclosure together with the embodiments of the present disclosure, and do not constitute a limitation on the technical solutions of the present disclosure.

[0014] Figure 1 An optional implementation environment provided by the embodiments of the present disclosure is shown in a schematic diagram;

[0015] Figure 2 An optional flowchart of a project file access method provided by the embodiments of the present disclosure is shown in a schematic diagram;

[0016] Figure 3 An optional schematic diagram of authorizing an entity permission for an access role provided by the embodiments of the present disclosure is shown in a schematic diagram;

[0017] Figure 4 An optional schematic diagram of authorizing an entity permission for an access object provided by the embodiments of the present disclosure is shown in a schematic diagram;

[0018] Figure 5 An optional schematic diagram of the second access permission configuration provided by the embodiments of the present disclosure is shown in a schematic diagram;

[0019] Figure 6 Another optional schematic diagram of the second access permission configuration provided by the embodiments of the present disclosure is shown in a schematic diagram;

[0020] Figure 7 An optional overall flow of the project file access provided by the embodiments of the present disclosure is shown in a schematic diagram. DETAILED DESCRIPTION

[0021] In order to make the purposes, technical solutions and advantages of the present disclosure clearer, the present disclosure will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present disclosure and do not limit the present disclosure.

[0022] It should be noted that in various specific embodiments of the present disclosure, when it is necessary to perform relevant processing on data related to the characteristics of the target object, such as target object attribute information or attribute information set, the permission or consent of the target object will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. Among them, the target object can be a user. In addition, when the embodiments of the present disclosure need to obtain target object attribute information, the separate permission or separate consent of the target object will be obtained through a pop-up window or by jumping to a confirmation page, and after obtaining the separate permission or separate consent of the target object, the necessary target object related data for enabling the embodiments of the present disclosure to operate normally will be obtained.

[0023] In the embodiments of the present disclosure, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the functions of the module or unit.

[0024] In order to facilitate understanding of the technical solutions provided by the embodiments of the present disclosure, some key terms used by the embodiments of the present disclosure will be explained first:

[0025] Transmission protocol: refers to the rules that must be followed in data transmission to ensure the reliability and integrity of data during transmission. Through the transmission protocol, data can be transmitted stably and efficiently, thereby realizing information sharing. Common transmission protocols include HTTP protocol, TCP protocol, FTP protocol, etc.

[0026] Key: a specific value or string used for encrypting and decrypting data, usually randomly generated to ensure its security and unpredictability. In the encryption process, the key is combined with the encryption algorithm to convert plaintext data into ciphertext data; in the decryption process, the key is used to restore the ciphertext data to plaintext data.

[0027] In practical applications, project file access is an indispensable part of engineering applications. Currently, file access mainly relies on existing structural analysis software, which reads engineering project files stored in local directories based on existing structural analysis software. When loading files from external sources, it usually relies on other network transmission tools or mobile media for file transfer, and at the same time, the loaded external files are subjected to permission verification to ensure the authenticity of the external files. However, this method of loading external files with the help of external tools may face security risks such as data leakage and data tampering, and the transmission path is not completely controllable, resulting in a lack of security for external files during transmission. On the other hand, although permission verification of external files can increase the security of project files, it also makes the file access operation complex and cumbersome, and there is a problem of low file access efficiency.

[0028] Based on this, the embodiments of the present disclosure provide a project file access method, which effectively avoids the risk of leakage of target project files, thereby improving the security and stability of accessing project files.

[0029] Referring to Figure 1 , Figure 1 An optional implementation environment provided by the embodiments of the present disclosure is shown in a schematic diagram, which includes a terminal 101 and a server 102. Specifically, the terminal 101 sends a request for accessing a target project file to the server 102, and the server 102 responds to the request for accessing the target project file, verifies the first access permission of the access object, and sends the target project file to the terminal 101 based on the verification result of the first access permission. In the server 102, the second access permission is configured for the access object, the permission information corresponding to the second access permission is obtained, and the permission information is sent to the terminal 101, so that the terminal 101 sends a request for allowing access to the target project file to the server 102 according to the permission information. The server 102 responds to the request for allowing access to the target project file, and provides access services for the target project file within the permission information range to the access object, so that the target project file is displayed in the terminal 101.

[0030] Referring to Figure 2 , Figure 2 An optional flowchart of a project file access method provided by the embodiments of the present disclosure can specifically include but is not limited to the following steps S201-S204:

[0031] Step S201: In response to a request for accessing a target project file, the first access permission of an access object is verified.

[0032] Specifically, the target project file is a project file that needs to be accessed by the access object, and the target project file can be a certain project file in a project or all project files in a certain project (i.e., a complete project). The first access permission is used to indicate the access permission of the access object to the target project file, and the access permission includes the permission to obtain the target project file. The first access permission of the access object is sent to the database, and the first access permission of the access object is verified in the database. By verifying the first access permission of the access object, it is ensured that the access object has the permission to access the target project file, which helps to improve the security of the target project file. It should be noted that the first access permission of the access object can be verified in the database of the server or in an independent database, and the present application does not make specific limitations.

[0033] Before verifying the first access permission of the access object in response to the request to access the target project file, the access object can select the project file to be uploaded through the target application. After the access object selects the project file, the access object uploads the project file to the server and saves the uploaded project file in a specified directory of the server. The specified directory of the server can be a specified directory in the database of the server, a specified directory in the file storage service provided by the server, or a specified directory in other services of the server, and the present application does not make specific limitations. In order to protect the security of the project file stored in the server, a security policy can be configured in the server, for example, configuring ingress and egress rules, limiting open ports, setting an application interface whitelist, regularly backing up stored project files, etc. By uploading all project files to the server, it can be ensured that all project files are centrally stored and managed, and on this basis, configuring a security policy in the server can reduce the risk of loss or damage of project files, facilitate backup and recovery of project files, and effectively improve the security of project file storage.

[0034] In order to further enhance the security of data storage and data transmission, specifically, when the access object uploads the project file to the server through the target application, the server can be set to only accept connection requests from a specific network address, and the specific network address can be an intranet network address, so as to ensure that only when the target application is logged in in the intranet environment can the project file be uploaded to the server, thereby effectively avoiding potential security risks from external networks.

[0035] Step S202: sending the target project file to the target application based on the verification result of the first access permission.

[0036] The target application is an application logged in by the access object through a login account, and the target application can perform operations such as uploading a project file, requesting to access a project file, and performing a permission operation on a project file.

[0037] Specifically, according to the above step S201, when the verification result of the first access right is that the access object has the access right to the target project file, the target project file is extracted from the database, sent to the server for storage, and then sent to the target application by the server. When the verification result of the first access right is that the access object does not have the access right to the target project file, the target project file is not sent to the access object.

[0038] Step S203: configure a second access right for the access object, obtain the permission information corresponding to the second access right, and send the permission information to the target application, so that the target application sends a request to allow access to the target project file according to the permission information.

[0039] The second access right is used to indicate the operation right of the access object to the target project file, and the permission information thereof includes a permission operation type. The second access right includes a system access right to the entire target project, and the permission operation type includes viewing, editing, deleting, and the like. The second access right also includes an entity data access right to specific project files, project charts, and the like in the target project, and the permission operation type includes displaying, details, adding, editing, deleting, authorization, document viewing, document creation, document modification, and complete control.

[0040] In a possible implementation, in the process of configuring a second access right for the access object, obtaining the permission information corresponding to the second access right, and sending the permission information to the target application, so that the target application sends a request to allow access to the target project file according to the permission information, the process can specifically be configuring a corresponding target access role for the access object, configuring operation recording for the role, determining the second access right of the access object according to the configured target access role, obtaining the permission information corresponding to the second access right, and sending the permission information to the target application. The target access role is a role with a right configured for the access object, and the operation recording for the role is recorded in a permission configuration log. The permission configuration log is used to record information related to permission configuration.

[0041] Specifically, the administrator configures the second access right for the access object. The administrator logs in to the target application through the administrator account. The administrator mainly configures and modifies the access role and permissions. The administrator configures the corresponding target access role for the access object based on the actual work content and actual job position of the access object, associates the target access role with the login account of the access object, records the role configuration operation of configuring the target access role for the access object in the permission configuration log, and uses the permission corresponding to the target access role as the second access right. Then, the role name of the target access role is sent to the server. The server searches based on the role name and obtains the permission information corresponding to the target access role, that is, the permission information corresponding to the second access right. The permission information of the second access right is sent to the target application. When the target application allows the access object to access the target project file, a request to allow access to the target project file is sent to the server; when the target application does not allow the access object to access the target project file, a prohibited access can be displayed on the browsing page of the target application to notify the access object. Since an access role corresponds to at least one type of permission operation, by configuring an access role for the access object, the permission configuration process can be simplified, effectively improving the efficiency of permission allocation.

[0042] Before configuring secondary access rights for access objects, administrators can preset access roles and the corresponding operational permissions based on the specific content of the target project file and the work scope of the access object's actual job position. The preset access roles can correspond to the actual job positions. For example, for an engineering project, the actual job positions include project manager, production manager, quality engineer, surveying engineer, etc., and the corresponding preset access roles can be project manager, production manager, quality engineer, surveying engineer, etc. The preset secondary access rights for the project manager role can be delete, edit, and view; the preset secondary access rights for the production manager role can be edit and view; and the preset secondary access rights for the quality engineer role and the surveying engineer role can be view. This method of setting access objects based on work content and work scope allows the setting of access roles to be dynamically adjusted according to actual project needs, promoting information sharing and collaboration among access objects, effectively increasing the flexibility of permission management, and reducing the maintenance cost of permission management. At the same time, different permissions corresponding to each access role help reduce operational conflicts among access objects and further promote team collaboration and communication.

[0043] Furthermore, when the second access right is entity data access right, before configuring entity data access right for the access role, the access role needs to be authorized. When the access role is authorized to have entity data access right, the entity data access right can be configured for the access role. Specifically, the administrator can authorize the access role to have entity data access right on the first permission management page, where the first permission management page can be the permission management page of the target application or the permission management page of the server database. Figure 3 , Figure 3 An optional schematic diagram of authorizing entity permissions for access roles provided in an embodiment of the present disclosure is provided. Figure 3 All access roles set in the project platform item of the project platform on the first management page are displayed. The displayed information includes the access role's role ID, role name, data level configured for the access role, and the creation time of the access role. Access roles include administrator role, project manager role, production manager role, surveying engineer role, quality engineer role, test engineer role, project team leader role, etc. When the role authorization selection control 301 is checked, the access role is authorized to have entity data access rights. If the role authorization selection control 301 corresponding to the project manager column is checked, the project manager role is authorized to have entity data access rights. Specific entity data access rights can be configured for the project manager role later.

[0044] In addition, when configuring the second access permission for the access object, the administrator can authorize the entity data access permission for the access object on the second permission management page, wherein the second permission management page can be the permission management page of the target application or the permission management page of the server database, refer to Figure 4 , Figure 4 An optional schematic diagram of authorizing an entity to access an object provided in an embodiment of the present disclosure is provided. Figure 4 All access objects in the project platform item of the second permission management page are displayed, and the displayed information includes user account, access object name, contact information, and email address. When it is necessary to temporarily authorize entity permissions for a certain access object, entity permissions can be authorized for the access object in the second permission management page. When the object authorization selection control 401 is checked, the access object is authorized to have entity data access permissions. If the object authorization selection control 401 corresponding to the access object A column is checked, the access object A is authorized to have entity data access permissions.

[0045] It should be further explained that the access role permission mapping table can be configured in the server, and the access role permission mapping table stores the correspondence between the role name and the permission information. The server finds the permission information corresponding to the role name in the access role permission mapping table according to the role name. In addition, the access role permission mapping table can also store the correspondence between the role identifier of the access role and the permission information. In the above process of obtaining the permission information, the server can also find the permission information corresponding to the target access object in the access role permission mapping table according to the role identifier.

[0046] In a possible implementation, the permission configuration log further records the access object behavior mode and the access object organization structure. In the process of configuring the corresponding target access role for the access object, the access object behavior mode and the access object organization structure in the permission configuration log can be analyzed, a new access role can be recommended based on the analysis result, and the corresponding target access role can be configured for the access object based on the new access role. The access object behavior mode is used to describe the operation and rule of the access object when accessing the target project file, for example, the frequency and content of the access object when accessing the target project file. The access object organization structure is used to describe the management structure of the actual work post among all the access objects of the target project file, for example, the project manager manages the production manager, and the production manager manages the measurement engineer. The method of analyzing the access object behavior mode and the access object organization structure can be statistical analysis or clustering analysis, which is not limited in the present application. The new access role is a historical access role that has not been created.

[0047] Specifically, the access object behavior mode of each access object and the access object organization structure corresponding to each project are extracted from the permission configuration log. The access object behavior mode and the access object organization structure are analyzed, for example, the frequency of access, the type of access content, and the number of permission operations of the access object are analyzed. A new access role is generated based on the analysis result, and the new access role is recommended to the administrator. When the administrator adopts the new access role, the new access role can be configured to the corresponding access object in the next role configuration. Alternatively, optimization suggestions for the existing access role can be proposed according to the analysis result, for example, the operation permission of the access role is increased or reduced, the name of the access role is changed, the access role is merged or deleted, and the like. By analyzing the access object behavior mode and the access object organization structure, the recommended new access role or the optimization suggestion for the existing access role can be obtained, which simplifies the role management process, ensures the consistency and rationality of the role configuration, and effectively improves the efficiency of the permission configuration.

[0048] In a possible implementation, after the operation of configuring the role is recorded, specifically, the second access right configured for the access object is modified, the right change operation is recorded, all right change operations in the right configuration log are analyzed, the configuration of the second access right of the access object is evaluated according to the analysis result, an evaluation result is obtained, and the configuration of the second access right of the access object is adjusted according to the evaluation result. The right change operation is recorded in the right configuration log. The evaluation result is used to indicate that the configuration of the second access right of the access object is reasonable, or to indicate that the configuration of the second access right of the access object is unreasonable.

[0049] Specifically, the right information of the second access right configured for the access object is obtained, the right information of the second access right of the access object is modified, for example, the right operation type is increased or reduced, and the like, and the right change operation is recorded in the right configuration log. All right change operations are extracted from the right configuration log and analyzed. The analysis can be performed from the change time, or from the change frequency, and the like. The configuration of the second access right of the access object is evaluated according to the analysis result, and an evaluation result is obtained. When the evaluation result indicates that the configuration of the second access right of the access object is reasonable, the configuration of the second access right of the access object is unchanged, and when the evaluation result indicates that the configuration of the second access right of the access object is unreasonable, the second access right of the access object is adjusted, for example, the right operation type of the second access right is modified, or the target access role of the access object is modified (the second access right is indirectly modified by modifying the target access role). By analyzing and evaluating the right change operation, potential security vulnerabilities, low access efficiency, or right allocation that does not conform to the access process can be identified. On this basis, the right configuration strategy is adjusted based on the evaluation result, which helps to create and optimize more reasonable access roles that conform to the access demand, ensures that the right configuration strategy matches the access demand, and thus improves the security and accuracy of accessing the target project file.

[0050] Further, when the evaluation result shows that the second access right of the access object frequently has other rights beyond the second access right, for example, the second access right of the access object A is display and edit, and the access role of the access object A is often temporarily assigned with the rights of deletion and management, etc., at this time, the access role of the access object A needs to be re-evaluated, the access role of the access object A needs to be changed, or a new access role suitable for the access object A needs to be created. Alternatively, when the evaluation result shows that the second access right of the access object is frequently changed in a short time, or is changed in an abnormal time period (such as non-working hours, etc.), the change of the second access right of the access object can be refused, or the association between the login account of the access object and the corresponding target access role is interrupted, and the access object is not allowed to continue to access the target project file. In addition, for sensitive data in the target project file, access to these sensitive data needs to be strictly controlled, all access operations to the sensitive data are recorded, and the records are audited regularly. According to the audit result, it is checked whether there is abnormal access behavior or potential security risk, and the effectiveness of the current right configuration strategy is evaluated. Alternatively, all historical operation records in the right configuration log can also be evaluated and audited, and the effectiveness of various right configuration strategies is summarized according to the evaluation result and the audit result. The effective right configuration strategy (such as when the right configuration strategy is used, the target project file is not maliciously accessed, or the response speed of accessing the target project file is fast, etc.) is retained, and the redundant right configuration strategy (such as when the right configuration strategy is used, the target project file is frequently maliciously accessed, or the response speed of accessing the target project file is slow, etc.) is removed.

[0051] In a possible implementation, different access roles correspond to different role right levels, and the second access right corresponding to the access role of different role right levels can be merged or inherited. In the process of modifying the second access right configured for the access object, the second access right corresponding to the target access role of the first access object can be obtained, the second access right corresponding to the target access role of the second access object can be obtained, and when the right selection of the first access object penetrates, the second access right of the first access object is the right set of the second access right of the first access object and the second access right of the second access object. Wherein, the role right level of the target access role of the first access object is higher than the target access role of the second access object, and the role right level is used to describe the management hierarchical relationship between the access roles. For example, the project manager role manages the test engineer role, so the role right level of the project manager role is higher than that of the test engineer role.

[0052] Specifically, the second access permission corresponding to the target access role of the first access object is acquired, the second access permission corresponding to the target access role of the second access object is acquired, the second access permission of the first access object and the second access permission of the second access object both include permission information, when the permission selection of the first access object is penetrated, the second access permission of the first access object is the permission set of the second access permission of the first access object and the second access permission of the second access object. For example, the permission of the first access object is management and display, the permission of the second access object is editing and display, when the permission selection of the first access object is penetrated, at this time, the permission of the first access object is management, editing and display.

[0053] When the permission of the first access object is not selected to be penetrated, the second access permission of the first access object and the second access permission of the second access object do not change. Specifically, the second access permission of the first access object and the second access permission of the second access object both include permission information, when the permission of the first access object is not selected to be penetrated, the second access permission of the first access object and the second access permission of the second access object do not change. For example, the permission of the first access object is management and display, the permission of the second access object is editing and display, when the permission of the first access object is not selected to be penetrated, at this time, the permission of the first access object is management and display, and the permission of the second access object is editing and display. Alternatively, when the permission of the second access object is selected to be penetrated and the permission of the first access object is not selected to be penetrated, because the role permission level of the target access role of the first access object is higher than that of the target access role of the second access object, at this time, the second access permission of the second access object and the second access permission of the first access object do not change.

[0054] When the second access permission of the second access object does not exist, the second access permission of the first access object is taken as the second access permission of the second access object. Specifically, the second access permission of the first access object includes permission information, and the second access permission of the second access object does not include permission information, that is, the second access object is not configured with the second access permission. At this time, whether the permission of the second access object is selected to be penetrated or not, the second access permission of the first access object is taken as the second access permission of the second access object.

[0055] By setting the penetration function for the access object with the configured access role, the current permission information can be quickly changed according to the role permission level, and the situation that a certain access object is not configured with the second access permission can be effectively avoided, thereby improving the efficiency of permission configuration.

[0056] In a possible implementation, the target project file is a plurality of project files, the second access permission further includes a file data level, and in the process of determining the second access permission of the access object, the file data level can be configured for the target project file, the permission information configured for the access object can be obtained, the permission operation type can be assigned to the file data level based on the permission information, and the second access permission of the access object can be determined according to the file data level and the permission operation type. The file data level is used for data level division of the target project file, and can be based on the content type of the project file or based on the importance of the project file.

[0057] Specifically, the file data level is configured for each target project file respectively, the permission information configured for the target access role of the access object is obtained, the permission information configured for the target access role of the access object is the permission operation type at this time, the corresponding permission operation type is assigned to each file data level based on the permission information, one of the permission operation types included in the permission information is selected and configured to the file data level, and the second access permission of the access object is determined according to the file data level and the permission operation type. For example, refer to Figure 5 , Figure 5 An optional schematic diagram of the second access permission configuration provided by the embodiment of the application, Figure 5 A third permission management page for configuring the second access permission of the access object configured with an authorized access role is shown, the access role identifier, the access role name, the access object, whether to penetrate, the corresponding permission of the access object, the permission of the data level 1, the permission of the data level 2, and the permission of the data level 3 are displayed in the third permission management page, and the administrator can edit the entity permission of the access object and the permission type corresponding to each data level in the third permission management page. For the access object A represented by the access role 0001, the target access role is the project manager, the permission of the access object A is display, addition, editing and deletion, the editing permission is configured for the data level 1, the display permission is configured for the data level 2, and the display permission is configured for the data level 3. Assuming that file A is configured with the data level 1, file B is configured with the data level 2, file C is configured with the data level 3, and file D is configured with the data level 1, then the access object A can perform editing operation on file A and file D, and can perform display operation on file B and file C. By configuring the file data level in the target project file, the permission isolation can be performed on the data, the flexible configuration of the access permission of the target project file is realized, and the security of accessing the target project file is further ensured.

[0058] Refer to Figure 6 , Figure 6 Another optional schematic diagram of the second access permission configuration provided by the embodiment of the application, Figure 6The fourth permission management page is configured with the second access permission of all access objects, and the authorized objects and all objects are displayed in the fourth permission management page. The authorized objects include the access objects configured with the target access role, and the all objects include the access objects configured with the target access role and the access objects not configured with the target access role. The access objects not configured with the target access role can be directly configured with the permission in the fourth permission management page.

[0059] By configuring the file data level for the project file, fine-grained permission control can be performed on each project or project file, so that each access object can only access the project file in the permission information range, data damage caused by multiple accesses is avoided, sensitive information is protected from being accessed at will, and the security and stability of the target project file are further improved.

[0060] Step S204: In response to the request for allowing to access the target project file, the access service of the target project file in the permission information range is provided to the access object.

[0061] According to the above steps S201 to S203, the server responds to the request for accessing the target project file, verifies the first access permission of the access object, and sends the target project file to the target application when the verification result of the first access permission indicates that the access object is an authorized access object. Then, a plurality of access roles are preset in the server, the second access permission is configured for the access object according to the configured access role, the permission information corresponding to the second access permission is obtained, and the permission information is sent to the target application. The target application sends a request for allowing to access the target project file to the server according to the permission information, and the server provides the access service of the target project file in the permission information range to the access object in response to the request. The access service in the permission information range includes an access service range determined according to the file data level and the permission operation type, for example, file A is configured with data level 1, file B is configured with data level 2, and file C is configured with data level 1. The second access permission of the access object is to edit the data level 1 file, and the access service in the permission information range corresponding to the access object is to access file A and file B, and not to access file C.

[0062] In a possible implementation, when the access service of the target project file in the permission information range is provided to the access object, specifically, the access service of the target project file in the permission information range is provided to the access object in response to the request for allowing to access the target project file, the target project file is transmitted according to the first transmission protocol, so that the target project file is displayed in the browsing page of the target application. The first transmission protocol is used to transmit the target project file between the target application and the server, and can be a hypertext transfer protocol.

[0063] Specifically, the server responds to the request for allowing access to the target project file, and the request for allowing access to the target project file carries the second access right of the access object. The file storage service of the server provides the access object with the access service of the target project file in the permission information range corresponding to the second access right of the access object according to the second access right of the access object, for example, opens an access port for accessing the target project file to the access object, so that the target application can connect to the access port provided by the server. Then, the target project file is loaded from the secure directory of the file storage service of the server, transmitted from the server to the target application through the network according to the first transmission protocol, and displayed in the browsing page of the target application. Since the first transmission protocol allows transmission of multiple types of data and can reduce network delay and bandwidth occupation, transmission of the target project file through the first transmission protocol can improve the response speed of the server and help improve the transmission efficiency of the target project file.

[0064] Further, the server can also use a caching mechanism to cache the project file to the memory area of the server. When the target project file accessed by the access object is cached in the memory area, the target project file can be directly loaded from the memory area, reducing the operation of repeatedly loading the target project file from the secure directory of the server, and also reducing the number of network requests, effectively improving the response speed of the server, and further improving the efficiency of accessing the target project file.

[0065] In a possible implementation, the first transmission protocol and the second transmission protocol are combined to perform encrypted transmission of the target project file. The second transmission protocol generates a first key during the transmission process. When the accessed target project file is transmitted according to the first transmission protocol, the first key can be obtained, the target project file is encrypted based on the first key to obtain first encrypted data, and the first encrypted data is transmitted to the target application, so that the target application decrypts the first encrypted data based on the first key to obtain the restored target project file. The first key is used to perform encrypted transmission of the target project file during the file transmission process, including a public key and a private key; the second transmission protocol is used to encrypt the transmitted target project file, which can be a secure socket layer protocol or a transmission layer security protocol.

[0066] Specifically, the first key generated by the second transmission protocol in the transmission process is acquired, the target project file is encrypted based on the public key of the first key to obtain first encrypted data, and the first encrypted data is transmitted to the target application through the first transmission protocol. The target application decrypts the first encrypted data based on the private key of the first key to obtain the restored target project file, and displays the restored target project file in the browsing page of the target application. By encrypting the target project file using the second transmission protocol, the transmission security of the target project file can be ensured, even if the target project file is intercepted, information cannot be easily obtained therefrom, and the risk of leakage of the target project file is effectively avoided.

[0067] In a possible implementation, in the process of acquiring the first key, specifically, in response to an access request sent by the target application, the server sends verification information to the target application for verification. The target application verifies the authentication certificate. When the verification is passed, a third key is randomly generated, the third key is encrypted according to the second key to obtain second encrypted data, the second encrypted data sent by the target application is received, and the second encrypted data is decrypted to obtain the restored third key. The access request carries a first random string, the first random string is randomly generated by the target application and is used to generate the first key; the verification information carries to-be-authenticated information and a second random string. The to-be-authenticated information is information provided by the server for verifying the authenticity of the server, including the second key and the authentication certificate. The second key is a public key provided by the server and is used to encrypt the key generated by the target application. The authentication certificate is used to verify the identity of the server. The second random string is randomly generated by the server and is used to generate the first key.

[0068] Specifically, the server responds to the access request sent by the target application to make the target application connect to the server, and then sends the to-be-authenticated information and the second random string to the target application. The target application verifies the authentication certificate in the to-be-authenticated information. When the verification is passed, a third key is randomly generated, the third key is encrypted by the second key to obtain second encrypted data, and the second encrypted data is sent to the server. After receiving the second encrypted data, the server decrypts the second encrypted data by using the private key corresponding to the second key to obtain the restored third key.

[0069] Then, the first key is generated based on the first random string, the second random string and the third key. Specifically, at this time, the target application and the server both hold the first random string, the second random string and the third key, and the first key is generated in the target application and the server based on the first random string, the second random string and the third key through the key generation function, and the target project file is encrypted and transmitted based on the first key. Since the first random string, the second random string and the third key are randomly generated by the target application or the server, the first key generated based on the first random string, the second random string and the third key has high security and confidentiality, and the security of the target project file in the transmission process is effectively improved.

[0070] It should be further noted that each time the target application establishes a connection with the connection server, a new first key is regenerated according to the above steps. Even if the first key used in a certain transmission process is leaked, the encrypted data in other transmission processes will not be threatened, effectively avoiding the risk of large-scale interception or tampering of transmission data, and further improving the security of the target project file in the transmission process.

[0071] In addition, in the process of encrypted transmission of the target project file, the second transmission protocol not only can encrypt the target project file, but also provides a data protection mechanism that can ensure that the target project file is not tampered with in the transmission process to protect the integrity of the transmission data. If the target project file is modified during transmission, the target application or the server as the receiver can compare the generated check value with the received target project file during transmission. When the comparison result shows that the check value and the received target project file are inconsistent, the target application or the server can refuse to receive the target project file, thereby avoiding the receiver from being attacked by abnormal attacks implanted in the middle.

[0072] It should be further noted that the operation of uploading the project file to the server in steps S201 to S203 and the operation of sending the target project file between the target application and the server are both encrypted transmission of the project file through the first transmission protocol and the second transmission protocol. The uploading process refers to the transmission process in step S204, which will not be described here.

[0073] In a possible implementation, when the application scenario of the embodiment of the application is to access the engineering project file, refer to Figure 7 , Figure 7 An optional overall process of the project file access method provided by the embodiment of the application.

[0074] Firstly, the access object selects the engineering project file to be uploaded through the target application, uploads the engineering project file to the server through the first transmission protocol and the second transmission protocol, and saves the uploaded engineering project file in a designated secure directory of the server to ensure that all engineering project files can be centrally stored and managed. In order to protect the security of the engineering project files stored in the server, the server is configured with access rules, open port restrictions, and other security policies such as regular backup of stored engineering project files. In addition, in order to further enhance the security of data storage and data transmission, only the access object is allowed to access the server through the internal network address, and external access is restricted by deploying an internal network environment to enhance the security of the engineering project files.

[0075] Next, the access object sends a request to access the target engineering file through the target application, and the request carries the first access permission of the access object. The server responds to the request and verifies the first access permission in the database. When the verification result of the first access permission indicates that the access object can access the target engineering file, the target engineering file is extracted from the database, sent to the server for storage, and then sent to the target application by the server.

[0076] Next, the administrator can preset the access role according to the specific content of the target engineering file and the actual work range of the access object's work post, for example, in the engineering project, the access role can be a project manager role, a production manager role, a surveying engineer role, a quality engineer role, a test engineer role, etc. In the fifth permission management page, a series of operation permissions corresponding to the access role are configured, which can be system operation permissions for the whole target project, such as viewing, editing, deleting, etc. Then, in the first permission management page, the access role is authorized with entity data access permissions, and when the access role is authorized with entity data access permissions, the access role's corresponding entity data access permissions can be configured in the third permission management page, which are operation permissions for specific files, charts, etc. in the target project, such as display, details, increase, edit, delete, authorization, document viewing, document creation, document modification, full control, etc.

[0077] When the access object is not currently configured with an access role, the administrator configures the corresponding access role for the access object, and associates the login account of the access object with the configured access role. When the corresponding access role of the access object needs to be modified later, the access role associated with the login account of the access object can be flexibly adjusted according to the engineering project requirements. It should be noted that in the permission management page, in addition to configuring permissions for access roles, permissions can also be configured for other access objects that do not configure access roles.

[0078] In addition, the system operation permission of the whole target project can be configured for the access object in the first permission management page, the entity data access permission of the access object can be authorized in the second permission management page, and the entity data access permission corresponding to the access object can be configured in the third permission management page.

[0079] In addition to the permission configuration for the access role and the access object, the permission of a certain engineering project or engineering project file can be configured and managed, and a certain engineering project or engineering project file can be configured with a specific access role or a specific access object that can be accessed. Specifically, the permission of a certain engineering project or engineering project file is refined, for example, the file data level of entity data such as engineering files, tables, and diagrams can be configured. By configuring different permissions for the file data level, the file data level is configured to different access roles and access objects. When the file data level configured by the access role or the access object does not match the file data level of the engineering project file, the engineering project file cannot be operated, and the permission is further isolated on the data, achieving a high flexibility effect of the engineering project permission configuration.

[0080] Next, the access role configured for the access object is sent to the server, and the server obtains the permission information corresponding to the access role from the database based on the access role, and sends the permission information to the target application. The target application verifies whether the access object is the corresponding access role or has the corresponding operation permission according to the permission information. When the access object is the access role that meets the condition and has the corresponding operation permission, the access object is allowed to access the target engineering file. At this time, a request for allowing the access object to access the target engineering file is sent to the file storage service of the server, and the file storage service provides the access service of the target engineering file for the access object in response to the request; when the access object is the access role that does not meet the condition and does not have the corresponding operation permission, the access object is denied to access the target engineering file.

[0081] When the access object is the access role that meets the condition and has the corresponding operation permission, the target engineering file is loaded from the security directory of the file storage service of the server, the target engineering file is encrypted based on the first key generated based on the second transmission protocol, the target engineering file is transmitted based on the first transmission protocol, the target engineering file is transmitted from the server to the target application, and the target engineering file is displayed in the Web page of the target application. In addition, the server can use a cache mechanism to cache the project file to the memory area of the server, so that the server can directly load the target project file from the memory area to reduce the operation of repeatedly reading the target engineering file from the security directory, thereby speeding up the response speed of accessing the target engineering file.

[0082] In addition, the administrator can dynamically modify the access role and the access right of the access object in the right management page, record all the right change operations, and use the record for subsequent review and troubleshooting, and also for improving the right configuration strategy. After the transmission is completed, the potential security vulnerabilities, low operation efficiency, or right allocation that does not conform to the business process can be identified by analyzing the right change record, the effective right combination and the redundant right combination can be identified by analyzing the historical right configuration operation, and the access object user behavior and the access object organization in the right configuration log can be statistically analyzed to recommend a suitable new access role for the administrator or to provide optimization suggestions for the existing role. In addition, a graphical interface can also be developed according to the relationship between the access object and the right, so that non-technical personnel can also intuitively view and manage the right configuration.

[0083] The project file access method provided by the embodiments of the present disclosure can realize the sharing access of the target project file by the various access objects by uploading the project file to the server for centralized management, deploying an intranet to limit external access, providing fine-grained right control for the project file based on role configuration and file data level configuration, and using the combination of the first transmission protocol and the second transmission protocol for the transmission of the project file, effectively avoiding the risk of leakage of the target project file, thereby improving the security and stability of the access project file.

[0084] The terms "first", "second", "third", "fourth" and the like used in the description of the present disclosure and the above drawings, if any, are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances to describe the embodiments of the present disclosure, for example, the embodiments can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0085] It should be understood that in the disclosure, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that there are three cases of only A, only B, and A and B at the same time, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0086] It should be understood that in the description of the embodiments of the disclosure, the meaning of multiple (or multiple) is two or more, greater than, less than, more than, etc. It is understood that the number is not included, and the above, below, etc. It is understood to include the number.

[0087] In several embodiments provided by the disclosure, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division, and actual implementation can have another division manner. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other form.

[0088] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0089] In addition, each functional unit in each embodiment of the disclosure can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0090] If the integrated unit is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present disclosure, essentially or in other words, the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and various media that can store program codes.

[0091] It should also be appreciated that the various embodiments provided by the present disclosure can be combined in any manner to achieve different technical effects.

[0092] The above is a specific description of the preferred embodiments of the present disclosure, but the present disclosure is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present disclosure, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present disclosure.

Claims

1. A project file access method, characterized in that: include: In response to a request to access a target project file, verifying a first access permission of an access object, wherein the access request operation of the access object is performed in a target application; sending the target project file to the target application based on a verification result of the first access authority; configuring a second access permission for the access object, obtaining permission information corresponding to the second access permission, and sending the permission information to the target application so that the target application sends a request for allowing access to the target project file according to the permission information; In response to a request for allowing access to the target project file, providing the access object with an access service to the target project file within the scope of the permission information; in response to an access request sent by the target application, sending verification information to the target application for verification by the target application, wherein the access request carries a first random string, the verification information carries information to be authenticated and a second random string, the information to be authenticated includes a second key and an authentication certificate; verifying the authentication certificate based on the target application; when the verification passes, randomly generating a third key; encrypting the third key based on the second key to obtain second encrypted data; receiving the second encrypted data sent by the target application; decrypting the second encrypted data to obtain the restored third key; generating a first key based on the first random string, the second random string, and the third key; encrypting the target project file based on the first key to obtain first encrypted data; transmitting the first encrypted data to the target application, so that the target application decrypts the first encrypted data based on the first key to obtain the restored target project file, and displaying the target project file on a browsing page of the target application.

2. The project file access method according to claim 1, characterized in that: The configuring a second access permission for the access object, obtaining permission information corresponding to the second access permission, and sending the permission information to the target application so that the target application sends a request for allowing access to the target project file according to the permission information, includes: Configure a corresponding target access role for the access object and record the role configuration operation, wherein the permission configuration operation is recorded in the permission configuration log; Determining the second access permission of the access object according to the configured target access role; The permission information corresponding to the second access permission is obtained, and the permission information is sent to the target application.

3. The project file access method according to claim 2, characterized in that: The permission configuration log also records the access object behavior pattern and access object organizational structure. The configuration of the corresponding target access role for the access object includes: Analyze the access object behavior pattern and the access object organizational structure in the permission configuration log, and recommend new access roles based on the analysis results; The corresponding target access role is configured for the access object based on the new access role.

4. The project file access method according to claim 2, characterized in that: After configuring a corresponding target access role for the access object and recording the role configuration operation, the project file access method further includes: Modify the second access permission configured for the access object, and record the permission change operation, wherein the permission change operation is recorded in the permission configuration log; analyzing all the permission change operations in the permission configuration log, and evaluating the configuration of the second access permission of the access object based on the analysis result to obtain an evaluation result, wherein the evaluation result is used to indicate that the configuration of the second access permission of the access object is reasonable, or is used to indicate that the configuration of the second access permission of the access object is unreasonable; The configuration of the second access permission of the access object is adjusted according to the evaluation result.

5. The project file access method according to claim 4, characterized in that: Different access roles correspond to different role authority levels, and modifying the second access authority configured for the access object includes: Obtaining the second access permission corresponding to the target access role of the first access object, and obtaining the second access permission corresponding to the target access role of the second access object, wherein the role permission level of the target access role of the first access object is higher than that of the target access role of the second access object; When the permission selection of the first access object is through, the second access permission of the first access object is a permission set of the second access permission of the first access object and the second access permission of the second access object; When the permission of the first access object is not selected to be through, the second access permission of the first access object and the second access permission of the second access object remain unchanged; When the second access permission of the second access object does not exist, the second access permission of the first access object is used as the second access permission of the second access object.

6. The project file access method according to claim 2, characterized in that: The target project file includes multiple project files, the second access permission further includes a file data level, and determining the second access permission of the access object includes: Acquire the permission information configured for the access object, wherein the permission information includes a permission operation type; The file data level is configured for the target project file, the permission operation type is assigned to the file data level based on the permission information, and the second access permission of the access object is determined according to the file data level and the permission operation type.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the project file access method according to any one of claims 1 to 6 when executing the computer program.

Images